Which Microsoft 365 or Okta sign-ins deserve a second look?

correlates identity logs against SOC-built detections for credential attacks, privilege escalation, MFA bypass and fatigue, account takeover, and federated identity manipulation, and infers a user's home country from the tenant when none is set so logins from that country aren't flagged as suspicious

Which configuration changes drifted away from the policies I set?

flags drift within minutes of a change in Microsoft 365 or identity settings and, for supported controls like MFA-on-device-registration or restricted Guest access, remediates the drift automatically without manual intervention

Would a new Conditional Access policy lock anyone out before I enforce it?

runs the policy in Learning Mode against real sign-in patterns first and reports the impact so the blast radius is known before enforcement is turned on

Did that suspicious DMG on a Mac actually run anything?

ejects deceptive or malicious installers before their payload executes, notifies the user on-screen why it was ejected, and opens a SOC investigation on every ejection to confirm the endpoint is clean

Which login alerts are just noise from a known IP or office range?

lets you suppress escalations for a specific IP or CIDR range without disabling the rest of identity detection, so expected traffic stops generating tickets

What actually happened during an investigation the SOC already closed?

the Investigations View lists every completed SOC investigation, including ones closed as benign, with a timeline of what was reviewed, what action was taken, and the final outcome

Huntress release history — The Cyber Toolchain

changelog Oct 28, 2026 · issue 123

Huntress adds Identity Posture Assessment (on-demand PDF + API) for M365 tenants and Lookback for 180-day historical login analysis on ITDR onboarding.

Adds Identity Posture Assessment available via the Huntress API, enabling automated retrieval and integration of M365 tenant posture reports into existing workflows.
Adds Identity Posture Assessment, an on-demand PDF report evaluating Microsoft 365 tenants against the Huntress Identity Security Framework — showing gaps, misconfigurations, severity-ranked next steps, and co-brandable output for client QBRs and onboarding.
New detectionAdds Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards to Managed ITDR, surfacing earlier compromises and active threats from day one.
Lookback findings appear as a dedicated section of the Identity Security Assessment, delivered by email and available in the Huntress portal within 48 hours of onboarding.

4 details in Everything

Now Live: Managed ISPM Identity Posture Assessment seen Oct 21, 2026 · issue 115

Huntress launches on-demand Identity Posture Assessment for Microsoft 365, available via portal and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Generate and download a co-branded PDF posture assessment for a client directly from the Huntress portal ISPM dashboard.

📍1. In the Huntress portal, navigate to the ISPM dashboard. 2. In the Quick Assessment card, select the target organization from the dropdown. 3. Click Generate to download the PDF report.

Adds a Huntress API endpoint to retrieve the Identity Posture Assessment report programmatically for integration into existing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces the Identity Posture Assessment, an on-demand report that evaluates a Microsoft 365 tenant against the Huntress Identity Security Framework, scoring only licensed controls and ranking gaps by severity.
Generates a co-branded, shareable PDF report from the ISPM dashboard via the Quick Assessment card to support client onboarding, QBRs, and prospect conversations.

3 details in Everything

Find Out Who Was in Your Microsoft 365 Tenant Before You Were: Introducing Managed ITDR Lookback Oct 19, 2026 · issue 115

Huntress Managed ITDR gains Lookback: automatic 180-day Microsoft 365 login-history analysis at tenant onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

When onboarding a new client to Managed ITDR, review the Lookback section of the Identity Security Assessment in the Huntress portal to see whether any pre-existing compromises were detected across the past 180 days of M365 login history.

📍In the Huntress portal, go to the newly onboarded tenant › Identity Security Assessment › Lookback section (available within 48 hours of onboarding). Review flagged historical findings; active compromises will already have a critical Incident Report opened by the SOC.

Adds Managed ITDR Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards, surfacing pre-existing compromises from day one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Lookback findings appear as a dedicated section of the Identity Security Assessment, delivered by email and visible in the Huntress portal within 48 hours of onboarding.
Active compromises discovered by Lookback trigger SOC investigation, a critical Incident Report, and active session revocation; previously remediated activity surfaces as historical findings without triggering a new incident.
Lookback runs once, automatically, for eligible Microsoft 365 tenants onboarded on or after October 19, 2026, including trial tenants; not available for GCC, GCC High, or CPV tenants.

4 details in Everything

SIEM Log Sources API is now available seen Oct 5, 2026 · issue 095

Huntress adds a SIEM Log Sources API to list source coverage, status, and 30-day data volume programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

changelog Oct 5, 2026 · issue 095

Huntress: New Microsoft 365 hardening controls are available for manual scheduling but are excluded from automatic Managed Deployments due to potential end-user impact.

changelog Oct 4, 2026 · issue 094

Huntress adds five new Microsoft 365 hardening controls for Entra inactive accounts, shared mailboxes, spam, and Bookings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Microsoft Entra control to block sign-in for member accounts inactive for 90 days, schedulable for deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Microsoft Entra control to block sign-in for guest accounts inactive for 30 days, schedulable for deployment.
Adds Microsoft Entra control to block sign-in to shared mailboxes, schedulable for deployment.
Adds outbound spam policy control to set explicit sending limits and block senders, schedulable for deployment.
Adds control to restrict Shared Bookings creation to selected users, schedulable for deployment.

5 details in Everything

New Security Controls in Managed ISPM seen Sep 30, 2026 · issue 090

Huntress Managed ISPM gains five new Microsoft 365 security controls covering Entra inactive accounts and Exchange Online shared mailboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Microsoft Entra control to block sign-in for member accounts inactive for 90 days, schedulable for deployment in Managed ISPM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Microsoft Entra control to block sign-in for guest accounts inactive for 30 days, schedulable for deployment in Managed ISPM.
Adds Microsoft Exchange Online control to block sign-in to shared mailboxes, schedulable for deployment in Managed ISPM.
Adds Microsoft Exchange Online control to ensure outbound spam policies set explicit sending limits and block senders, schedulable for deployment in Managed ISPM.
Adds Microsoft Exchange Online control to restrict Shared Bookings creation to selected users, schedulable for deployment in Managed ISPM.

5 details in Everything

New Security Controls in Managed ISPM Sep 29, 2026 · release notes

New configurable Microsoft Entra and Exchange Online security controls for M365 environments

Adds Ensure sign-in is blocked for member accounts inactive for 90 days to the Managed ISPM policy set
Adds Ensure sign-in is blocked for guest accounts inactive for 30 days to the Managed ISPM policy set
Adds Ensure sign-in to shared mailboxes is blocked to the Managed ISPM policy set
Adds Ensure outbound spam policies set explicit sending limits and block senders to the Managed ISPM policy set
Adds Restrict Shared Bookings creation to selected users to the Managed ISPM policy set

+1 more show less

Enables scheduling of these new recommended controls for deployment in the UI

6 details in Everything

changelog Sep 26, 2026 · issue 086

Huntress adds Modified Deployments rollout control, Unsecured Credentials overhaul, macOS Screen Sharing visibility, and new macOS quarantine-strip detections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Before re-enabling Unsecured Credential Incident Reports on a noisy environment, preview exactly which files would trigger reports and allowlist already-reviewed ones.

📍In the Huntress console, go to Managed EDR › Process Insights › Credential Files. Use the preview mode to see which files would generate an Incident Report without turning reporting on, then select reviewed files and add them to the allowlist before enabling reporting.

Enable Archive File Scanning and disable Network File Scanning for Microsoft Defender on endpoints where mapped-drive performance is a concern.

📍In the Huntress console, go to EDR › Managed Antivirus › Defender Configuration › Scans. Set Network File Scanning to off and confirm Archive File Scanning remains on, then save.

Adds Modified Deployments org-level setting, letting administrators build a custom control set from the Huntress policy library, select low/medium/high impact items, set deployment days, and approve new controls before they roll out — ideal for strict compliance or change-control environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in EDR > Managed Antivirus > Defender Configuration > Scans, previously fixed to Huntress defaults.

2 details in Everything

changelog Sep 25, 2026 · issue 085

Huntress: Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in Managed Antivirus, found under EDR > Managed Antivirus > Defender Configuration > Scans; previously fixed to Huntress defaults.

└──▷ HOW TO FIND IT

Switch an org from automatic Managed Deployments to Modified Deployments so no new controls roll out without explicit approval — suitable before a compliance audit or major change freeze.

📍In the Huntress console, go to your organization settings and select Modified Deployments. Choose the impact levels (low, medium, or high) you want available, then set the deployment schedule days. New library controls will notify you but will not deploy until you approve each one.

Re-enable Unsecured Credentials reporting for an org that turned it off due to noise, using the new preview and allowlist to scope reports to genuinely risky files first.

📍In the Huntress console, navigate to Process Insights › Credential Files. Use the preview mode to review which files would generate Incident Reports without turning reporting on. Allowlist any files you have reviewed and accepted, then enable Incident Report generation once the list is scoped to real risks.

Enable Archive File Scanning and disable Network File Scanning in Microsoft Defender for a specific policy to ensure malware inside ZIPs and RARs is caught without the performance overhead of scanning mapped drives.

📍In the Huntress console, go to EDR › Managed Antivirus › Defender Configuration › Scans. Set Network File Scanning to off and confirm Archive File Scanning is on, then save the configuration.

Adds a detection for Screen Sharing sessions that attach to a root user session via a legacy authentication handshake — the signature of a pre-auth flaw in Apple's Screen Sharing service disclosed July 2026; requires Agent v0.14.196.
Adds three macOS quarantine-attribute-strip detections (requires Agent v0.14.196): quarantine removed from a file in a common malware staging folder by a script or shell; quarantine removed from a file on a mounted disk image; a fake installer mounted and a quarantine strip on the same machine within five minutes.
Extends the Last Logged-In User field on the agent overview page to macOS endpoints (previously Windows-only), reflecting the most recent interactive console/GUI login; populates on Agent v0.14.196 or later.
Adds two new Microsoft Exchange Online controls against Shadow Workflows — Ensure Direct Send is disabled and 'Tenant Allow/Block list should contain zero entries in the allow list' — available for manual scheduling but excluded from automatic Managed Deployments rollout.

