https://cybertoolchain.io/tools/huntress New releases and features in Huntress, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 07:53:36 GMT https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Wed, 28 Oct 2026 07:53:36 GMT Huntress adds Identity Posture Assessment report (PDF + API) and Lookback for 180-day M365 login history analysis on ITDR onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Identity Posture Assessment available via the Huntress API, enabling automated retrieval and integration of M365 tenant posture reports into existing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Identity Posture Assessment, an on-demand PDF report evaluating Microsoft 365 tenants against the Huntress Identity Security Framework — showing gaps, misconfigurations, severity-ranked next steps, and co-brandable output for client QBRs and onboarding. • Adds Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards to Managed ITDR, surfacing earlier compromises and active threats from day one. • Lookback findings appear as a dedicated section of the Identity Security Assessment, delivered by email and available in the Huntress portal within 48 hours of onboarding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/now-live-managed-ispm-identity-posture-assessment https://feedback.huntress.com/changelog/now-live-managed-ispm-identity-posture-assessment Wed, 21 Oct 2026 07:43:50 GMT Huntress launches on-demand Identity Posture Assessment for Microsoft 365, available via portal and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Huntress API endpoint to retrieve the Identity Posture Assessment report programmatically for integration into existing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces the Identity Posture Assessment, an on-demand report that evaluates a Microsoft 365 tenant against the Huntress Identity Security Framework, scoring only licensed controls and ranking gaps by severity. • Generates a co-branded, shareable PDF report from the ISPM dashboard via the Quick Assessment card to support client onboarding, QBRs, and prospect conversations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/find-out-who-was-in-your-microsoft-365-tenant-before-you-were-introducing-manage https://feedback.huntress.com/changelog/find-out-who-was-in-your-microsoft-365-tenant-before-you-were-introducing-manage Mon, 19 Oct 2026 00:00:00 GMT Huntress Managed ITDR gains Lookback: automatic 180-day Microsoft 365 login-history analysis at tenant onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Managed ITDR Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards, surfacing pre-existing compromises from day one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Lookback findings appear as a dedicated section of the Identity Security Assessment, delivered by email and visible in the Huntress portal within 48 hours of onboarding. • Active compromises discovered by Lookback trigger SOC investigation, a critical Incident Report, and active session revocation; previously remediated activity surfaces as historical findings without triggering a new incident. • Lookback runs once, automatically, for eligible Microsoft 365 tenants onboarded on or after October 19, 2026, including trial tenants; not available for GCC, GCC High, or CPV tenants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/siem-log-sources-api-is-now-available https://feedback.huntress.com/changelog/siem-log-sources-api-is-now-available Mon, 05 Oct 2026 16:24:08 GMT Huntress adds a SIEM Log Sources API to list source coverage, status, and 30-day data volume programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a SIEM Log Sources API endpoint that returns each source's name, type, organization, agent, status, last activity, and 30-day data volume — the same data shown on the Source Management page — so partners can audit coverage and detect silent sources without opening the portal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Mon, 05 Oct 2026 07:55:29 GMT Huntress: New Microsoft 365 hardening controls are available for manual scheduling but are excluded from automatic Managed Deployments due to potential end-user impact. