Changes Made to Unwanted Access (VPN/Location) Escalations
complete
J
Jacob Adams
Recently, a change was made to the UI in the escalations overview. Formerly, the overview for a specific location in a specific tenant would contain all of the identities that were found to violate a specific country rule in aggregate. I believe this still happens, but links to the identity page in the "Identities" section are no longer present.
Currently, the UI lists the identity, but no link to view the identity page for the purposes of reviewing recent activity. Additionally, the descriptions of the escalation have become less descriptive. Now we're getting escalations titled "Huntress ITDR High Escalation | Unexpected Country - Spain (Customer)" whereas before we were getting escalations like [Huntress Escalation] Login from unexpected country - Austria by user@example.com.
The UI is fine, but a hyperlink to the relevant identity's activity page would be appriciated.
Photo Viewer
View photos in a modal
Autopilot
Merged in a post:
VPN/Location Escalations
Brian Fischer
We have had a few techs adding expected/unauthorized rules to the Account level, where it should be on the identity. Looking at the Escalation layout, I can see how if someone is not paying attention, they can mix up how to add. If possible, I would like to see the Escalation resolution options be clearer for the tech handling.
Photo Viewer
View photos in a modal
Rich Mozeleski
updated the status to
complete
Made this update in the escalation view yesterday.
K
Kirk Engard
I was going to mention the same thing. I need to see where and how they usually log in from to determine how to react.
P
Pat Catalfamo
We are also struggling with the new alerting format. The new escalation notifications should contain the same subject/summary as the incidents.