GWS Isolation/Suspension/Lockout
M
Matthew Nelms
Please add this feature, just like it is already working in M365. What good are session sign outs, if the attacker can just sign back in. User accounts should be allowed to be locked out/isolated/suspended, not just 'signed out'. May not continue my ITDR trial until this is working, as most of my clients are GWS. Would also be nice to see some more 'basic' security features available for GWS.
See huntress current available feature comparison: https://support.huntress.io/hc/en-us/articles/49300628099859-Understanding-the-Differences-Between-ITDR-for-Microsoft-365-and-ITDR-for-Google-Workspace
C
Calin Andrews
Huntress currently states the following regarding this:
"When an identity included in ITDR for Google Workspace is compromised, Huntress will Revoke Access to the account which will result in all currently signed in sessions being signed out.
Due to the nature of suspension steps within Google Workspace, we are currently not isolating further. Suspension within Google will disconnect more than just email services and may be considered excessively disruptive if performed without user knowledge."
reference: https://support.huntress.io/hc/en-us/articles/49463229642771--Google-Workspace-Huntress-Identity-Isolation-for-ITDR-for-Google-Workspace
I don't fully follow the logic behind that. I think revoking the session without disabling/suspending the user will achieve containment for the majority of compromise scenarios, but not necessarily in all cases.