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Sun, 04 Oct 2026 07:49:00 GMT Huntress adds five new Microsoft 365 hardening controls for Entra inactive accounts, shared mailboxes, spam, and Bookings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Entra control to block sign-in for member accounts inactive for 90 days, schedulable for deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Entra control to block sign-in for guest accounts inactive for 30 days, schedulable for deployment. • Adds Microsoft Entra control to block sign-in to shared mailboxes, schedulable for deployment. • Adds outbound spam policy control to set explicit sending limits and block senders, schedulable for deployment. • Adds control to restrict Shared Bookings creation to selected users, schedulable for deployment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/new-security-controls-in-managed-ispm-1 https://feedback.huntress.com/changelog/new-security-controls-in-managed-ispm-1 Wed, 30 Sep 2026 07:34:24 GMT Huntress Managed ISPM gains five new Microsoft 365 security controls covering Entra inactive accounts and Exchange Online shared mailboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Entra control to block sign-in for member accounts inactive for 90 days, schedulable for deployment in Managed ISPM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Entra control to block sign-in for guest accounts inactive for 30 days, schedulable for deployment in Managed ISPM. • Adds Microsoft Exchange Online control to block sign-in to shared mailboxes, schedulable for deployment in Managed ISPM. • Adds Microsoft Exchange Online control to ensure outbound spam policies set explicit sending limits and block senders, schedulable for deployment in Managed ISPM. • Adds Microsoft Exchange Online control to restrict Shared Bookings creation to selected users, schedulable for deployment in Managed ISPM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Sat, 26 Sep 2026 07:48:14 GMT Huntress adds Modified Deployments rollout control, Unsecured Credentials overhaul, macOS Screen Sharing visibility, and new macOS quarantine-strip detections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Modified Deployments` org-level setting, letting administrators build a custom control set from the Huntress policy library, select low/medium/high impact items, set deployment days, and approve new controls before they roll out — ideal for strict compliance or change-control environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Network File Scanning` and `Archive File Scanning` toggles for Microsoft Defender in `EDR > Managed Antivirus > Defender Configuration > Scans`, previously fixed to Huntress defaults. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Fri, 25 Sep 2026 13:12:50 GMT Huntress: Adds `Network File Scanning` and `Archive File Scanning` toggles for Microsoft Defender in Managed Antivirus, found under `EDR > Managed Antivirus > Defender Configuration > Scans`; previously fixed to Huntress defaults. • Adds a detection for Screen Sharing sessions that attach to a root user session via a legacy authentication handshake — the signature of a pre-auth flaw in Apple's Screen Sharing service disclosed July 2026; requires Agent v0.14.196. • Adds three macOS quarantine-attribute-strip detections (requires Agent v0.14.196): quarantine removed from a file in a common malware staging folder by a script or shell; quarantine removed from a file on a mounted disk image; a fake installer mounted and a quarantine strip on the same machine within five minutes. • Extends the `Last Logged-In User` field on the agent overview page to macOS endpoints (previously Windows-only), reflecting the most recent interactive console/GUI login; populates on Agent v0.14.196 or later. • Adds two new Microsoft Exchange Online controls against Shadow Workflows — 'Ensure Direct Send is disabled' and 'Tenant Allow/Block list should contain zero entries in the allow list' — available for manual scheduling but excluded from automatic Managed Deployments rollout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/managed-ispm-customize-control-rollouts-with-modified-deployments https://feedback.huntress.com/changelog/managed-ispm-customize-control-rollouts-with-modified-deployments Fri, 25 Sep 2026 07:33:30 GMT Huntress Managed ISPM adds Modified Deployments, letting orgs hand-pick security controls and approval gates before anything rolls out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Modified Deployments, an org-level setting in Managed ISPM that lets you hand-pick which security controls (low, medium, or high impact) from the Huntress policy library roll out and on which days, with no changes deployed until explicitly approved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New controls added by Huntress to the policy library trigger a notification under Modified Deployments but are held until you approve them, supporting strict compliance and change control requirements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/unsecured-credentials-new-credential-files-dashboard-and-allowlisting https://feedback.huntress.com/changelog/unsecured-credentials-new-credential-files-dashboard-and-allowlisting Fri, 25 Sep 2026 07:33:30 GMT Huntress Unsecured Credentials gets a new Credential Files dashboard, pre-enable preview, and allowlisting to cut alert noise.