List all Potentially Unsecured Credentials outside of Incident Reports
complete
A
Alan Bishop
Since Huntress Potentially Unsecured Credentials have a 30 day cool-down between Incident Reports this can leave partners unaware if the machine has detections for multiple files. This data is normally only exposed to partners via Investigated Signals or Incident Reports, both of which do not populate with new PUC data inside the 30 day cool-down. If we had a central place partners could view these detectors partners could tackle all of these files at once rather than wait for reports to trickle in over time.
* Request from ticket 115283
Russ Bashaw - Huntress
updated the status to
complete
Hi all, we've updated this capability with a new dashboard to view the entirety of all the files like you've alluded to Alan and Roy. We also now have allow-listing functionality so you can mute specific detecting and alerting of files you know are false positives or are files that cannot be removed. Check it out at /account/credential_files or through the Process Insights dashboard within EDR. Thanks for the feedback!
Russ Bashaw - Huntress
updated the status to
complete
Hi all, we've updated this capability with a new dashboard to view the entirety of all the files like you've alluded to Alan and Roy. We also now have allow-listing functionality so you can mute specific detecting and alerting of files you know are false positives or are files that cannot be removed. Check it out at /account/credential_files or through the Process Insights dashboard within EDR. Thanks for the feedback!
C
Christopher Sutherland
Russ Bashaw - Huntress
nice, in your KB: https://support.huntress.io/hc/en-us/articles/21966460493331-Potentially-Unsecured-Credentials
it's mentioned:
At this time Huntress does not allow for file directory or file type allow-listing. This is a feature we hope to provide in the future.
do we need a new feedback suggestion for this?
R
Roy Denman
Would be nice to have more granular control over exclusions for this and the other features. Current options are all or nothing.
J
Jordy Minnebo
Great idea