Adds a detection for Screen Sharing sessions that attach to a root user session via a legacy authentication handshake — the signature of a pre-auth flaw in Apple's Screen Sharing service disclosed July 2026; requires Agent v0.14.196.
Adds three macOS quarantine-attribute-strip detections (requires Agent v0.14.196): quarantine removed from a file in a common malware staging folder by a script or shell; quarantine removed from a file on a mounted disk image; a fake installer mounted and a quarantine strip on the same machine within five minutes.

2 more in Everything

Managed ISPM: Customize control rollouts with Modified Deployments seen Sep 25, 2026 · issue 085

Huntress Managed ISPM adds Modified Deployments, letting orgs hand-pick security controls and approval gates before anything rolls out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Modified Deployments, an org-level setting in Managed ISPM that lets you hand-pick which security controls (low, medium, or high impact) from the Huntress policy library roll out and on which days, with no changes deployed until explicitly approved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New controls added by Huntress to the policy library trigger a notification under Modified Deployments but are held until you approve them, supporting strict compliance and change control requirements.

2 details in Everything

Unsecured Credentials: New Credential Files Dashboard and Allowlisting seen Sep 25, 2026 · issue 085

Huntress Unsecured Credentials gets a new Credential Files dashboard, pre-enable preview, and allowlisting to cut alert noise.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Audit noisy Unsecured Credentials alerts before re-enabling reporting — review flagged files and allowlist accepted ones to keep Incident Reports focused.

📍In the Huntress console, go to Managed EDR › Process Insights › Credential Files. Review the listed files, select those you have accepted, and choose Allowlist to exclude them. Then enable Unsecured Credential Incident Reports.

Adds a new Credential Files page under the Process Insights dashboard in Managed EDR to view and manage every file triggering an Unsecured Credentials report in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables preview of which Credential Files would generate an Incident Report before turning Unsecured Credential reporting on.
Adds allowlisting for Credential Files so reviewed and accepted files are excluded from future Unsecured Credentials Incident Reports.

3 details in Everything

Managed ISPM: Customize control rollouts with Modified Deployments Sep 24, 2026 · release notes

Managed ISPM adds Modified Deployments to let admins select specific controls and schedule their rollout dates.

Adds the ability to choose exactly which security controls roll out from the complete policy library
Allows selection of control impact levels (low, medium, or high) during the deployment configuration process
Enables setting custom deployment days for selected controls

3 details in Everything

changelog Sep 24, 2026 · issue 084

└──▷ HOW TO FIND IT

Enable Archive File Scanning or explicitly disable Network File Scanning for Defender-managed endpoints to harden malware-in-archive coverage without impacting shared drive performance.

📍In the Huntress console, go to EDR › Managed Antivirus › Defender Configuration › Scans, then toggle Network File Scanning or Archive File Scanning to your desired state and save.

changelog Sep 23, 2026 · issue 083

Huntress: Adds three macOS detections for quarantine-attribute removal (xattr strip via system call): script/shell strip in common malware staging folders, strip on a mounted disk image, and a combined fake-installer-plus-strip-within-five-minutes correlation — covering AMOS, Poseidon, Odyssey, and MacSync infostealers; requires Agent v0.14.196.

└──▷ HOW TO FIND IT

Enable Archive File Scanning or disable Network File Scanning for Defender-managed endpoints without touching Huntress defaults on every host.

📍In the Huntress console, go to EDR → Managed Antivirus → Defender Configuration → Scans and toggle Network File Scanning or Archive File Scanning to your desired state, then save.

Adds Screen Sharing session telemetry on macOS — reports source address, session user, and authentication type for each session start, with per-host field suppression; requires Agent v0.14.196.

1 detail in Everything

changelog Sep 22, 2026 · issue 082

Huntress adds macOS Screen Sharing visibility, quarantine-strip detections, and Defender scan toggle controls for M365 and endpoint hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable Archive File Scanning and explicitly disable Network File Scanning for Defender to harden malware-in-ZIP detection without impacting shared-drive performance.

📍In the Huntress console, go to EDR › Managed Antivirus › Defender Configuration › Scans, set Network File Scanning to Off and Archive File Scanning to On, then save.

Schedule the Exchange Online Shadow Workflow hardening controls to roll out to tenants without auto-deploying to avoid unplanned end-user impact.

📍In the Huntress console, open the Microsoft 365 hardening controls, locate Ensure Direct Send is disabled and 'Tenant Allow/Block list should contain zero entries in the allow list', and use the Schedule for Deployment option rather than Managed Deployments.

Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in Managed Antivirus, found under EDR > Managed Antivirus > Defender Configuration > Scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Extends the agent overview page to show the last logged-in user for macOS endpoints (previously Windows-only), requiring Agent v0.14.196 or later.
Adds a detection that fires when a Screen Sharing session attaches to a root user via a legacy authentication handshake, covering an unauthenticated file-read flaw in Apple's Screen Sharing service disclosed July 2026.

Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in Managed Antivirus, found under EDR > Managed Antivirus > Defender Configuration > Scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a detection that fires when a Screen Sharing session attaches to a root user via a legacy authentication handshake, covering an unauthenticated file-read flaw in Apple's Screen Sharing service disclosed July 2026.

1 more in Everything

New Security Controls in Managed ISPM seen Sep 22, 2026 · issue 082

Huntress Managed ISPM adds two new M365 security controls targeting Shadow Workflows in Exchange Online and Defender for Office 365.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Ensure Direct Send is disabled control for Microsoft Exchange Online, available to schedule for deployment in Managed ISPM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds 'Tenant Allow/Block list should contain zero entries in the allow list' control for Microsoft Defender for Office 365, available to schedule for deployment in Managed ISPM.

2 details in Everything

New Security Controls in Managed ISPM Sep 21, 2026 · release notes

Huntress adds scheduled deployment for managed ISPM Shadow Workflow controls.

Adds Direct Send enforcement to Microsoft Exchange Online protections in Managed ISPM.
Adds zero-entry Allow/Block list enforcement for Defender for Office 365 in Managed ISPM.
Enables scheduling of these security controls for deployment in the Managed ISPM service.

3 details in Everything

Huntress now detects macOS Gatekeeper bypass via quarantine stripping seen Sep 17, 2026 · issue 077

Huntress adds three macOS Gatekeeper bypass detections covering quarantine stripping via scripts, disk images, and combined fake-installer sequences.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detects quarantine attribute removal from files in common malware staging folders by a script or shell — covering the ClickFix and AMOS dropper pattern.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Detects quarantine attribute removal from files on mounted disk images — the technique fake installers use to silently bypass Gatekeeper.
Detects a combined sequence of a fake installer mount and a quarantine strip on the same machine within five minutes — a high-confidence pre-execution signal.
Monitors the system call directly rather than the xattr command, so detection fires regardless of whether the attacker uses a shell script or compiled binary.
Each detection surfaces the file path, the attribute removed, and the process that removed it, distinguishing malware from legitimate build tooling.

+2 more show less

Filters out Apple backup and file-sharing services, which accounted for approximately 99% of noise during testing.
Requires Agent v0.14.196 or later for all three detections.

7 details in Everything

Last logged in user now visible for macOS endpoints seen Sep 17, 2026 · issue 077

Huntress agent overview now shows last logged-in user for macOS endpoints, requiring Agent v0.14.196 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

During triage or asset review, quickly attribute a macOS host to an individual user without querying the endpoint directly.

📍In the Huntress console, go to the agent overview page for a macOS endpoint and check the Last Logged In User field — visible once the endpoint checks in on Agent v0.14.196 or later.

New MAV Configuration Settings: Network File Scanning and Archive File Scanning seen Sep 17, 2026 · issue 077

Huntress Managed Antivirus now lets you toggle Network File Scanning and Archive File Scanning for Microsoft Defender.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable Network File Scanning for endpoints where mapped network drive coverage is required, such as file servers accessed by a small number of endpoints.

📍In the Huntress console, go to EDR → Managed Antivirus → Defender Configuration → Scans, then toggle Network File Scanning on.

Disable Archive File Scanning for high-throughput endpoints where ZIP/RAR scanning overhead is a concern, while keeping all other Defender defaults intact.

📍In the Huntress console, go to EDR → Managed Antivirus → Defender Configuration → Scans, then toggle Archive File Scanning off.

Adds configurable Network File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (off by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds configurable Archive File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (on by default, covers ZIP, RAR, and similar formats).

2 details in Everything

Huntress now detects macOS Gatekeeper bypass via quarantine stripping Sep 16, 2026 · release notes

Huntress now detects macOS Gatekeeper bypass via quarantine stripping using three new detections

Adds detection for 'Quarantine removed from a file in a common malware staging folder by a script or shell'
Adds detection for 'Quarantine removed from a file on a mounted disk image'
Adds detection for 'A fake installer mounted and a quarantine strip on the same machine within five minutes'
Requires Agent v0.14.196 to utilize these new macOS Gatekeeper bypass detections

4 details in Everything

macOS Configuration Wizard now opens on the step you left off at Sep 16, 2026 · release notes

macOS Configuration Wizard restores session state to resume at the last incomplete step.

Configuration Wizard for macOS retains open sessions and resumes on the first incomplete setup step rather than showing the welcome screen

1 detail in Everything

changelog Aug 28, 2026 · issue 058

Huntress adds ITDR Executive Summary PDFs, per-identity escalations, full IPv4 via ipv4_addresses API field, WSL visibility, and 7 new ISPM controls.

