Hi, we recently had an issue where Huntress flagged a possible unwanted connection coming in from Singapore. In the Huntress system there was nothing at the time to indicate this was a legit connection, so an investigation was launched given the end user at the time advised he was in Australia. After reviewing in the Entra logs, it showed that this connection was done via Microsoft GSA and as such was indeed legit as the person accidently left their GSA client on. I would like to suggest the following to handle situations such like this: (Preferred) Given Huntress has access to the audit logs etc, update the reporting in the identities to show that it was a VPN and its MS GSA. (Alternative) If GSA is considered trusted/low risk, then at the very least don't generate an escalation. I raised this with the support team and was advised you only alert on "non-gated" VPNs (VPNs where there's no requirement to identify yourself, such as VPN's that are free or that offer a trial).. I can see how that cuts down on the possible false positives etc, but wouldn't it be better to classify all vpns and then perhaps have a standard template/profile applied at a client level which is "best practise" from Huntress and then let us decide what to alert on? Eg in the above scenario, Huntress might automatically tick GSA to be trusted but we might say "GSA isn't in use/permitted, we want to know if a connection is detected".