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new 'Credential Files' page under the Process Insights dashboard in Managed EDR to view and manage every file triggering an Unsecured Credentials report in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables preview of which Credential Files would generate an Incident Report before turning Unsecured Credential reporting on. • Adds allowlisting for Credential Files so reviewed and accepted files are excluded from future Unsecured Credentials Incident Reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Thu, 24 Sep 2026 07:51:48 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Wed, 23 Sep 2026 07:43:41 GMT Huntress: Adds three macOS detections for quarantine-attribute removal (xattr strip via system call): script/shell strip in common malware staging folders, strip on a mounted disk image, and a combined fake-installer-plus-strip-within-five-minutes correlation — covering AMOS, Poseidon, Odyssey, and MacSync infostealers; requires Agent v0.14.196. • Adds Screen Sharing session telemetry on macOS — reports source address, session user, and authentication type for each session start, with per-host field suppression; requires Agent v0.14.196. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Tue, 22 Sep 2026 12:59:28 GMT Huntress adds macOS Screen Sharing visibility, quarantine-strip detections, and Defender scan toggle controls for M365 and endpoint hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in Managed Antivirus, found under EDR > Managed Antivirus > Defender Configuration > Scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends the agent overview page to show the last logged-in user for macOS endpoints (previously Windows-only), requiring Agent v0.14.196 or later. • Adds a detection that fires when a Screen Sharing session attaches to a root user via a legacy authentication handshake, covering an unauthenticated file-read flaw in Apple's Screen Sharing service disclosed July 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/new-security-controls-in-managed-ispm https://feedback.huntress.com/changelog/new-security-controls-in-managed-ispm Tue, 22 Sep 2026 07:33:36 GMT Huntress Managed ISPM adds two new M365 security controls targeting Shadow Workflows in Exchange Online and Defender for Office 365.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Ensure Direct Send is disabled' control for Microsoft Exchange Online, available to schedule for deployment in Managed ISPM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Tenant Allow/Block list should contain zero entries in the allow list' control for Microsoft Defender for Office 365, available to schedule for deployment in Managed ISPM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/huntress-now-detects-macos-gatekeeper-bypass-via-quarantine-stripping https://feedback.huntress.com/changelog/huntress-now-detects-macos-gatekeeper-bypass-via-quarantine-stripping Thu, 17 Sep 2026 07:32:55 GMT Huntress adds three macOS Gatekeeper bypass detections covering quarantine stripping via scripts, disk images, and combined fake-installer sequences.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Detects quarantine attribute removal from files in common malware staging folders by a script or shell — covering the ClickFix and AMOS dropper pattern.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Detects quarantine attribute removal from files on mounted disk images — the technique fake installers use to silently bypass Gatekeeper. • Detects a combined sequence of a fake installer mount and a quarantine strip on the same machine within five minutes — a high-confidence pre-execution signal. • Monitors the system call directly rather than the `xattr` command, so detection fires regardless of whether the attacker uses a shell script or compiled binary. • Each detection surfaces the file path, the attribute removed, and the process that removed it, distinguishing malware from legitimate build tooling. • Filters out Apple backup and file-sharing services, which accounted for approximately 99% of noise during testing. • Requires Agent `v0.14.196` or later for all three detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/last-logged-in-user-now-visible-for-macos-endpoints https://feedback.huntress.com/changelog/last-logged-in-user-now-visible-for-macos-endpoints Thu, 17 Sep 2026 07:32:55 GMT Huntress agent overview now shows last logged-in user for macOS endpoints, requiring Agent v0.14.196 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends the last logged-in user field on the agent overview page to macOS endpoints (previously Windows-only), showing the most recent interactive console/GUI login and excluding system-owned login windows and shutdown records; requires Agent v0.14.196 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/new-mav-configuration-settings-network-file-scanning-and-archive-file-scanning https://feedback.huntress.com/changelog/new-mav-configuration-settings-network-file-scanning-and-archive-file-scanning Thu, 17 Sep 2026 07:32:55 GMT Huntress Managed Antivirus now lets you toggle Network File Scanning and Archive File Scanning for Microsoft Defender.