SOC/Incident/Investigations/Escalations

We would like to have the ability to customize the email notifications for the escalations so we can include more context to the notifications with links to our SOPs and documentation.

Customers on Starlink are being flagged as accessing from Mexico. SpaceX's IP address range 129.222.0.0/16 seems to trigger this. It would be nice if Huntress could differentiate Starlink IPs. Right now our only options are to whitelist Mexico or simply ignore these alerts. Instead of whitelisting Mexico, it would be nice if we could whitelist an IP range.

This is generating some noise, and would be nice to be able to customize this, or at least select who would receive notifications on this.

This update will give Customers and Partners the ability to configure the details of where, when and who an Escalation will be sent to and reduce frequency of notifications

This update will allow for Customers and Partners to see the full timeline of adversary actions taken, detection triggered, and investigative and remediation actions taken by Huntress SOC analysts, in a chronological timeline view

Is there any plan to implement a feature to be able to export 'Incidents' to a CSV? This feature would be greatly appreciated.

It would be great to allow RMM access to an isolated machine so that we can continue to remote in and work on the device based on the Screenconnect Hosts page you keep track of. I know there are aspects that make this challenging, but being able to investigate and connect to our remote devices that are experiencing an incident would be very much appreciated. Thanks!

Starting with Ransomware detections, correlate signals between different Huntress products to uncover suspicious activity, tying compromised identities and endpoints together.

I would like the ability to have email escalations set at the organization level rather than just the account level. This would ensure that subtenant administrators receive necessary notifications directly, improving communication and response times.

Currently, the emails we receive do not contain the company name in the body, which makes it difficult to identify the relevant organization. It would be beneficial to have the company name included in the email body for easier identification and management, especially for MSPs handling multiple organizations.