Integrations

Ability to create email integrations at the organization level so incident reports for certain organizations will be sent to them and not the account level emails.

Allow that ability to link different products (EDR/ITDR/SAT/SEIM) to different contracts in Autotask rather than all of them being tired to one Contract for Billing Update purposes.

We enabled SSO with Microsoft Entra. It still requires us to manually create the user within Huntress before they can login. Many other applications that we integrated have an "auto provision" setting. When enabled this will automatically create the user in Huntress as long as they're part of security group on the Entra Enterprise Application. Some of the better ones even have mapping logic where you can map specific Entra Groups to specific permissions on the application (huntress) side.

We would like to see a billing integration between Huntress and HaloPSA. Ideally this would push license counts for all Huntress products (EDR, ITDR, SAT, SIEM) to each of our customer records in HaloPSA and allow us to link the invoice quantities with licenses in use.

An additional integration option for event updates that initiates a HTTPS callback and posts detailed JSON data about the event. It will allow faster response and wider range of integration options and much more preferable then having to parse an email.

We are using the billing sync feature to sync into Autotask. There seem to be failures from time to time. I would also like to be able to send either tickets into a PSA or an email to ensure that we are proactively notified of billing sync issues without needing to come and manually check for sync issues on our sync day each month. This would also go hand in hand with a previous feature request I made for being able to 'sync now' at customer / product level so that we can test the connectivity between Huntress and PSA and know we've resolved the issue.

Add the ability to ingest telemetry from Crowdstrike Falcon into the Huntress to allow the SOC to have visibility acoss endpoints without Defender enabled. Management of Crowdstrike would stay in their own portal.

Perception Point email integration, if a threat originated from an email, huntress can send the file hash to perception point and they can block all emails with the file hash: Current EDR platforms perception point that they support https://perception-point.io/landing/sentinelone/ https://perception-point.io/landing/crowdstrike/

I informed that Virustotal integration stopped and now the threat operations teams review the binaries manually. I liked the VT scoring and I think that an automatic check and verification, even as a first step is mandatory. Especially for Endpoints that have a third-party AV or are incompatible with the Managed AV.

By leveraging the SAML protocol, Multi-Pass, an innovative passwordless solution developed by Kelvin Zero, can significantly enhance both security and user experience for end users. The integration has already been tested successfully. The new authentication flow would allow users to: Initiate login via the Huntress SSO module using their email address > Be redirected to Multi-Pass for biometric authentication > Be seamlessly redirected back to their Huntress dashboard.