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds configurable Network File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (off by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds configurable Archive File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (on by default, covers ZIP, RAR, and similar formats). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Fri, 28 Aug 2026 02:34:14 GMT Huntress adds ITDR Executive Summary PDFs, per-identity escalations, full IPv4 via `ipv4_addresses` API field, WSL visibility, and 7 new ISPM controls. • Adds per-identity escalations for Unexpected Country and Unexpected VPN activity in Managed ITDR, so each affected identity generates its own escalation, notification, and — if a PSA integration is configured — its own PSA ticket. • Adds an Executive Summary in plain text at the top of every ITDR incident report, with a standalone PDF export available via the 'Export PDF' button in the portal. • Adds 7 new Microsoft 365 security controls to Managed ISPM (approaching 80 total): Anti-Malware, Anti-Spam, and Anti-Phishing policies against the Microsoft Standard baseline in Exchange Online Protection; Safe Links, Safe Attachments, Safe Documents, and spoof-protection Anti-Phishing policies in Microsoft Defender for Office 365. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/all-ipv4-addresses-associated-with-an-agent-are-now-displayed-in-portal https://feedback.huntress.com/changelog/all-ipv4-addresses-associated-with-an-agent-are-now-displayed-in-portal Fri, 21 Aug 2026 08:59:40 GMT Huntress Portal now exposes all IPv4 addresses per agent via UI hover, exports, and the `ipv4_addresses` REST API field. • Adds `ipv4_addresses` REST API field on agent records, returning the full list of IPv4 addresses collected by the Base Agent survey — not just the first. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/windows-subsystem-for-linux-visibility-in-huntress-managed-edr https://feedback.huntress.com/changelog/windows-subsystem-for-linux-visibility-in-huntress-managed-edr Fri, 21 Aug 2026 08:59:40 GMT Huntress Managed EDR now surfaces Windows Subsystem for Linux (WSL) status on Windows endpoints to expose shadow IT blind spots. • Adds WSL visibility to the EDR agent page in the Huntress portal, showing WSL status (Installed or Uninstalled) per Windows endpoint across your fleet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Wed, 19 Aug 2026 17:54:51 GMT Huntress adds a transparent SOC Investigation dashboard with timelines, summaries, and CSV/Excel export. • New Investigations dashboard (accessed via 'Investigations' in the top navigation) shows a chronological timeline of SOC signals reviewed, actions taken, remediations applied, and final outcomes for both closed-benign and reported investigations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/view-chronological-timeline-of-every-huntress-investigation-ga https://feedback.huntress.com/changelog/view-chronological-timeline-of-every-huntress-investigation-ga Tue, 18 Aug 2026 08:55:11 GMT Huntress GA's a chronological investigation timeline dashboard with CSV/Excel export across Managed EDR, ITDR, and SIEM. • New 'Investigations' dashboard (accessible via the top navigation in the Huntress portal) shows a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcomes for both reported and closed-benign investigations. • Supports export of investigations to CSV and Excel for reporting and recordkeeping. • Covers investigations across Managed EDR, ITDR, and SIEM in a unified view. • New summary section displays key stats across investigations for quick situational awareness. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Wed, 12 Aug 2026 09:48:09 GMT Huntress adds executive summary reports, a remote access API, and a redesigned ITDR dashboard with rapid triage and login characterization. • New API endpoint for querying remote access connections — including ConnectWise ScreenConnect hosts — returns agent hostname, relay host, port, and first/last seen timestamps, enabling automated audits and response workflows (see the `Remote Access` section of the API docs). • New Rapid Identity Triage panel in the ITDR dashboard lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with the ability to export a timeline, revoke sessions, or disable the account. • New Failed Login Characterization view surfaces failed login attempts globally with specific classification by residential proxies, VPNs, and datacenters. • New Quick SIEM Search panel inside the ITDR dashboard exposes pre-populated queries against Huntress-ingested Entra Unified Audit Log data retained free for up to one year for all ITDR customers. • New redesigned ITDR dashboard