Managed EDR

Would be good to collect the Mac logs into the SIEM its a requirement for some of our clients right now and makes sense to be in Huntress.

Additional MDM providers added to make the deployment of Huntress EDR for MacOS seamless. Currently vetting out vendors so leaving agnostic. Please do suggest MDM vendors you'd like to see us working with!

Adding additional insights into file and application based malware/attacks

This update to the EDR Agent software for MacOS will stop unauthorized removal as well as making any attempt to stop associated processes or elements more difficult, which would render the EDR non-functional.

After a user (or Huntress admin) removes the Huntress agent from a computer, I would like the computer to still be searchable in the Huntress admin console displaying the computer's information from its last check-in + the removal date.

Currently, the Mac endpoint does not perform scans after 24 hours, and the console shows 0 scans. It would be beneficial to have the ability to manage and schedule antivirus scans directly from the Console for Mac endpoints, similar to other platforms. This feature would enhance the usability and effectiveness of the antivirus tool for Mac users.

I noticed that macOS agents with Defender for Endpoint activated show 'Active (XProtect)' instead of 'Active (Defender)' in the defender portal. It would be helpful to identify devices that might miss Defender quickly if the UI displayed Defender status instead of XProtect when Defender is active.

Does anyone have a recommendation on how to monitor a Mac endpoint running Huntress, that the Huntress agent is functional and healthy? Like on Windows we use our RMM to check that the Huntress service is running and run a powershell script daily to check for if the agent became orphaned.

I am working on improving the macOS Huntress Agent deployment script to avoid unnecessary reinstallation. The script should check if the agent is already installed and up to date. However, the official Huntress Release Notes and Agent Version page does not reflect the actual installed version number. I need a reliable, official live source for the current macOS version number to compare against the installed version.

Huntress currently lacks support for Ransomware Canaries and SIEM on MacOS, which are available on Windows. Adding these features to MacOS would provide a more comprehensive security solution, aligning the capabilities across different operating systems and improving threat detection and response for Mac users.