Integrations, Webhooks, APIs

We are working with Rewst for process automation. It'd be great to be able to uninstall agents via API, create/delete users, isolate machines, etc..

Please add more functionality to the external recon. like: Darkweb monitoring Domains and Subdomains Domain Doppelgänger Social Media Accounts Blacklist checks for Mailserver Shodan / IntellX We're doing all this monitoring with external Tools or manually at the moment

Having SAML SSO set up is great, including the ability to enforce it, thanks! As documented and in practice, when using iDP-initiated sign-in, it just redirects to the SSO login page and users must retype their password. SAML is much more powerful than this, and it would be great if iDP-initiated sign-in were as seamless as it is most places. Thanks!

Tooling allowlist currently only supports the manual additions of IP addresses. This doesn't allow for easy addition of tools that are hosted in the cloud with dynamic IPs. There should be an option to add the FQDN to prevent the need to constantly update lists of IPs. This is especially problematic when there is an incident and the IP list needs to be updated before we can access isolated hosts.

Currently when we set up mappings to a contract in Autotask it will not sync if the service does not already exist on the Autotask contract. It would be AMAZING if Huntress could create this service on the Autotask contract. Ideally this would be in some form of alert / warning that provides the option to either create the service on the contract or ignore the error.

Ability to create email integrations at the organization level so incident reports for certain organizations will be sent to them and not the account level emails.

We use a custom browser plugin to pop alert banners when things need attention in Huntress. This works really well for all team members when it comes to incidents but when it comes to escalations there doesn't seem to be any way to review/check for these under the API.

An additional integration option for event updates that initiates a HTTPS callback and posts detailed JSON data about the event. It will allow faster response and wider range of integration options and much more preferable then having to parse an email.

We'd like to automate noting expected user travel (i.e user travelling to Spain for a few days). Requesting an API endpoint to provide user, start date, end date, country would be ideal.

We enabled SSO with Microsoft Entra. It still requires us to manually create the user within Huntress before they can login. Many other applications that we integrated have an "auto provision" setting. When enabled this will automatically create the user in Huntress as long as they're part of security group on the Entra Enterprise Application. Some of the better ones even have mapping logic where you can map specific Entra Groups to specific permissions on the application (huntress) side.