available in Early Access via the ITDR icon in left-hand navigation, running alongside the existing dashboard. • New monthly executive summary report distills each organization's Threat Report into a non-technical snapshot, available via email link and under `Reports` in the Huntress portal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/monthly-executive-summary-reports-are-now-available-ga https://feedback.huntress.com/changelog/monthly-executive-summary-reports-are-now-available-ga Tue, 11 Aug 2026 15:34:42 GMT Huntress adds Monthly Executive Summary reports in GA, delivering a one-page stakeholder-friendly snapshot per organization each month. • Adds Monthly Executive Summary reports (GA) — a one-page, plain-language snapshot per organization highlighting active protection layers (EDR, ITDR, SIEM, etc.), signals investigated, and threats contained, aimed at non-technical stakeholders. • Reports are accessible under the 'Reports' section of the Huntress portal and delivered via email link to partners for easy forwarding to end customers. • Complements (does not replace) the existing full monthly/quarterly Threat Report; described as the first in a planned series of reporting improvements. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/remote-access-connections-api-is-now-available-ga https://feedback.huntress.com/changelog/remote-access-connections-api-is-now-available-ga Tue, 11 Aug 2026 15:34:42 GMT Huntress adds a GA API for querying remote access connections, including ConnectWise ScreenConnect hosts. • New Remote Access section in the Huntress API lets you programmatically query all remote access connections observed across your environment, returning agent hostname, relay host, port, and first/last seen timestamps — data previously confined to the portal's ScreenConnect Hosts view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/now-live-managed-itdr-dashboard-in-early-access https://feedback.huntress.com/changelog/now-live-managed-itdr-dashboard-in-early-access Sat, 08 Aug 2026 04:43:20 GMT Huntress launches redesigned Managed ITDR Dashboard in Early Access with rapid triage, login characterization, and SIEM search. • New Rapid Identity Triage panel lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with options to export a timeline, revoke sessions, or disable the account. • New Failed Login Characterization view shows failed login attempts globally with specific categorization by residential proxies, VPNs, and datacenters. • New Quick SIEM Search surface within the ITDR dashboard provides pre-populated queries against the full Entra Unified Audit Log, stored in Huntress SIEM at no cost for ITDR customers for up to one year. • Redesigned ITDR dashboard is accessible via the ITDR icon in the left-hand navigation; the existing dashboard remains available in parallel during Early Access. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog https://feedback.huntress.com/changelog Tue, 04 Aug 2026 11:08:38 GMT Huntress adds API-based IP rules for ITDR, trusted-device suppression for corporate logins, onboarding escalation pacing, and automatic usage-location inference. • New API endpoint lets you create IP address-based allow/block rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call. • Logins from corporate-managed devices no longer trigger location and VPN escalations by default for new accounts; existing partners can configure which device trust levels qualify — compliant, domain-joined, or registered — per account or per organization. • Managed ITDR now automatically paces escalation flow during a new tenant's first week to prevent onboarding noise spikes, on by default with no configuration required. • Microsoft Usage Location Inference is now live in Managed ITDR: Huntress infers an identity's home country from the tenant when Entra usage location is absent, eliminating 'Unexpected Country' and 'login without usage location' false escalations with no partner configuration needed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/huntress-api-now-supports-creating-ip-based-rules-for-itdr https://feedback.huntress.com/changelog/huntress-api-now-supports-creating-ip-based-rules-for-itdr Sat, 01 Aug 2026 18:29:42 GMT Huntress API gains an endpoint to create IP-based allow/block rules for Managed ITDR Unwanted Access. • New API endpoint lets you programmatically create IP address-based rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/trusted-device-suppression-live-in-managed-itdr https://feedback.huntress.com/changelog/trusted-device-suppression-live-in-managed-itdr Fri, 31 Jul 2026 15:56:11 GMT Huntress Managed ITDR adds Trusted Device Suppression to cut unexpected-login escalations by 40–50%. • New Trusted Device Suppression in Managed ITDR automatically suppresses location and VPN escalations for logins from corporate-managed devices, configurable per account or per organization. • Supports granular trust-level selection — compliant, domain-joined, or registered — giving partners precise control over which device states qualify for suppression. