MAV (Managed AV - Microsoft Defender)

Requesting Managed AV for Mac Devices so that our MSP partners can have AV across operating systems.

Hi team, would love the ability to control tamper protection for MAV via Huntress. We have a few clients that use it and it can get turned off for a variety of reasons and would love to have that control in a policy.

Be able to force enable defender when defender is disabled.

There's a genuine demand for including what the "otherav" is in the csv that is generated when you pull from the managed av section of the dashboard. In the "Health Substatus" column, we already have the AV listed at the host level view. Please add it here inplace of "OtherAV"

To enable better reporting via RMM, it would be nice to enable notifications for Defender detections. Including those which are low-severity or automatically remediated.

https://docs.microsoft.com/en-NZ/microsoft-365/security/defender-business/?view=o365-worldwide

One of the key components of Windows Defender is the Attack Surface Reduction (ASR) Rules. In my opinion, the ASR rules is what makes Defender such a powerful platform. It would be great if we could include the ability to turn on, manage, and add exclusions for the ASR rules in huntress. Other competitor platforms can do this and it works quite well. These rules exponentially expand the effectiveness of Defender.

Looking at Antivirus Events graph showed 3 Antivirus Events for 3/4/2024 but the View All Antivirus Events list does not show any records since 2/22/2024. Via chat it determined the 3 events were tied to computers that had been replaced and thus deleted. I believe Antivirus Event details should remain in the list even if the computer is no longer active in Huntress or (and less attractive in my eyes) the graph count should be updated after computers are removed to clean up the discrepancy.

Add a Windows agent flag that Defender is enrolled in customers DefenderATP/MDE. If the majority of a client's devices have OrgID populated but one does not, flag this. If a single customer/client OrgID's differ (not that they should) - Flag this as a potential action item.

Would like to ingest data from defender for business without over-riding the policies. I can't deploy this integration without gutting my licensed defender implementations and can't gain any added value for huntress without being able to share that data amongst the apps.