└──▷ HOW TO FIND IT

Review and tune per-identity escalation notification recipients and PSA ticket categories before multiple concurrent ITDR escalations flood the wrong queues.

📍In the Huntress portal, go to Account Settings › Huntress Platform and Alert Notifications, then review each category (Unexpected Country, Unexpected VPN) to confirm the correct recipients and PSA settings are configured for per-identity escalations.

Export a ready-to-share executive briefing from an active ITDR incident without rewriting technical findings for a client or insurer.

📍In the Huntress portal, open the ITDR incident report, then click the Export PDF button at the top of the report to queue a standalone Executive Summary PDF download.

Adds per-identity escalations for Unexpected Country and Unexpected VPN activity in Managed ITDR, so each affected identity generates its own escalation, notification, and — if a PSA integration is configured — its own PSA ticket.
Adds an Executive Summary in plain text at the top of every ITDR incident report, with a standalone PDF export available via the Export PDF button in the portal.
Adds 7 new Microsoft 365 security controls to Managed ISPM (approaching 80 total): Anti-Malware, Anti-Spam, and Anti-Phishing policies against the Microsoft Standard baseline in Exchange Online Protection; Safe Links, Safe Attachments, Safe Documents, and spoof-protection Anti-Phishing policies in Microsoft Defender for Office 365.

3 details in Everything

Executive Summaries Now in ITDR Incident Reports Aug 27, 2026 · release notes

ITDR incident reports now include auto-generated Executive Summaries in plain text and as standalone PDFs.

Adds automatic plain-text Executive Summaries to the top of every ITDR incident report for quick business translation of technical findings
Enables downloading a standalone Executive Summary PDF from the portal via the Export PDF button

2 details in Everything

New Per-Identity Notification Escalations Model in Managed ITDR Aug 27, 2026 · release notes

Huntress introduces per-identity notification escalations for Unexpected Country and VPN activity in Managed ITDR.

Each identity generating new Unexpected Country or Unexpected VPN activity now receives its own distinct Huntress escalation and notification.
PSA integrations can generate a separate ticket for each per-identity escalation, allowing granular tracking of identity-specific threats.

2 details in Everything

All IPv4 Addresses associated with an Agent are now displayed in Portal seen Aug 21, 2026 · issue 052

Huntress Portal now exposes all IPv4 addresses per agent via UI hover, exports, and the ipv4_addresses REST API field.

Adds ipv4_addresses REST API field on agent records, returning the full list of IPv4 addresses collected by the Base Agent survey — not just the first.

1 detail in Everything

Windows Subsystem for Linux Visibility in Huntress Managed EDR seen Aug 21, 2026 · issue 052

Huntress Managed EDR now surfaces Windows Subsystem for Linux (WSL) status on Windows endpoints to expose shadow IT blind spots.

└──▷ HOW TO FIND IT

Audit your fleet for unsanctioned WSL usage by reviewing the EDR agent page for each Windows endpoint.

📍In the Huntress portal, navigate to the EDR agent page for a Windows endpoint and review the WSL status field (Installed or Uninstalled), then expand per-account detail to see instance name, user account, SID, WSL version, and state (running or stopped).

Adds WSL visibility to the EDR agent page in the Huntress portal, showing WSL status (Installed or Uninstalled) per Windows endpoint across your fleet.

1 detail in Everything

Windows Subsystem for Linux Visibility in Huntress Managed EDR Aug 20, 2026 · release notes

Huntress EDR now surfaces Windows Subsystem for Linux (WSL) status and per-account instance details on the EDR agent page.

Adds WSL status (Installed/Uninstalled) to the Huntress Managed EDR portal's EDR agent page for Windows endpoints
Adds per-account WSL details including instance name, user account, SID, WSL version, and state (running or stopped) to the EDR agent page

2 details in Everything

Additional Security Controls in Managed ISPM Aug 20, 2026 · release notes

Adds Exchange Online Protection and Defender for Office 365 security controls to Managed ISPM

Adds Ensure Anti-Malware policies meet the Microsoft Standard baseline control
Adds Ensure Anti-Spam policies meet the Microsoft Standard baseline control
Adds Ensure Anti-Phishing policies meet the Microsoft Standard baseline control
Adds Ensure Safe Links policies meet the Microsoft Standard baseline control
Adds Ensure Safe Attachments protection meets the Microsoft Standard baseline control

+2 more show less

Adds Ensure Safe Documents is turned on for Office clients control
Adds Ensure Anti-Phishing policies meet the Microsoft Standard spoof protection baseline control

7 details in Everything

changelog Aug 19, 2026 · issue 050

Huntress adds a transparent SOC Investigation dashboard with timelines, summaries, and CSV/Excel export.

└──▷ HOW TO FIND IT

Export a closed investigation for a compliance report or post-incident record.

📍In the Huntress portal, go to Investigations (top navigation) › locate the investigation › click Export › choose CSV or Excel.

New Investigations dashboard (accessed via Investigations in the top navigation) shows a chronological timeline of SOC signals reviewed, actions taken, remediations applied, and final outcomes for both closed-benign and reported investigations.

1 detail in Everything

View Chronological Timeline of Every Huntress Investigation (GA) seen Aug 18, 2026 · issue 049

Huntress GA's a chronological investigation timeline dashboard with CSV/Excel export across Managed EDR, ITDR, and SIEM.

└──▷ HOW TO FIND IT

Access the full investigation timeline to review SOC actions and remediations on a closed or reported incident.

📍In the Huntress portal, click Investigations in the top navigation, then select any reported or closed-benign investigation to view its chronological timeline of signals, actions, and outcomes.

New Investigations dashboard (accessible via the top navigation in the Huntress portal) shows a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcomes for both reported and closed-benign investigations.
Supports export of investigations to CSV and Excel for reporting and recordkeeping.
Covers investigations across Managed EDR, ITDR, and SIEM in a unified view.
New summary section displays key stats across investigations for quick situational awareness.

4 details in Everything

View Chronological Timeline of Every Huntress Investigation (GA) Aug 17, 2026 · release notes

Huntress now offers a GA chronological timeline dashboard for SOC investigations with CSV/Excel export

Adds a Investigations dashboard in the top navigation to view chronological timelines of all reported and closed-benign investigations across Managed EDR, ITDR, and SIEM
Enables exporting investigation data via CSV/Excel for reporting and recordkeeping

2 details in Everything

changelog Aug 12, 2026 · issue 043

Huntress adds executive summary reports, a remote access API, and a redesigned ITDR dashboard with rapid triage and login characterization.

New API endpoint for querying remote access connections — including ConnectWise ScreenConnect hosts — returns agent hostname, relay host, port, and first/last seen timestamps, enabling automated audits and response workflows (see the Remote Access section of the API docs).
New Rapid Identity Triage panel in the ITDR dashboard lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with the ability to export a timeline, revoke sessions, or disable the account.
New Failed Login Characterization view surfaces failed login attempts globally with specific classification by residential proxies, VPNs, and datacenters.
New Quick SIEM Search panel inside the ITDR dashboard exposes pre-populated queries against Huntress-ingested Entra Unified Audit Log data retained free for up to one year for all ITDR customers.
New redesigned ITDR dashboard available in Early Access via the ITDR icon in left-hand navigation, running alongside the existing dashboard.

+1 more show less

New monthly executive summary report distills each organization's Threat Report into a non-technical snapshot, available via email link and under Reports in the Huntress portal.

6 details in Everything

Monthly Executive Summary reports are now available (GA) seen Aug 11, 2026 · issue 042

Huntress adds Monthly Executive Summary reports in GA, delivering a one-page stakeholder-friendly snapshot per organization each month.

Adds Monthly Executive Summary reports (GA) — a one-page, plain-language snapshot per organization highlighting active protection layers (EDR, ITDR, SIEM, etc.), signals investigated, and threats contained, aimed at non-technical stakeholders.
Reports are accessible under the Reports section of the Huntress portal and delivered via email link to partners for easy forwarding to end customers.
Complements (does not replace) the existing full monthly/quarterly Threat Report; described as the first in a planned series of reporting improvements.

3 details in Everything

Remote access connections API is now available (GA) seen Aug 11, 2026 · issue 042

Huntress adds a GA API for querying remote access connections, including ConnectWise ScreenConnect hosts.

Now Live: Managed ITDR Dashboard in Early Access seen Aug 8, 2026 · issue 039

Huntress launches redesigned Managed ITDR Dashboard in Early Access with rapid triage, login characterization, and SIEM search.

New Rapid Identity Triage panel lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with options to export a timeline, revoke sessions, or disable the account.
New Failed Login Characterization view shows failed login attempts globally with specific categorization by residential proxies, VPNs, and datacenters.
New Quick SIEM Search surface within the ITDR dashboard provides pre-populated queries against the full Entra Unified Audit Log, stored in Huntress SIEM at no cost for ITDR customers for up to one year.
Redesigned ITDR dashboard is accessible via the ITDR icon in the left-hand navigation; the existing dashboard remains available in parallel during Early Access.

4 details in Everything

Now Live: Managed ITDR Dashboard in Early Access Aug 7, 2026 · release notes

Huntress adds a redesigned ITDR dashboard with Rapid Identity Triage, Failed Login Characterization, and pre-populated SIEM queries in Early Access.

Adds the Rapid Identity Triage panel to the ITDR dashboard for entering an email to get a 24-hour activity overview, export timeline, revoke sessions, or disable accounts.
Adds Failed Login Characterization capability showing failed login attempts from residential proxies, VPNs, and datacenters in the new dashboard.
Adds Quick SIEM Search with pre-populated popular queries to view Entra Unified Audit Log data stored in the Huntress SIEM directly from the dashboard.
Makes the redesigned ITDR dashboard accessible via the ITDR icon in the left-hand navigation during Early Access.