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/microsoft-usage-location-inference-live-in-managed-itdr https://feedback.huntress.com/changelog/microsoft-usage-location-inference-live-in-managed-itdr Tue, 28 Jul 2026 15:59:59 GMT Huntress Managed ITDR now infers Microsoft 365 home country from tenant data, eliminating false-positive Unexpected Country escalations. • Automatically infers a Microsoft 365 identity's home country from the tenant when no Entra usage location is set, requiring zero partner configuration. • Inferred country value serves as the Expected Country for Unexpected Country escalation evaluation, reducing false-positive alerts for users logging in from their home country. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/onboarding-escalation-throttle-now-live-in-managed-itdr https://feedback.huntress.com/changelog/onboarding-escalation-throttle-now-live-in-managed-itdr Tue, 28 Jul 2026 15:59:59 GMT Managed ITDR now throttles and prioritizes escalations during a new tenant's first week to reduce onboarding noise. • Adds onboarding escalation throttle to Managed ITDR, pacing and prioritizing alert flow during a new tenant's first week while behavioral baselines build. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/ip-based-expected-rules-now-available-in-managed-itdr https://feedback.huntress.com/changelog/ip-based-expected-rules-now-available-in-managed-itdr Fri, 17 Jul 2026 15:07:09 GMT Managed ITDR now supports IP- and CIDR-based Expected Unwanted Access rules to suppress known-good login escalations. • Adds IP-based Expected Unwanted Access rules in Managed ITDR, letting partners and customers suppress escalations for individual IPs or entire CIDR ranges without disabling other detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/see-the-details-of-every-huntress-investigation-with-the-new-partner-investigati https://feedback.huntress.com/changelog/see-the-details-of-every-huntress-investigation-with-the-new-partner-investigati Wed, 15 Jul 2026 01:22:47 GMT New Partner Investigations View (Early Access) exposes full Huntress SOC activity — including Closed-Benign outcomes — across EDR, ITDR, and SIEM. • Adds Partner Investigations View (Early Access) showing all completed SOC investigations — both Reported and Closed-Benign — across Managed EDR, ITDR, and SIEM, not just those that became incident reports. • Each investigation includes a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcome. • Automatically surfaces completed investigations from the last 90 days upon opt-in. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/ai-search-for-huntress-managed-siem-has-officially-gone-ga https://feedback.huntress.com/changelog/ai-search-for-huntress-managed-siem-has-officially-gone-ga Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed SIEM gains GA AI Search, enabling plain-English log queries with automatic ESQL translation. • Adds AI Search (GA) to Huntress Managed SIEM, allowing natural-language queries against SIEM logs without requiring ESQL or the Query Builder. • Enables on-demand ESQL translation: after a plain-English search, clicking the ESQL button reveals the generated ESQL query to accelerate analyst upskilling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/additional-security-controls-in-managed-ispm https://feedback.huntress.com/changelog/additional-security-controls-in-managed-ispm Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed ISPM adds SharePoint/OneDrive/Teams security controls and expands Continuous Enforcement to five new policies. • New SharePoint Online control: enforces idle session timeout for SharePoint and OneDrive. • New SharePoint Online control: blocks anonymous sharing links in SharePoint and OneDrive. • New SharePoint Online control: prevents users from self-creating SharePoint sites. • New SharePoint Online control: retains deleted user OneDrive content for at least 90 days. • New Microsoft Teams control: blocks communication with unmanaged Teams tenants. • New Microsoft Teams control: blocks organizational communication with accounts in trial Teams tenants. • Continuous Enforcement (drift detection + auto-remediation) now covers: restricting Azure Management portal access, blocking unused device types, restricting Guests from Microsoft Office clients, requiring frequent Admin sign-in, and requiring MFA for device registration/join. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/huntress-managed-edr-for-macos-now-ejects-deceptive-installers https://feedback.huntress.com/changelog/huntress-managed-edr-for-macos-now-ejects-deceptive-installers Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed EDR for macOS auto-ejects malicious DMGs before payload execution, blocking infostealers. • Automatically ejects deceptive/malicious DMG installers on macOS before their payloads can execute, blocking infostealer malware. • Delivers on-screen user notifications explaining why a DMG was ejected. • Triggers a Huntress SOC investigation on every DMG ejection event to confirm endpoint cleanliness. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/huntress-managed-edr-stops-macos-infostealers-before-they-run https://feedback.huntress.com/changelog/huntress-managed-edr-stops-macos-infostealers-before-they-run Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed EDR now blocks macOS infostealers at the Gatekeeper-override moment on macOS 14+. • New macOS infostealer prevention: detects and stops infostealer execution at the moment a user is socially engineered into overriding Apple's Gatekeeper, available on macOS 14 and later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/lock-down-microsoft-365-identities-today-as-managed-ispm-hits-general-availabili https://feedback.huntress.com/changelog/lock-down-microsoft-365-identities-today-as-managed-ispm-hits-general-availabili Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed ISPM hits GA, delivering continuous M365 identity hardening across Entra ID, Exchange, SharePoint, and Teams. • Adds Managed ISPM (Identity Security Posture Management) at General Availability, continuously hardening Microsoft 365 environments against misconfigurations and over-permissioned accounts. • New Huntress-managed security controls span Microsoft Entra ID, Exchange Online, SharePoint, and Teams — covering the most commonly abused identity attack surfaces. • Adds Conditional Access policy management with recommended templates, giving practitioners a curated baseline for CA enforcement. • New Learning Mode delivers pre-deployment impact analysis for Huntress-managed Conditional Access policies before any enforcement is applied. • Managed Deployment enables a continuously updated identity framework that automatically keeps all managed organizations aligned with the latest security updates. • Drift Detection triggers within minutes of configuration change, with Continuous Enforcement to maintain alignment with security best practices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/osint-2-simulation-is-in-ga https://feedback.huntress.com/changelog/osint-2-simulation-is-in-ga Mon, 13 Jul 2026 10:06:27 GMT Huntress adds OSINT 2 Simulation in GA, teaching learners the risks of oversharing online. • New OSINT 2 Simulation (fifth simulation) now generally available, covering risks of oversharing personal information online. • Accompanies July's managed learning assignment for structured security awareness training. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/sat-custom-html-phishing-is-ga https://feedback.huntress.com/changelog/sat-custom-html-phishing-is-ga Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed SAT now offers GA Custom HTML Phishing Scenarios for targeted spearphishing simulations. • Adds General Availability of Custom HTML Scenarios in Managed SAT, enabling fully customized spearphishing simulations that can impersonate trusted vendors or mimic specific employees' names and communication styles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/siem-okta-integration-is-now-ga https://feedback.huntress.com/changelog/siem-okta-integration-is-now-ga Mon, 13 Jul 2026 10:06:27 GMT Huntress Managed SIEM adds Okta as a GA log source with SOC-built detections for identity-based attacks. • Adds Okta as a supported identity and authentication log source in Huntress Managed SIEM (generally available). • New SOC-built detections for Okta covering credential attacks, privilege escalation, MFA bypass and fatigue, account takeover, and federated identity manipulation. • Extends SIEM visibility to the identity layer for organizations using Okta as their IdP or SSO provider. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/the-microsoft-defender-for-endpoint-mde-integration-now-supports-gcc-high-tenant https://feedback.huntress.com/changelog/the-microsoft-defender-for-endpoint-mde-integration-now-supports-gcc-high-tenant Mon, 13 Jul 2026 10:06:27 GMT Huntress MDE integration now supports GCC High tenants, routing API traffic to .us endpoints automatically. • Supports onboarding Microsoft Defender for Endpoint (MDE) tenants in GCC High environments, with login, Graph, and MDE API traffic automatically routed to GCC High .us endpoints. • Enables GCC High tenants already mapped in ITDR to be onboarded into MDE using the same tenant. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/siem-okta-integration-is-now-ga https://feedback.huntress.com/changelog/siem-okta-integration-is-now-ga Wed, 24 Jun 2026 18:30:37 GMT Huntress Managed SIEM GA support for Okta logs with built-in detections. • `Huntress Managed SIEM` now supports `Okta` as an identity and authentication log source • `Huntress SOC` includes detections for `credential attacks`, `privilege escalation`, `MFA bypass`, `account takeover`, and `federated identity manipulation` targeting `Okta` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/ai-search-for-huntress-managed-siem-has-officially-gone-ga https://feedback.huntress.com/changelog/ai-search-for-huntress-managed-siem-has-officially-gone-ga Wed, 24 Jun 2026 18:28:45 GMT Huntress Managed SIEM introduces GA AI Search for plain English log queries and ESQL translation • Adds 'AI Search' capability to Huntress Managed SIEM allowing users to search logs using plain English instead of only ESL or the Query Builder • Adds an 'ESQL button' after running a plain-English AI Search that displays the translated ESQL query to help users learn the syntax Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/additional-security-controls-in-managed-ispm https://feedback.huntress.com/changelog/additional-security-controls-in-managed-ispm Wed, 24 Jun 2026 14:36:45 GMT Managed ISPM adds security controls for SharePoint/Teams and continuous enforcement for Azure/Microsoft identities. • Adds idle session timeout and anonymous sharing block for SharePoint and OneDrive in Managed ISPM • Blocks user creation of SharePoint sites in Managed ISPM • Retains deleted user OneDrive content for at least 90 days • Blocks communication with unmanaged Teams tenants in Managed ISPM • Ensures organization cannot communicate with accounts in trial Teams tenants • Adds continuous enforcement with drift detection and auto-remediation for Azure Management portal access policy • Adds continuous enforcement with drift detection and auto-remediation for unused device types blocking policy • Adds continuous enforcement with drift detection and auto-remediation for guest Office client restriction policy • Adds continuous enforcement with drift detection and auto-remediation for frequent admin sign-in policy • Adds continuous enforcement with drift detection and auto-remediation for MFA on device registration/join policy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/the-redesigned-managed-antivirus-dashboard-is-now-ga https://feedback.huntress.com/changelog/the-redesigned-managed-antivirus-dashboard-is-now-ga Wed, 17 Jun 2026 15:30:05 GMT Managed Antivirus Dashboard GA brings Microsoft Defender activity tracking with new AV Events view and top org/agent summaries. • Adds a `Recently installed agents` tab to the Managed Antivirus Dashboard for verifying new endpoint configurations • Introduces a dedicated 'AV Events' view rolling up severities with quarantined and removed totals • Adds 'Top organizations with events' and 'Top agents with events' panels to identify noisy sources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/automate-agent-management-with-the-agents-write-api-ga https://feedback.huntress.com/changelog/automate-agent-management-with-the-agents-write-api-ga Tue, 16 Jun 2026 20:20:24 GMT Huntress GA release introduces Agents Write API for programmatic agent management • Adds `Agents Write API` (GA) enabling partners to programmatically uninstall agents, update tags, toggle tamper protection, and isolate or release hosts via automation tools Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/managed-ispm-enhanced-security-controls https://feedback.huntress.com/changelog/managed-ispm-enhanced-security-controls Fri, 12 Jun 2026 14:46:25 GMT Managed ISPM adds Exchange Online, Teams, and SharePoint/OneDrive security controls. • Adds `Exchange Online` control to ensure the Common Attachment types filter is enabled • Adds `Exchange Online` control to ensure notifications for internal users sending malware is set to Enabled • Adds `Exchange Online` control to ensure Exchange Online spam policies are set to notify administrators • Adds `Exchange Online` control to ensure that SPF records are published for all Exchange domains • Adds `Microsoft Teams` control to disable communication with unmanaged Teams • Adds `SharePoint Online` control to ensure Guest resharing of SharePoint and OneDrive files is set to Disabled • Adds `SharePoint Online` control to ensure Legacy authentication protocols are blocked for SharePoint and OneDrive Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress https://feedback.huntress.com/changelog/learning-mode-for-conditional-access https://feedback.huntress.com/changelog/learning-mode-for-conditional-access Wed, 10 Jun 2026 08:27:14 GMT ISPM Learning Mode for Conditional Access allows 14-day impact monitoring before policy deployment. • Adds ISPM Learning Mode to monitor Conditional Access policy impact on individual identities over a 14-day period. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/huntress