Defender Disabled Escalations (Alerts)

We are rolling out a new Escalation type for Managed Antivirus endpoints that use Microsoft Defender as the primary antivirus. This escalation will trigger for any endpoint that is set to Enforce for Managed Antivirus and the Microsoft Defender Real-time Protection engine has been disabled for longer than 2 hours. There is an ‘Email (Escalations)’ field in the Integration settings in Huntress that determines who is notified when this happens.

Learn more about Huntress Escalations and get answers to your questions.