4 details in Everything

changelog seen Aug 4, 2026 · issue 035

Huntress adds API-based IP rules for ITDR, trusted-device suppression for corporate logins, onboarding escalation pacing, and automatic usage-location inference.

New API endpoint lets you create IP address-based allow/block rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call.
Logins from corporate-managed devices no longer trigger location and VPN escalations by default for new accounts; existing partners can configure which device trust levels qualify — compliant, domain-joined, or registered — per account or per organization.
Managed ITDR now automatically paces escalation flow during a new tenant's first week to prevent onboarding noise spikes, on by default with no configuration required.
Microsoft Usage Location Inference is now live in Managed ITDR: Huntress infers an identity's home country from the tenant when Entra usage location is absent, eliminating Unexpected Country and 'login without usage location' false escalations with no partner configuration needed.

4 details in Everything

Huntress API now supports creating IP-based rules for ITDR seen Aug 1, 2026 · issue 032

Huntress API gains an endpoint to create IP-based allow/block rules for Managed ITDR Unwanted Access.

New API endpoint lets you programmatically create IP address-based rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call.

1 detail in Everything

Huntress API now supports creating IP-based rules for ITDR Jul 31, 2026 · release notes

Huntress API now supports creating IP-based ITDR rules via POST /v1/unwanted_access_rules

Adds POST /v1/unwanted_access_rules endpoint to create IP-based Managed ITDR Unwanted Access rules via Huntress API
The new endpoint accepts a single IP address, a CIDR range, or a list of IPs in a single call

2 details in Everything

Trusted Device Suppression Live in Managed ITDR seen Jul 31, 2026 · issue 031

Huntress Managed ITDR adds Trusted Device Suppression to cut unexpected-login escalations by 40–50%.

New Trusted Device Suppression in Managed ITDR automatically suppresses location and VPN escalations for logins from corporate-managed devices, configurable per account or per organization.
Supports granular trust-level selection — compliant, domain-joined, or registered — giving partners precise control over which device states qualify for suppression.

2 details in Everything

Trusted Device Suppression Live in Managed ITDR Jul 30, 2026 · release notes

Trusted Device Suppression Live in Managed ITDR

Microsoft Usage Location Inference Live in Managed ITDR seen Jul 28, 2026 · issue 028

Huntress Managed ITDR now infers Microsoft 365 home country from tenant data, eliminating false-positive Unexpected Country escalations.

Automatically infers a Microsoft 365 identity's home country from the tenant when no Entra usage location is set, requiring zero partner configuration.
Inferred country value serves as the Expected Country for Unexpected Country escalation evaluation, reducing false-positive alerts for users logging in from their home country.

2 details in Everything

Onboarding Escalation Throttle Now Live in Managed ITDR seen Jul 28, 2026 · issue 028

Managed ITDR now throttles and prioritizes escalations during a new tenant's first week to reduce onboarding noise.

Adds onboarding escalation throttle to Managed ITDR, pacing and prioritizing alert flow during a new tenant's first week while behavioral baselines build.

1 detail in Everything

Microsoft Usage Location Inference Live in Managed ITDR Jul 27, 2026 · release notes

Managed ITDR now infers Microsoft 365 identity home country from tenant data, eliminating missing-location escalations without configuration.

Infers the expected country for Microsoft 365 identities when Entra usage location is missing

1 detail in Everything

IP-Based Expected Rules Now Available in Managed ITDR seen Jul 17, 2026 · issue 018

Managed ITDR now supports IP- and CIDR-based Expected Unwanted Access rules to suppress known-good login escalations.

└──▷ HOW TO FIND IT

Suppress login escalations from a known office or remote-worker IP range without creating overly broad country or VPN exceptions.

📍In the Huntress console, go to Managed ITDR › Expected Unwanted Access rules and create a new rule scoped to a single IP address or CIDR range.

See the details of every Huntress investigation with the new Partner Investigations View (Early Access) seen Jul 15, 2026 · issue 015

New Partner Investigations View (Early Access) exposes full Huntress SOC activity — including Closed-Benign outcomes — across EDR, ITDR, and SIEM.

└──▷ HOW TO FIND IT

Opt in to the new Investigations View to review all SOC investigations — including benign closures — from the past 90 days.

📍In the Huntress portal, go to the top nav and select Investigations, then click the Try the new investigations view banner to opt in.

Adds Partner Investigations View (Early Access) showing all completed SOC investigations — both Reported and Closed-Benign — across Managed EDR, ITDR, and SIEM, not just those that became incident reports.
Each investigation includes a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcome.
Automatically surfaces completed investigations from the last 90 days upon opt-in.

3 details in Everything

See the details of every Huntress investigation with the new Partner Investigations View (Early Access) Jul 14, 2026 · release notes

New Partner Investigations View for partners to review Reported and Closed-Benign investigations across EDR, ITDR, and SIEM.

AI Search for Huntress Managed SIEM has officially gone GA seen Jul 13, 2026 · issue 014

Huntress Managed SIEM gains GA AI Search, enabling plain-English log queries with automatic ESQL translation.

└──▷ HOW TO FIND IT

Run a plain-English investigation query against SIEM logs, then inspect the generated ESQL to learn query syntax or refine further.

📍In Huntress Managed SIEM, enter your query in the AI Search bar (e.g. "show me failed logins from external IPs in the last 24 hours"), press Search, then click the ESQL button to view and copy the translated ESQL query.

Adds AI Search (GA) to Huntress Managed SIEM, allowing natural-language queries against SIEM logs without requiring ESQL or the Query Builder.
Enables on-demand ESQL translation: after a plain-English search, clicking the ESQL button reveals the generated ESQL query to accelerate analyst upskilling.

2 details in Everything

Additional Security Controls in Managed ISPM seen Jul 13, 2026 · issue 014

Huntress Managed ISPM adds SharePoint/OneDrive/Teams security controls and expands Continuous Enforcement to five new policies.

└──▷ HOW TO FIND IT

Enable Continuous Enforcement on the 'Require MFA to register or join devices' policy to automatically detect and remediate drift without manual intervention.

📍In the Huntress portal, go to Managed ISPM › Security Controls, locate 'Require MFA to register or join devices', and toggle on Continuous Enforcement to enable drift detection and auto-remediation.

New SharePoint Online control: enforces idle session timeout for SharePoint and OneDrive.
New SharePoint Online control: blocks anonymous sharing links in SharePoint and OneDrive.
New SharePoint Online control: prevents users from self-creating SharePoint sites.
New SharePoint Online control: retains deleted user OneDrive content for at least 90 days.
New Microsoft Teams control: blocks communication with unmanaged Teams tenants.

+2 more show less

New Microsoft Teams control: blocks organizational communication with accounts in trial Teams tenants.
Continuous Enforcement (drift detection + auto-remediation) now covers: restricting Azure Management portal access, blocking unused device types, restricting Guests from Microsoft Office clients, requiring frequent Admin sign-in, and requiring MFA for device registration/join.

7 details in Everything

Huntress Managed EDR for macOS now ejects deceptive installers seen Jul 13, 2026 · issue 014

Huntress Managed EDR for macOS auto-ejects malicious DMGs before payload execution, blocking infostealers.

Automatically ejects deceptive/malicious DMG installers on macOS before their payloads can execute, blocking infostealer malware.
Delivers on-screen user notifications explaining why a DMG was ejected.
Triggers a Huntress SOC investigation on every DMG ejection event to confirm endpoint cleanliness.

3 details in Everything

Huntress Managed EDR stops macOS infostealers before they run seen Jul 13, 2026 · issue 014

Huntress Managed EDR now blocks macOS infostealers at the Gatekeeper-override moment on macOS 14+.

New macOS infostealer prevention: detects and stops infostealer execution at the moment a user is socially engineered into overriding Apple's Gatekeeper, available on macOS 14 and later.

1 detail in Everything

Lock down Microsoft 365 identities today as Managed ISPM hits General Availability seen Jul 13, 2026 · issue 014

Huntress Managed ISPM hits GA, delivering continuous M365 identity hardening across Entra ID, Exchange, SharePoint, and Teams.

└──▷ HOW TO FIND IT

Use Learning Mode to model the blast radius of a new Conditional Access policy before it goes live — preventing unexpected user lockouts across tenants.

📍In the Huntress console, navigate to ISPM › Conditional Access Policies, select a recommended template, then enable Learning Mode to preview impact before deploying enforcement.

Adds Managed ISPM (Identity Security Posture Management) at General Availability, continuously hardening Microsoft 365 environments against misconfigurations and over-permissioned accounts.
New Huntress-managed security controls span Microsoft Entra ID, Exchange Online, SharePoint, and Teams — covering the most commonly abused identity attack surfaces.
Adds Conditional Access policy management with recommended templates, giving practitioners a curated baseline for CA enforcement.
New Learning Mode delivers pre-deployment impact analysis for Huntress-managed Conditional Access policies before any enforcement is applied.
Managed Deployment enables a continuously updated identity framework that automatically keeps all managed organizations aligned with the latest security updates.

+1 more show less

Drift Detection triggers within minutes of configuration change, with Continuous Enforcement to maintain alignment with security best practices.

6 details in Everything

OSINT 2 Simulation is in GA seen Jul 13, 2026 · issue 014

Huntress adds OSINT 2 Simulation in GA, teaching learners the risks of oversharing online.

New OSINT 2 Simulation (fifth simulation) now generally available, covering risks of oversharing personal information online.
Accompanies July's managed learning assignment for structured security awareness training.

2 details in Everything

SAT Custom HTML Phishing is GA seen Jul 13, 2026 · issue 014

Huntress Managed SAT now offers GA Custom HTML Phishing Scenarios for targeted spearphishing simulations.

