SOC/Incident/Investigations

Having the ability to "release all" isolated endpoints with a single click would be nice as it can get tiring having to manually release each endpoint when more than 10-15 are isolated on an org-wide incident.

Please add the ability to add comments to the incidents, as that would improve communication between our team, so they don't have to login to the ticket system and find the ticket to see what the update is.

During large-scale or successful lateral movement incidents, we would like to speak with a Huntress security analyst for additional background and guidance, beyond what is listed in the incident report. A 1-hr SLA would be fine.

When Windows Defender detects blocked Brute Force login attempts to a device, please can Huntress Trigger an Incident investigation which would in turn create a open ticket in our sytems to also investigate.

When automatic and auto-approved remediations are enabled, and when manual remediations are required by the MSP for an incident, the incident should not be resolved until manually resolved by the MSP. Example event: There has been a compromised user within Active Directory and one of the manual remediation tasks is to reset the user's password. Huntress isolates the host. One of the steps for remediation in the example above was to reboot the host, which part of our standard patching our RMM did reboot the host. When the machine booted back up, Huntress thought that was a remediation step which took the host out of isolation automatically. However, the user's password had not been changed and by removing isolation had opened the machine up to further attacks. The incident should remain active until the password has been rotated and should only be manually resolved. The host should also remain isolated until all manual remediations have been completed. Further information can be found in ticket 102738.

Would love to see the ability to close a PSA ticket, and in turn, that resolves the incident.

Can you add the texts and robocalls for critical incidents at the organization level? It would be nice to be able to set this up for IT managers, etc. at individual customers.

We receive a ticket now for hosts isolated by the Huntress team as a part of an investigation, but we'd also like a ticket for any manual host isolations performed. If someone calls in because their device can't access the internet, I want a tech to be able to easily identify that as the reason within our ticketing system. If they weren't the tech that isolated within Huntress, they'd have no way of knowing it was triggered there unless they had credentials to the Huntress dashboard and thought to look there.

It would be helpful to communicate with the SOC following an escalation through a chat feature.

It would be nice if an email was sent when remediations were ran stating if they were successful or not so we can automate it into our ticketing system.