Reporting/Alerting

Good Afternoon, Cytek currently has an Organization within Huntress called USOSM. Now, we have many clients underneath this organization. Currently, we know we can download a threat report for each organization. But corporate will not have the time to go through over 100 reports and we were hoping that we could just combine each report into one. After some discussions with Andrew Meier and Kyle Sada, we now know this is not a current possibility therefore, I am submitting a feature request in hopes that one day it can be. Thank you again and have a good day. -Tyler A.

-External Recon data reporting/alerting through email or PSA. -Ability to define IPs to track per organization. -Customize IP labeling, ability to add notes to ports (explanation on why it's left open)

If Huntress detects a firewall is disabled, it would be good if we could have to option to allow Huntress to create a ticket for the client in our PSA, similar to incidents.

It would be a great feature to have an audit trail for all installed and/or removed agents. This would just be a log file listing agents installed or removed to allow us reconcile if a Huntress agent is getting intentionally removed or not. This would just help provide better overall accountability that once we deploy a Huntress agent to a device that we have a record that it was there and when/if it was removed.

Allow organisations to put an escalation or alarm on hold while they wait for customer feedback, this will reduce the time taken to solve incidents, further increasing efficiency and trust in partners.

We recently noticed one of our servers hadn't sent any data to Huntress for 1 day for server hosts it would be good to have the option to have huntress to send an email alert that it hasn't been seen for ideally under 1 hour but even 1 day would be better than nothing. Currently the options only seem to be centred around uninstalling agents that haven't checked in.

Escalation does not include critical information such as the user account affected, when seen, IP address. Manually having someone go into the portal to view the information slows everything down.

Right now we just have the option to pull a report that tells us there was an incident. Would like to see the ability to pull a report that has detail on that incident to provide to clients.

Is there a way for more distinguishable identified such as which "Organization + Device" currently it only shows hostname which multiple companies utilize the same hostnames

Would like to see an end user facing report similar to the monthly client report that could be sent directly to an end user with details on the password file(s) that were found and then info on what they should do and why it's best to not have this stuff saved like they do.