SIEM Okta integration is now GA seen Jul 13, 2026 · issue 014

Huntress Managed SIEM adds Okta as a GA log source with SOC-built detections for identity-based attacks.

└──▷ HOW TO FIND IT

Connect Okta System Log to Huntress Managed SIEM to enable identity-layer detection coverage.

📍In the Huntress portal, navigate to SIEM › Log Sources › Add Source, select Okta (API – Okta System Log), and follow the configuration guide at https://support.huntress.io/hc/en-us/articles/50820786591379-API-Okta-System-Log

Adds Okta as a supported identity and authentication log source in Huntress Managed SIEM (generally available).
New SOC-built detections for Okta covering credential attacks, privilege escalation, MFA bypass and fatigue, account takeover, and federated identity manipulation.
Extends SIEM visibility to the identity layer for organizations using Okta as their IdP or SSO provider.

3 details in Everything

The Microsoft Defender for Endpoint (MDE) integration now supports GCC High tenants seen Jul 13, 2026 · issue 014

Huntress MDE integration now supports GCC High tenants, routing API traffic to .us endpoints automatically.

Supports onboarding Microsoft Defender for Endpoint (MDE) tenants in GCC High environments, with login, Graph, and MDE API traffic automatically routed to GCC High .us endpoints.
Enables GCC High tenants already mapped in ITDR to be onboarded into MDE using the same tenant.

2 details in Everything

The Microsoft Defender for Endpoint (MDE) integration now supports GCC High tenants Jul 7, 2026 · release notes

Huntress MDE integration adds GCC High tenant support for compliant onboarding and API routing

Adds support for onboarding Microsoft Defender for Endpoint (MDE) tenants in GCC High environments
Routes login, Graph, and MDE API traffic to GCC High .us endpoints automatically upon configuration

2 details in Everything

macOS Screen Sharing session visibility and root-session abuse detection Jul 1, 2026 · release notes

Huntress adds visibility into macOS Screen Sharing sessions and a detection for legacy root-session abuse.

└──▷ HOW TO FIND IT

Suppress session user telemetry in the console for specific hosts to reduce noise.

📍In the Huntress console, navigate to Host Settings › Telemetry Filters › Screen Sharing and disable session_user for targeted Macs.

Adds per-host field suppression capabilities for source address, session user, and authentication type in Screen Sharing session telemetry
Introduces a new detection for unauthenticated remote file read via legacy Screen Sharing handshake

2 details in Everything

Huntress Managed EDR stops macOS infostealers before they run Jun 30, 2026 · release notes

Huntress Managed EDR now blocks macOS infostealers by catching Gatekeeper override attempts on macOS 14+

Catches the moment an end user overrides Apple's Gatekeeper to launch an infostealer
Available on macOS 14 and later

2 details in Everything

SAT Custom HTML Phishing is GA Jun 30, 2026 · release notes

Huntress Managed SAT now supports general availability of custom HTML phishing scenarios for partners and customers.

Lock down Microsoft 365 identities today as Managed ISPM hits General Availability Jun 30, 2026 · release notes

Huntress Managed ISPM GA adds Learning Mode for impact analysis and drift detection to M365 identity hardening

Adds Learning Mode which provides pre-deployment impact analysis for managed Conditional Access policies
Introduces Drift Detection within minutes for automated identity configuration alignment
Enables Managed Deployment of a continuously updated identity framework with continuous enforcement

3 details in Everything

SIEM Okta integration is now GA Jun 24, 2026 · release notes

Huntress Managed SIEM GA support for Okta logs with built-in detections.

Huntress Managed SIEM now supports Okta as an identity and authentication log source
Huntress SOC includes detections for credential attacks, privilege escalation, MFA bypass, account takeover, and federated identity manipulation targeting Okta

2 details in Everything

AI Search for Huntress Managed SIEM has officially gone GA Jun 24, 2026 · release notes

Huntress Managed SIEM introduces GA AI Search for plain English log queries and ESQL translation

Adds AI Search capability to Huntress Managed SIEM allowing users to search logs using plain English instead of only ESL or the Query Builder
Adds an ESQL button after running a plain-English AI Search that displays the translated ESQL query to help users learn the syntax

2 details in Everything

Additional Security Controls in Managed ISPM Jun 24, 2026 · release notes

Managed ISPM adds security controls for SharePoint/Teams and continuous enforcement for Azure/Microsoft identities.

Adds idle session timeout and anonymous sharing block for SharePoint and OneDrive in Managed ISPM
Blocks user creation of SharePoint sites in Managed ISPM
Retains deleted user OneDrive content for at least 90 days
Blocks communication with unmanaged Teams tenants in Managed ISPM
Ensures organization cannot communicate with accounts in trial Teams tenants

+5 more show less

Adds continuous enforcement with drift detection and auto-remediation for Azure Management portal access policy
Adds continuous enforcement with drift detection and auto-remediation for unused device types blocking policy
Adds continuous enforcement with drift detection and auto-remediation for guest Office client restriction policy
Adds continuous enforcement with drift detection and auto-remediation for frequent admin sign-in policy
Adds continuous enforcement with drift detection and auto-remediation for MFA on device registration/join policy

10 details in Everything

The redesigned Managed Antivirus Dashboard is now GA Jun 17, 2026 · release notes

Managed Antivirus Dashboard GA brings Microsoft Defender activity tracking with new AV Events view and top org/agent summaries.

Adds a Recently installed agents tab to the Managed Antivirus Dashboard for verifying new endpoint configurations
Introduces a dedicated AV Events view rolling up severities with quarantined and removed totals
Adds Top organizations with events and Top agents with events panels to identify noisy sources

3 details in Everything

Automate agent management with the Agents Write API (GA) Jun 16, 2026 · release notes

Huntress GA release introduces Agents Write API for programmatic agent management

Adds Agents Write API (GA) enabling partners to programmatically uninstall agents, update tags, toggle tamper protection, and isolate or release hosts via automation tools

1 detail in Everything

Managed ISPM: Enhanced Security Controls Jun 12, 2026 · release notes

Managed ISPM adds Exchange Online, Teams, and SharePoint/OneDrive security controls.

Adds Exchange Online control to ensure the Common Attachment types filter is enabled
Adds Exchange Online control to ensure notifications for internal users sending malware is set to Enabled
Adds Exchange Online control to ensure Exchange Online spam policies are set to notify administrators
Adds Exchange Online control to ensure that SPF records are published for all Exchange domains
Adds Microsoft Teams control to disable communication with unmanaged Teams

+2 more show less

Adds SharePoint Online control to ensure Guest resharing of SharePoint and OneDrive files is set to Disabled
Adds SharePoint Online control to ensure Legacy authentication protocols are blocked for SharePoint and OneDrive

7 details in Everything

Learning Mode for Conditional Access Jun 10, 2026 · release notes

ISPM Learning Mode for Conditional Access allows 14-day impact monitoring before policy deployment.

New SAT Assignment PDF summary report Jun 4, 2026 · release notes

New SAT Assignment PDF summary report accessible via UI export button

SCORM export support is now in GA Jun 2, 2026 · release notes

Huntress SAT content can now be exported as SCORM 1.2 files via the portal for LMS integration.

Adds SCORM 1.2 compatible file export for SAT content directly within the Huntress portal

1 detail in Everything

Managed ISPM New Features and Security Controls May 28, 2026 · release notes

Managed ISPM introduces Exchange Online security controls, Risk Exceptions for policy bypass, and Platform Notifications.

Adds Connection Filter Should Not Bypass Spam Filtering control to block spam bypass attempts in Exchange Online
Adds Transport Rules Should Not Bypass Security Controls control to prevent transport rules from circumventing security settings
Adds Block Exchange Forwarding control to prevent email forwarding outside the organization
Adds Ensure MailTips are enabled control to mandate MailTips functionality in Outlook
Adds Ensure External Flag is visible within Outlook control to display external sender indicators

+6 more show less

Adds Ensure Modern Authentication is enabled control to require modern auth protocols
Adds Ensure 'AuditDisabled' organizationally is set to 'False' control to enforce auditing
Adds Ensure SMTP AUTH is disabled control to block legacy authentication methods
Adds Block Outlook External Storage Providers control to prevent saving files to external cloud storage
Adds policy exclusion capability via Risk Exceptions to suppress non-compliant flags and escalations for specific policies
Consolidates prior Escalations into Platform Notifications that do not require acknowledgment or resolution

11 details in Everything

Updated Organization API for reporting and dashboards May 27, 2026 · release notes

Huntress GET /v1/organizations/{id} now returns per-product stats (SIEM storage, EDR agents, ITDR counts) for dashboards

GET Organization API endpoint returns fields that separate statistics by product (SIEM, EDR, SAT, and ITDR)
Organization API exposes SIEM storage usage data
Organization API provides EDR agent counts for unresponsive, outdated, and isolated agents
Organization API provides per-tenant ITDR identity counts

4 details in Everything

ServiceNow ticket integration is generally available May 20, 2026 · release notes

Huntress general availability for ServiceNow integration allows account admins to configure notification delivery.

Webhooks for real-time notification delivery May 20, 2026 · release notes

Adds webhook support for real-time event notifications and signature verification

Introduces webhooks to all Huntress accounts for real-time event notifications without API polling
Supports signature verification for payload authenticity

2 details in Everything

You can now export ITDR Incident Report with Timeline! May 18, 2026 · release notes

Adds Export Timeline button to ITDR Incident Report for PDF generation.

Detecting Social Engineering for Infostealers on macOS May 14, 2026 · release notes

Huntress adds proactive defense against prevalent macOS infostealer malware through real-time file scanning and behavioral screen analysis.

