Huntress Sensitive Data Mode

Overview

When managing cybersecurity in a regulated environment, certain capabilities are required for handling files containing sensitive data during threat detections. For example, retrieving files for malware investigations could unwittingly expose sensitive information.

Recognizing this challenge, Huntress built our new Sensitive Data Mode—a configuration designed to strike the perfect balance between effective threat investigation and compliance requirements.

In this Article

Huntress' Sensitive Data Mode Explained
Enabling and Disabling Sensitive Data Mode
Blocked Extensions List
Mass Outbound Spam Detection

Huntress' Sensitive Data Mode Explained

Here is what the new mode delivers to help you support regulated clients:

1. Blocking SOC Access to Potential CUI Data 

Specific Impact on Endpoint Investigations

Huntress now enables organizations to block our Security Operations Center (SOC) from accessing files and data likely to contain CUI (Controlled Unclassified Information) during investigations. Huntress blocks high-risk file types (e.g. documents, spreadsheets, CAD files) from being retrieved during investigations. This measure reduces risk and protects compliance objectives.
 

Specific Impact on Identity Investigations

Huntress Managed Identity Threat Detection and Response (ITDR) has the ability to detect mass outbound emails from a user. In order to confirm a business email compromise (BEC), we alert when a user has sent email at a frequency which is abnormally high. In normal operation, our SOC has the ability to view the contents of those emails to verify they are malicious before taking measures to contain the threat. When Sensitive Data Mode is enabled for an organization, our SOC will be blocked from viewing the contents of these emails utilizing the Mail.ReadWrite permission for our app.

2. Effective Threat Detection for Analysts 

Huntress analysts can still retrieve and analyze executable files, scripts, or other non-sensitive file types often associated with malicious activity. This means we can continue to deliver critical incident reports at 99% accuracy without compromising compliance.

Enabling and Disabling Sensitive Data Mode

Enabling Sensitive Data Mode

Sensitive Data Mode must be enabled per-organization. To enable Sensitive Data Mode, simply open a support request for it to be enabled and include the organization(s) you need it enabled for. If you or your client’s environments require additional extensions added to the list of Blocked Extensions, please include this information in your request. 

Disabling Sensitive Data Mode

Sensitive Data Mode can not be disabled by our SOC nor our Support Team. If you wish to disable Sensitive Data Mode, please open a support ticket with the request. This ticket will be escalated to our Leadership team for review.

Blocked Extensions List

Below you will find a list of all extensions blocked by Sensitive Data Mode. 

Mass Outbound Spam Detection

We are unable to detect mass outbound spam emails from a user when either Sensitive Data Mode is enabled for the organization or the tenant resides in a GCC High environment.

The ITDR Outbound Spam feature requires Mail.ReadWrite permission.

Sensitive Data Mode prevents the Huntress portal from executing any mail-read operations, even though the Mail.ReadWrite permission still exists in the ITDR app. 

For GCC High environments, we do not have any permissions to view email contents or metadata beyond what is included in the audit log data.