Managed EDR

When enforcing SSO it would be nice to be able to exclude an account as a breakglass that could be used in the rare circumstance a certificate every expired we could use that to navigate back into the console and renew it.

Partners could establish what RMM they use and if another RMM appears on a machine under their management, an alert/isolation could take place. This could prevent an attacker from leveraging what's typically viewed as trusted RMM software as a persistence mechanism other than an autorun.

Comments were added to incidents, but they do not exist for escalations. This same functionality would be a welcomed addition to escalations for the same purpose.

For what it is worth, it takes a very long time for the Huntress console to report that a computer has been rebooted. When a computer is rebooted, Kasaya VSA will show it within a minute or two, however Huntress may not show it for 30 minutes or more. This means that I will typically resolve the incident before waiting for Huntress to acknowledge that the host has rebooted. The downside of this is that the Incident will show "Huntress Assisted Remediations bypassed; report resolved by user" in the Remediation column of the Incidents page, which is not entirely accurate.

Show installed software and any CVEs attached to that version of software. This is handy when checking machines which require updates for things like Cyber Essentials.

Addition of comments to platform is great, but it would be improved by having the comment field displayed when resolving an incident as well. Noticed that there are some areas where this exists, such as rejecting an incident as the comments entered on that page get populated into the comments on the incident. However, when resolving an incident or approving remediations - there isn't any text field to provide comments/notes that can then make it into the comments on the incident. Please add comment/notes field to the resolve options on incidents.

Can we have an External Recon rescan button please to test an IP address after adjusting Firewall rules to confirm the port is no longer open from the outside world instead of having to wait up to 2 weeks for Shodan to rescan the IP.

Check to see if Ransomware Data Recovery is enabled in Windows Defender.

Please add source VPN IP address to the escalations where there is unrecognized VPN traffic.

Please can Huntress look at incorporating Microsoft Smartscreen DNS filtering into the Huntress Managed Anti Virus offering as per: https://petri.com/microsoft-defender-endpoint-network-web-protection-macos-linux/ Thanks