Unwanted Access Rules API is now available Apr 29, 2026 · release notes

New Unwanted Access Rules API to manage ITDR rules by country or VPN via CRUD endpoints.

Exposes an Unwanted Access Rules API with endpoints to list, create, update, and delete unwanted access rules
Allows scoping rules to account, organization, or specific identity levels
Supports expected/unauthorized determinations for identity access attempts
Enables optional scheduled rule activation using starts_at and expires_at fields

4 details in Everything

EDR/ITDR Correlations Now Live! Apr 29, 2026 · release notes

Huntress introduces EDR/ITDR Correlations, linking endpoint detections to cloud identities in Incident Reports for instant remediation.

EDR/ITDR Correlations now appear directly inside the EDR Incident Report alongside endpoint findings
Managed ITDR enables immediate, guided remediation (revoke sessions, disable accounts) for correlated identities

2 details in Everything

New Platform portal role for provisioning activities Apr 27, 2026 · release notes

New Platform portal role for provisioning activities

Adds a new role in the Platform that allows account admins to create users with permissions limited to onboarding and offboarding organizations.

1 detail in Everything

Huntress MCP Server is now available Apr 27, 2026 · release notes

Huntress releases an MCP server to connect platform data to AI assistants

Huntress now provides an MCP server for read-only access to account information including agents, organizations, signals, incident reports, escalations, remediations, invoices, reports, and external recon.
Enables seamless integration of Huntress Platform data into AI assistants like Claude and ChatGPT via the new MCP server.

2 details in Everything

New Identities API endpoint Apr 27, 2026 · release notes

New GET /v1/identities API endpoint for listing Managed ITDR and ISPM identities

Combating Adversaries Abusing Vulnerable Drivers Apr 20, 2026 · release notes

Huntress Managed EDR now detects when Windows blocks a known vulnerable driver (BYOVD tradecraft)

Managed ITDR for GWS: Logs Now Ingested by Huntress SIEM Apr 16, 2026 · release notes

Huntress SIEM now ingests Google Workspace logs for Managed ITDR at no extra cost

macOS EDR Agent Installation Improvements Apr 14, 2026 · release notes

Redesigned macOS Configuration Wizard with MDM-focused view and consolidated setup flow

Redesigned Huntress Configuration Wizard on macOS for a clearer, faster setup flow.
Shows all required setup steps (system extension approval, Full Disk Access, network filter) on a single scrollable page.
Adds a dedicated MDM-managed endpoint view in the Configuration Wizard showing a summary of pending steps.

3 details in Everything

Managed EDR improvements with our Defender for Endpoint integration Apr 9, 2026 · release notes

New Command Center widgets for MDE tenant health, coverage gaps, and data flow alerts

Adds a new widget in the Command Center showing the percentage of endpoints running MDE that lack the Huntress agent
Adds an Account-level view to summarize the health of all MDE tenants in one place
Adds a visual alert icon and clearer language when data stops flowing from Microsoft to Huntress

3 details in Everything

Google Workspace Student License Exclusions Now Available Apr 6, 2026 · release notes

Huntress adds ability to exclude Google Workspace student OUs from ITDR billing and detections via account manager.

Adds Student OU Exclusions for Google Workspace environments, allowing partners to exclude student organizational units from ITDR billing and detection
Implements automatic signal filtering so excluded identities do not generate security signals or appear in billing calculations

2 details in Everything

Lock down Microsoft 365 identities with Managed ISPM, now in free Early Access for ITDR tenants Mar 31, 2026 · release notes

Huntress adds Managed ISPM for Microsoft 365 identities with drift detection and self-enrollment in Early Access

Adds continuous hardening of Microsoft Entra ID settings including MFA, admin accounts, passwords, standard users, and guests
Adds Conditional Access policy management with recommended templates and drift detection with Continuous Enforcement

2 details in Everything

Managed ITDR for Google Workspace GA Released Mar 30, 2026 · release notes

Managed ITDR for Google Workspace reaches general availability with identity threat detection and response capabilities.

Automated monthly and quarterly reports via email for account admins Mar 26, 2026 · release notes

Account admins can now configure email recipients to receive automated monthly and quarterly reports via a new Manage Recipients button in the Platform portal.

External Recon data is now available via API Mar 26, 2026 · release notes

Huntress exposes External Recon data via two new API endpoints

Adds GET /v1/external_ports endpoint for querying external attack surface records
Adds GET /v1/external_ports/{id} endpoint for retrieving details of a specific record

2 details in Everything

Subscription management for resellers now available via API Mar 26, 2026 · release notes

Huntress adds /v1/reseller/subscriptions API for resellers to manage managed account subscriptions programmatically.

Adds /v1/reseller/subscriptions endpoints to create, retrieve, update, and upgrade Managed EDR, ITDR, SAT, and SIEM subscriptions.

1 detail in Everything

Email integrations users can now opt out of resolved emails Mar 26, 2026 · release notes

Huntress email integration destinations now include a Send Resolved notifications toggle to stop receiving resolved emails.

New reseller API billing endpoints now available Mar 26, 2026 · release notes

Huntress adds new Reseller API billing endpoints for programmatic invoice and usage data access

Adds GET /v1/reseller/invoices endpoint to retrieve a full invoice index.
Adds GET /v1/reseller/invoices/{id} endpoint to retrieve specific invoice details.
Adds GET /v1/reseller/invoices/{id}/account_usage_line_items endpoint for account-level granular line-item breakdowns.
Adds GET /v1/reseller/invoices/{id}/organization_usage_line_items endpoint for organization-level granular line-item breakdowns.

4 details in Everything

Introducing Attack Disruption in Managed EDR Mar 3, 2026 · release notes

Huntress Managed EDR introduces the Attack Disruption Engine for Windows to create friction against threat actors.

SAT "Report a Phish" Gmail now uploads complete message via API Feb 24, 2026 · release notes

SAT Gmail plugin transmits Report a Phish messages via API to preserve full headers

Gmail Report a Phish plugin now uploads complete message including all original headers via API instead of forwarding as plain text email

1 detail in Everything

Improvements to Windows Defender Antivirus Exclusions Feb 23, 2026 · release notes

Huntress Platform enables indefinite bulk exclusions for Windows Defender Antivirus via new UI actions

Removes the 30-day restriction on allow-list exclusions for Windows Defender Antivirus, permitting indefinite duration
Adds bulk action buttons in the Managed EDR > Managed Antivirus Exclusions interface to modify selected exclusions

2 details in Everything

New Notification Categories and Improvements to Visibility, Configuration, and Mappings Feb 2, 2026 · release notes

Huntress adds Platform Action and Account Notice notification categories with expanded visibility and configuration controls.

SAT Notifications Log is in GA Jan 30, 2026 · release notes

Huntress adds GA Notifications log report for SAT admins to audit notifications across SMTP, API, Slack, and Teams.

ITDR Data Exfiltration Timeline now available Jan 22, 2026 · release notes

ITDR Data Exfiltration Timeline now available in incident reports to show adversary activity chronology.

Adds a new Data Exfiltration Timeline view within ITDR incident reports for subscribers
Chronologically records compromise start time, Microsoft log receipt time, and Huntress action time

2 details in Everything

Additional ITDR Microsoft Audit Log Ingestion Jan 20, 2026 · release notes

Huntress ITDR adds Audit.General and Audit.Sharepoint log ingestion for all users

Makes the new audit log data available to all Huntress users for threat detection via Huntress SIEM functionality, without requiring a separate SIEM subscription.

1 detail in Everything

Write APIs for Account and Organization Management Jan 16, 2026 · release notes

New Organizations and Reseller write APIs enable automated account/org management without logging in

Adds the Organizations API to create, update, and delete organizations via automation
Adds the Reseller API to automate account onboarding and off-boarding

2 details in Everything

Billing sync with HaloPSA now supported Jan 2, 2026 · release notes

Huntress Platform adds automatic billing sync with HaloPSA integration.

Adds automatic billing information syncing for the HaloPSA integration to automate client billing.

1 detail in Everything

SAT Import PDF in Custom Content Creator (Early Access) Dec 15, 2025 · release notes

New Import PDF option in the SAT Custom Content Creator allows importing slides from exported Google Slides or PowerPoint decks.

Adds the ability to import PDF files into the Custom Content Creator as slides for SAT training modules.

1 detail in Everything

New SAT API endpoints for reports (GA) Dec 15, 2025 · release notes

Huntress SAT introduces GA report APIs for programmatic access

Adds new SAT API endpoints for generating and retrieving reports

1 detail in Everything

SAT Custom Content Creator - Import PDF is GA Dec 15, 2025 · release notes

SAT Custom Content Creator now allows admins to upload PDFs containing PowerPoint or Google Slides exports.

"Deny All" Functionality for ITDR Configuration Rules Dec 4, 2025 · release notes

Huntress ITDR now supports Deny All configuration rules to revoke sessions from outside allowed countries or anonymous VPNs

Adds account- and organization-level Deny All location rules that revoke login sessions and disable identities when accessed from outside expected countries
Adds account- and organization-level Deny All VPN rules that revoke login sessions and disable identities when accessed via anonymous VPNs

2 details in Everything

Standard Reports are in GA (GA) Nov 25, 2025 · release notes

Huntress releases Standard Reports for Phishing & Assignments in GA, adding granular performance and trend views.

APIs for Escalations and Incident Report responses now available Nov 24, 2025 · release notes

New write APIs for escalation management and incident report remediation actions now available.

