Integrations, Webhooks, APIs

We have realized that one of our ITDR integrations was marked as "unhealthy" and needed to be re-synced, but it did not generate a ticket to our PSA. I do not see a way to configure alerts for this, and it would be helpful to be able to have alerts for this sent to our PSA so we can fix it before incidents are missed.

Ability to create email integrations at the organization level so incident reports for certain organizations will be sent to them and not the account level emails.

Rewst is a common tool used in MSP's and supported webhook authentication by providing a secret value published under the "x-rewst-secret" key, which is supported by CIPP and other tools to authenticate webhooks. Rewst does not yet support Svix signatures, but this would be a good addition in the meantime to secure webhook endpoints using Rewst's native functions. See https://docs.rewst.help/documentation/automations/intro-to-triggers/use-cases-and-examples/using-webhook-triggers#set-trigger-parameters .

I wanted to share product feedback based on what I am seeing with SMB and mid-market clients. Huntress already covers a major part of the risk stack with EDR, ITDR, SAT, SIEM, and now ESPM/ISPM. The gap I see is the browser. A growing amount of compromise is happening before traditional endpoint tools get a clean signal. The main use cases are: ClickFix-style attacks where users are tricked into copying and running malicious commands from fake CAPTCHA, fake Cloudflare, fake browser update, or fake document pages. Malicious browser extensions that collect credentials, hijack sessions, inject scripts, exfiltrate data, or abuse permissions after being installed by the user. SaaS and identity abuse where users approve rogue OAuth apps, reuse passwords, enter corporate credentials into unmanaged apps, or upload sensitive data into shadow SaaS and AI tools. This feels like a natural Huntress expansion because these attacks sit between endpoint, identity, and SaaS. Today, the practical answer is to use Intune/GPO/Chrome Enterprise/Edge policies for extension governance and a separate browser-native tool such as Push Security for in-browser user protection. That creates another tool, another agent/extension, and another dashboard for MSPs. The ideal Huntress capability would be a lightweight managed browser extension or browser-security module that can: Detect ClickFix behavior, including malicious copy/paste instructions, fake verification flows, and suspicious browser-to-command execution paths. Inventory Chrome and Edge extensions across managed endpoints. Score extensions by risk based on permissions, publisher reputation, install source, update behavior, and known malicious indicators. Alert on risky extensions, new high-permission extensions, sideloaded extensions, and suspicious extension changes. Help enforce extension allowlists or integrate with Intune/Chrome/Edge policy management. Detect corporate password reuse or credential entry into unapproved sites. Detect risky OAuth grants and connect that back to Huntress ITDR. Warn users in-browser before they enter credentials, approve OAuth access, copy malicious commands, or upload sensitive data into risky SaaS/AI tools. Give MSPs simple client-facing reporting: risky extensions, risky SaaS usage, browser-driven phishing exposure, and user behavior trends. The business reason is simple: attackers are moving into the browser because it is where identity, SaaS, credentials, AI tools, and user decision-making all meet. Huntress already has strong coverage after compromise. A browser-native protection layer would help move Huntress closer to prevention without losing the managed detection value that makes the platform useful for SMBs. My ask: please consider adding browser extension governance and ClickFix/browser-native protection to the roadmap, either as part of ITDR, ESPM, ISPM, or as a dedicated managed browser security module. This would be highly valuable for MSPs and small security teams that want Push Security-like browser protection without adding another standalone platform.

Would love to see the ability to close a PSA ticket, and in turn, that resolves the incident.

Integrate with Syncro billing to update customer invoices with Huntress agent count.

Integration with Yubikey for MFA.

Hello Team, Right now the Huntress API uses basic auth for authentication which forces us, your customers, to create a myriad of accounts for each case (we have to create multiple accounts and grant them privileges depending on the use case since scoping is done at the user account level) which is cumbersome. Changing to real API keys would solve this problem as it will allow as to setup scoping on the API key at creation time. A user with permissions to create API keys would be able to select the scopes at creation time thus removing the requirement of creating a new user for each use case.

Excactly as the title says. No more, no less.

You have everything BUT the option to select what Status in the ticket. Right now it just uses the default for that board but would like to select a status that I want.