ITDR (MDR for Microsoft 365)

Add support for Google Workspace for MDR (similar to the O365 MDR).

We need a better alerting system, or at least some kind of notification should you suddenly not get any data from client tenants.

We use Conditional access policies for our clients when they travel out of country. As such, the users will be connecting to their O365 account from a different location than their accounts set Usage location. Can Huntress auto propagate a tenant's Conditional Access policies to the ITDR Location Rules. This would help reduce the amount of "Unexpected Location" escalations. Whether this be through automatic creation of Location Rules, based on Conditional Access policies from Azure/Entra. Or Huntress references the Conditional Access policies that are applied to the users account, before creating "Unexpected Location" escalations.

Today we can set priorities on incidents. Please mirror that? They are coming in at highest priority right now.

The list of VPN services we're able to block is a pretty extensive list. Rather than a blocklist style approach, an allowlist or exceptions to a global blocklist would be helpful. Perhaps a client wants to block all VPN tools except for their Sophos VPN; that would take some time to build out and clutter the dashboard with how things are configured currently.

When an account experience say 100 failed login attemps in 1 hour but the 101 login is succesvol this might indicate a successfull brute force attack. In that case I want to know. Number of attempts and timeframe to be defined; this was just an example.

It seems that Huntress just wants this Entra Usage Location set so they can use it as a datapoint, setting it per user it tedious. MSP and IT also use JIT accounts which can create accounts on the fly. As an MSP, we are getting these alerts for every JIT account being created. For all our clients, we could simply just tell you (in settings) that USA is the only Usage Location, vs setting this on a per user basis. Above that, if there was a single user in say Japan, it would be better for us to set that usage location on their identity in Huntress, not in Entra.

I have been getting escalations for unwanted location or VPN. They are for one user and I usually only want to approve/block for that one user. I can ONLY approve or block for the organization as a whole or all organizations right from that escalation, not just for one user. It takes a lot more clicks to then go to unwanted access and find and allow the country or vpn just for the user. It would be easier to do it straight from the escalation itself.

Add the ability to block IP ranges of public VPN Services on a per tenant basis. I know some people like to use VPN services, but most smb's don't use these, but the bad guys certainly do. Bonus for ability to whitelist a specific reputable VPN service as needed.

Allow us to create a rule that sets a (or multiple) countries as Allowed and all others as Unexpected