Adds GET /escalations API endpoint to list escalations
Adds GET /escalations/{id} API endpoint to retrieve specific escalation details
Adds new API endpoint to enable resolution of common escalations
Adds POST /v1/incident_reports/{id}/resolution endpoint for approving/rejecting remediations and resolving incident reports

4 details in Everything

Support for Additional Endpoints and Organizations in Windows Defender Antivirus Exclusion Settings Nov 24, 2025 · release notes

Huntress adds capability to append endpoints and organizations to existing Windows Defender Antivirus exclusion settings

New "Image" slide type in SAT custom content creator (GA) Nov 20, 2025 · release notes

Huntress' SAT custom content creator now supports an Image slide type for full-bleed visuals. This GA feature allows users to add screenshots or exported images that maintain aspect ratio during resizing, enhancing report customization without cropping.

Portal-wide dark mode is here! Nov 20, 2025 · release notes

Huntress Portal introduces a universal dark mode theme accessible via the settings gear icon.

Adds dark mode theme support to all Portal pages

1 detail in Everything

New languages available for Threat Summary Reports Nov 20, 2025 · release notes

Huntress adds Dutch, French, and Spanish options to Threat Summary Report settings.

Detection and remediation of attacker abuse of Windows Firewall rules Nov 12, 2025 · release notes

Huntress Managed EDR detects and remediates attacker abuse of Windows Firewall to block agent/Defender comms

Adds detection and automated remediation for attackers abusing Windows Firewall rules to impair Huntress EDR and Windows Defender

1 detail in Everything

General Manager View is in GA for SAT (GA) Nov 4, 2025 · release notes

General Manager View is now generally available for Huntress Managed SAT, enabling read-only access to assignment and phishing reports for designated learners via a new UI toggle.

GA Release of SentinelOne as a Log Source Sep 24, 2025 · release notes

Huntress Managed SIEM now supports SentinelOne as a log source with GA configuration guide.

User-level API keys are now available in the Huntress Platform Sep 19, 2025 · release notes

Huntress adds user-specific API keys assignable by Account Admins to mirror individual permissions

Adds user-level API keys that can be assigned by Account Admins, allowing multiple keys per account and mirroring the specific user’s permissions.

1 detail in Everything

New Organization selector in the Huntress Portal Sep 19, 2025 · release notes

Huntress Portal adds a search-enabled Organization selector to the navigation bar.

Full history in Incident Reports is now available Sep 12, 2025 · release notes

Incident Reports now show full SOC activity history with View Changes button

Incident Reports now display the complete history of all SOC updates, with latest details at the top and previous updates shown below.
A new View Changes button highlights modifications in each update within Incident Reports.

2 details in Everything

New Huntress Platform API documentation page Sep 12, 2025 · release notes

New Huntress Platform API documentation page with PowerShell samples and dark mode

Adds simplified navigation to the Huntress Platform API docs at https://api.huntress.io/docs
Enables generation of sample API commands in PowerShell via the new documentation interface
Adds dark mode option to the API documentation page

3 details in Everything

Account team (CAM) contact info now visible in the Portal Sep 12, 2025 · release notes

Huntress Portal now displays Account team (CAM) contact info in multiple locations

Adds CAM name and contact information to the Contact Sales workflow for direct outreach
Exposes CAM details on the Billing & Invoices page for account-specific support access
Displays CAM contact info within Trial Manager to facilitate trial-related inquiries

3 details in Everything

Improved visibility into failed tickets with integrated PSA ticketing systems Sep 12, 2025 · release notes

Huntress portal now displays error messages from PSA ticketing integrations and allows resending failed tickets.

Adds visibility into error messages returned by integrated PSA ticketing systems in the Huntress Portal
Enables initiation of resend actions for any failed tickets created via the PSA integration

2 details in Everything

SAT Manager Phishing Notifications is in GA (GA) Sep 4, 2025 · release notes

SAT Manager Phishing Notifications GA allows managers to receive immediate alerts on simulated compromises by direct reports.

Google API insertion for SAT is GA (GA) Sep 4, 2025 · release notes

Google API insertion for SAT transactional and phishing emails reaches GA.

Tamper Protection for Managed EDR for macOS is now live Sep 3, 2025 · release notes

Huntress extends endpoint defense capabilities to macOS by introducing Tamper Protection for its Managed EDR agents. This feature safeguards the agent process and associated system files from active tampering or removal by threat actors, ensuring continuous visibility. Administrators can temporarily pause this protection for maintenance tasks via the web portal.

Enhanced Windows Firewall status in the Portal Sep 3, 2025 · release notes

Huntress Portal now displays in-depth Windows Firewall status for Domain, Private, and Public profiles.

Audit logging for the Huntress Platform Jul 18, 2025 · release notes

Centralized audit logging for Portal activity available via SIEM Dashboard

Adds Audit Log access in the Portal top menu bar (hamburger icon) and SIEM Dashboard Starter Queries.
Enables automatic, free central logging of all Portal events to Huntress SIEM for compliance reporting.

2 details in Everything

Portal enhancements to engage with SOC Support Jul 7, 2025 · release notes

UI updates to Huntress Portal make requesting SOC Support easier via Incident Triage Feed and deep links.

Adds a SOC Support button on the Incident Triaging Feed page for quicker requests during urgent situations
Displays a banner in the Portal when a callback request has been initiated
Includes a deep link in the text version of Incident Reports so support requests can be made from a PSA or integrated ticketing system

3 details in Everything

Simulation 2: Spear phishing is in GA (GA) Jul 1, 2025 · release notes

Spear phishing simulation available in GA for learners and admins

Adds Simulation 2: Spear phishing as a GA optional activity after the Spear Phishing 2 episode completion
Adds Spear Phishing 2 simulation to the Assignments area for learners
Enables admins to preview the Simulation 2: Spear phishing in the library

3 details in Everything

Identity Disablement/Enablement for Active Directory Synced Identities Jun 24, 2025 · release notes

Huntress adds identity disablement/enablement for AD synced identities via agent v0.14.22+ and portal

Adds ability to disable and re-enable Active Directory synced (hybrid) identities using the Huntress agent on an organization’s AD server.
Adds identity disablement as a Containment (automatic) remediation option for AD synced identities in Huntress Managed ITDR.
Adds identity disablement as an Assisted (partner-initiated from incident report) remediation option for AD synced identities.
Allows partners to disable AD synced identities directly from the Huntress portal.
Introduces a new escalation notification when an AD synced identity disablement task fails.

5 details in Everything

Autotask PSA integration is now GA Jun 10, 2025 · release notes

Huntress adds general availability for Autotask PSA integration with configurable incident reports and billing.

Autotask PSA integration is now generally available, allowing configuration of incident reports and billing information.

1 detail in Everything

Automatic SAT Assignment Recommendations for Incidents Jun 10, 2025 · release notes

Adds Recommendations tab in Incident Report to auto-suggest SAT episodes for assignment

Adds a Recommendations tab to the Incident Report UI for existing SAT customers with EDR and/or ITDR.
Enables one-click assignment of recommended SAT episode(s) directly from the Incident Report.
Links assigned training completion back to the SAT portal for tracking.

3 details in Everything

macOS XProtect AV and Windows Defender for Endpoint Coverage Jun 10, 2025 · release notes

Huntress adds macOS XProtect visibility and Microsoft Defender for Endpoint integration.

Adds visibility into macOS XProtect alerts, triggering high-fidelity signals visible on the new Antivirus page in the Mac agent detail pages in the Portal
Adds Microsoft Defender for Endpoint (MDE) integration generating Signals from MDE alerts and showing Defender status on the Antivirus page
Adds capabilities to request a Defender scan and signature update via the Antivirus page in the Portal

3 details in Everything

SAT & SIEM billing information is now available in Connectwise, Autotask & the API May 13, 2025 · release notes

Adds SAT and SIEM usage counts to ConnectWise, Autotask, and Organizations API billing integrations

The report API can now return data contained in a PDF May 13, 2025 · release notes

Huntress Report API now returns raw data for PDF reports instead of just a link

SAT Microsoft Teams integration is in GA (GA) Apr 17, 2025 · release notes

SAT Microsoft Teams integration is now generally available for incident notifications.

Moves the SAT Microsoft Teams integration from Early Access to General Availability, allowing security teams to rely on it for production incident workflows.

1 detail in Everything

New Feature: Add Comments to Incident Reports Apr 4, 2025 · release notes

Adds ability to add comments to Incident Reports in the Huntress Dashboard for team coordination.

Enables adding comments directly to Incident Reports via the Huntress Dashboard for internal triage and handoffs.

1 detail in Everything

Huntress Managed SIEM Now Uses Custom Syslog Collection Ports (GA) Apr 3, 2025 · release notes

GA release enabling custom syslog ports for Huntress SIEM agent flexibility in constrained network environments.

Assign custom syslog collection ports during configuration.

1 detail in Everything

Rogue Apps Now in General Availability Mar 19, 2025 · release notes

Rogue Apps GA enables detection and remediation of Traitorware and Stealthware in Microsoft tenants via a new dashboard.

Enables automatic disabling of Traitorware (frequently abused legitimate apps) and Stealthware (rare, high-permission unknown apps) in Microsoft tenants.
Adds detection and remediation logic that disables identities with permissions delegated to identified Rogue Apps.

2 details in Everything

Update - Managing an Organizations Billable Products Mar 14, 2025 · release notes

Partner account admins can now enable or disable Managed EDR and SIEM products for individual organizations.

Update: Windows EDR Tamper Protection Feb 24, 2025 · release notes

Huntress limits Tamper Protection overrides to 4 hours in the dashboard

└──▷ BREAKING ON UPGRADE

!Tamper Protection can no longer be turned off indefinitely via the dashboard; overrides are capped at 4 hours

PDF Attachment Phishing is now available (GA) Jan 8, 2025 · release notes

Huntress now includes PDF-based phishing simulations for security awareness training.

Adds PDF Attachment Phishing simulation capability to the Huntress platform

1 detail in Everything

Password-less login now available for all Trials (GA) Dec 27, 2024 · release notes

Huntress Trials now support Magic Link login and reduced signup friction

Adds Magic Link login for Huntress trial accounts
Updates trial signup flow to request only business email address

2 details in Everything

SAT Dashboard page in GA Dec 10, 2024 · release notes

The SAT Dashboard page is now generally available to all customers and partners.

