Managed EDR

When the portal tells us a machine has "Other AV" Would be nice to know exactly which AV so we can action faster, thanks!

We have had several endpoints where Windows Defender shows as healthy and managed, but the settings on the endpoint are out of sync with the managed settings for some reason. This is resolved by setting the endpoint to audit mode, and then flipping it back to enforced mode, but I feel like we really need a way to be able to get these reported to us, and either have an automated remediation of doing this, or at least notify us so that we can perform this action as needed vs finding these machines by random chance.

https://docs.microsoft.com/en-NZ/microsoft-365/security/defender-business/?view=o365-worldwide

To enable better reporting via RMM, it would be nice to enable notifications for Defender detections. Including those which are low-severity or automatically remediated.

One of the key components of Windows Defender is the Attack Surface Reduction (ASR) Rules. In my opinion, the ASR rules is what makes Defender such a powerful platform. It would be great if we could include the ability to turn on, manage, and add exclusions for the ASR rules in huntress. Other competitor platforms can do this and it works quite well. These rules exponentially expand the effectiveness of Defender.

Be able to force enable defender when defender is disabled.

I encountered an issue where a manual scan was consuming 100% CPU resources, and I couldn't find a way to stop it through the console or on the endpoint. It would be beneficial to have the capability to cancel a manual scan mid-scan to better manage resources from an admin perspective.

Posting on behalf of a partner I worked with. This pertains to the Managed Exclusions UI: "can't sort alphabetically. filter has to be the exact string of the exclusion, can't be just a keyword. Exact string is also case sensitive. No ability to export exclusions into excel as a workaround. does not show how many pages of exclusions there are (only shows a "next page button" and what page number the next page will be. You "unlock" the next page by clicking on that button) reviewing what we have in there is a nightmare. It used to be better, what happened?"

When migrating from another AV, we want the ability to import the list (when properly formatted) so we don't need to enter them one at a time.

Would like an automate uninstall script that we can use when offboarding individual workstations instead of having to manually remove them.