Ability to rename Huntress Managed Learning Plan is in GA Dec 10, 2024 · release notes

Huntress introduces Managed Learning Plan renaming and configurable launch times

Allows partners to rename Huntress Managed Learning Plans via the gear icon on the Managed Learning Plan page
Adds beta configuration for customized learning plan launch time of day to support EMEA and ANZ audiences

2 details in Everything

SOC Phone Support from Incidents Dec 4, 2024 · release notes

Managed EDR partners can now request SOC phone support directly from the Huntress Portal via new incident report buttons

Adds a Request SOC Support button to the top right of all Managed EDR critical incident reports in the portal

1 detail in Everything

Enhanced Security: Tamper Protection for Windows Oct 21, 2024 · release notes

New Tamper Protection feature for Windows endpoints requiring Dashboard intervention for agent uninstallation.

Enforces that the Huntress Agent on Windows cannot be easily uninstalled or tampered with locally by default.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Local uninstallation of the Huntress Agent is blocked unless Tamper Protection is explicitly disabled in the Dashboard first.

Update: Editable Incident Reports Oct 11, 2024 · release notes

Huntress allows editing of existing incident reports to consolidate updates into a single notification.

Incident report content (details, status, severity, remediation guidance) can now be edited and reflected in a single report instead of triggering new reports for each change.

1 detail in Everything

Brand New Huntress Managed SAT Learner Dashboard with Leaderboards! Oct 10, 2024 · release notes

New SAT Learner Dashboard with prioritized episodes and beta leaderboards for Huntress Managed SAT.

Adds a new Huntress Managed SAT Learner Dashboard with episodes prioritized by time remaining
Introduces admin-controlled leaderboards in Open Beta to track SAT progress

2 details in Everything

MDR for Microsoft 365 Unwanted Access Now in General Availability Aug 21, 2024 · release notes

Huntress MDR for Microsoft 365 Unwanted Access now GA with configurable Expected and Unauthorized rules and escalation handling.

Unwanted Access for MDR for Microsoft 365 is now generally available for detecting malicious login activity.
Configurable Expected rules in the Unwanted Access dashboard to specify countries/VPNs where logins are allowed, filtering out anomalies.

2 details in Everything

Configure which hosts collect Windows Event logs Aug 19, 2024 · release notes

Huntress introduces granular control over Windows Event log collection via new UI settings at the account, organization, and host levels.

Adds a new Account-level setting page to enable or disable Windows Event log collection for all supported hosts.

1 detail in Everything

Escalation Notifications in MDR for Microsoft 365 Aug 16, 2024 · release notes

New Entra Usage Location Not Set and Unexpected Login escalation notifications for MDR customers on Microsoft 365

Adds email and PSA ticket notifications for the Entra Usage Location Not Set low-severity escalation.
Adds email and PSA ticket notifications for the Unexpected Login high-severity escalation.

2 details in Everything

MDR for Microsoft 365 Unwanted Access Now in Public Beta Aug 2, 2024 · release notes

MDR for Microsoft 365 Unwanted Access enters public beta with session token theft detection and rule configuration.

Introduces Session Token Theft Detection to identify differences within login events from the same session
Adds Unwanted Access Rules dashboard to configure Expected and Unauthorized rules for countries and VPNs
Enables Escalations for unknown login locations and unknown VPNs during public beta

3 details in Everything

New Incident Simulation Feature! Jun 27, 2024 · release notes

Huntress introduces Incident Simulation feature for EDR and Microsoft 365 to test response workflows via UI.

Adds the ability to simulate critical-severity incidents for EDR environments
Adds the ability to simulate critical-severity incidents for Microsoft 365 tenants
Enables use of simulated incidents during tabletop exercises to test security response protocols

3 details in Everything

Update: PSA Automatic Remediation Logging Jun 17, 2024 · release notes

Automatic PSA ticket updates for Remediation Plan approval/rejection actions

Adds automatic Sync of Remediation Plan status (Approved/Rejected) and steps to ConnectWise, Autotask, Syncro, and HaloPSA PSAs when the action is taken in the Huntress Dashboard.
Includes Approver identity and Remediation Steps in the automated PSA ticket payload.

2 details in Everything

Update to the Huntress Dashboard UI Jun 13, 2024 · release notes

Huntress Dashboard UI updates include streamlined navigation icons for Managed EDR, ITDR, and SAT, and relocated reporting/partner menus.

Adds new left-hand navigation icons for Managed EDR, MDR for Microsoft 365 (under ITDR banner), and Managed SAT that link directly to service detail pages
Moves the reporting icon to the top navigation bar
Makes the Partner Enablement icon accessible via the top right menu

3 details in Everything

Update: SOC Comments on Investigated Signals Jun 13, 2024 · release notes

Huntress reintroduces SOC analyst comments on all investigated Signals via UI updates.

Adds SOC Analyst first name and Investigation Comments fields to the Signal Investigated view for benign signals.

1 detail in Everything

New EDR Feature: IP allow list for isolated endpoints Feb 22, 2024 · release notes

Adds IP allow list configuration for isolated endpoints to enable self-hosted RMM connectivity.

Allows configuration of static IP addresses that isolated endpoints can connect to
Enables remote investigation and remediation of isolated hosts via self-hosted RMM tooling

2 details in Everything

Update: Signals Investigated View Feb 6, 2024 · release notes

Signals Investigated are now accessible across the entire Huntress Platform with unified views for endpoints and identities.

Replaces data source specific detection views and autorun only investigations with all encompassing investigated signal views
Enables access to Signals Investigated across the entire Huntress Platform

2 details in Everything

MDR for Microsoft 365 Progress Report #2 Jan 2, 2024 · release notes

Huntress MDR improves account takeover detection via VPN enrichment and user identity resolution

Incorporates Spur.us VPN data into Microsoft 365 event analysis to enhance anomalous login and account takeover detection.
Adds event processing enrichment that resolves user identities using GUID lookups when UPN fields are unavailable, ensuring accurate user association.

2 details in Everything

MDR for Microsoft 365 Progress Report #1 Dec 11, 2023 · release notes

MDR for Microsoft 365 adds geolocation enrichment via Spur and six new login-based detectors.

Adds IP address geolocation and VPN/anonymization detection signals via partnership with Spur.
Adds six new detectors: Login from VPN, Login from proxy, Login from brute force IP, Login from TOR, Login from new region, and Login from RDP.
Increases Elasticsearch query maximum hits limit to 5,000 for improved detection coverage.

3 details in Everything

New Feature: Credential Reports Oct 25, 2023 · release notes

Huntress introduces Credential Reports to detect users accessing insecurely stored credential files.

Detects and reports on end users accessing possible credential files that are being stored insecurely
All accounts are opted-in to this feature by default unless an admin opts out in Account Settings

2 details in Everything

New Feature: Data Export to Amazon S3 Buckets Oct 23, 2023 · release notes

New feature to export Process Insights Data directly to US East Region 1 Amazon S3 buckets.

New Feature: End User Notification When Isolated Sep 25, 2023 · release notes

New feature: End users on isolated hosts now see a notification informing them of network isolation and instructing them to contact IT.

Adds in-app End User Notification to the active user when their host is isolated, notifying them they have been disconnected from the network and need to contact their IT administrator.

1 detail in Everything

Defender Disabled Escalations (Alerts) Aug 8, 2023 · release notes

Adds new Escalation type for Managed Antivirus endpoints with disabled Microsoft Defender Real-time Protection

Management of Additional Windows Defender Settings! Jul 7, 2023 · release notes

Huntress adds management of additional Windows Defender settings and Tamper Protection status viewing

Adds cloud-delivered protection, automatic sample submission, SmartScreen for apps/files, SmartScreen for Microsoft Store, and PUA blocking to managed AV settings
Adds view-only display of Windows Tamper Protection status on the agent detail page

2 details in Everything

Huntress API is now in General Availability! Aug 12, 2022 · release notes

Huntress API exits Public Beta and reaches General Availability with mock server and expanded documentation.

Adds a mock server to the API suite for testing
Updates route documentation and improved support documentation including Swagger

2 details in Everything

Huntress API is now in Public Beta! May 16, 2022 · release notes

Huntress API Public Beta adds six read-only endpoints and portal-based credential generation

Adds API Credentials option in Account Settings wizard to generate authentication credentials
New /account, /organizations, /agents, /incident-reports, /summary-reports, and /billing-reports endpoints provide read-only access to platform data

2 details in Everything

Managed Antivirus is now in Public Beta! Jan 26, 2021 · release notes

Managed AV enters Public Beta, enabling centralized audit and enforce of Microsoft Defender Antivirus policies via the Huntress dashboard.

Adds the Managed AV service to hunt cyber tooling for centralized management of Microsoft Defender Antivirus
Adds Audit mode to capture Defender status and configuration data without making changes

2 details in Everything

Partner Enablement Nov 4, 2020 · release notes

Huntress expands its Partner Enablement Service with new educational materials, co-branded assets, and threat awareness resources.

Huntress

Summary

How Huntress helps

Languages

Features

What Huntress offers you

release

example

release

release 67 total

docs

example

release 22 total

example 8 total

release 42 total

docs

example

release 14 total

example

release 26 total

example

release 24 total

release 18 total

release 11 total

docs

example

release 11 total

docs

example

release 12 total

release 10 total

release 9 total

release

release

release

release

release

release

example

release

example

Score card

Trajectory

Release-note detail over time

Commercials

Plans by offering

Plan relaunches

Website history

Rebranding timeline

Coverage

Releases

Add the badge to your README