PSA/RMM & Huntress Name Matching

Team: Huntress EDR
Product: PSA, RMM
Environment: Huntress integration
Summary: Matching the name of organizations between the Huntress portal and any PSA, RMM or other ticket tool is critical for proper integration. 

NOTE: This doesn't apply for e-mail only reporting integrations. We will send the e-mail incident with the Organization Name exactly as it appears in Huntress to the specified address(es). 

When reporting incidents to a multi-tenant PSA or ticketing system, Huntress needs to be able to match up the "Organization Name" in Huntress to the name of your client or site name. Since all incident reports sent by Huntress are reviewed by a member of our Threat Operations team, we can search your PSA for the appropriate client based on the Organization Name you have Huntress (if you have set up an integration into your ticketing system).

For ConnectWise Manage customers, we offer the ability to map Huntress Organization names to ConnectWise Manage names under the Integrations page. See Reporting Incidents to CW Manage (name matching) for more information.

You can view all of your Organization Names in Huntress by selecting the Organizations tab at the top menu bar of our portal:

NOTE: For many of our RMM deployments, Organization Names are generated in Huntress by the RMM deployment script. Please review the deployment article related to your RMM to find out how Organization Names create in your environment. 

When a Threat Researcher attempts to report an incident under your account, a search is conducted within your PSA using the Organization Name in Huntress. If there is a matching name, the incident report is easily filed under the correct client or site name in your system. 

This means that it is crucial that the Organization Names in Huntress are exact matches (or very similar) and unique to the names in your PSA to ensure proper reporting. 

For this example, let's say an organization in Huntress named  Weyland-Yutani Corporation had a malware outbreak, and our Researcher wanted to file an incident with our partner. When attempting to report the incident, we search the PSA, and in this case, we found an exact match:

In this case, our Researcher would have no trouble matching the incident with a client in the PSA and can submit a ticket without delay. Let's try an example where the Organization Name in Huntress is simply " Weyland-Yutani" and we conduct the same search:

As you can see, there are multiple similar company names in the PSA; therefore, we are unable to make a match based on the shortened version of the name. This would require us to reach out to the partner to locate the correct end customer or site name for the incident--possibly causing a delay in reporting.

Let's look at one final example that we commonly see. We've seen partners have full business names in their PSA, but abbreviations in their RMM and, therefore, in Huntress as well. In this example, the Organization Name in Huntress was WY Corp:

Again, we are unable to make a match based on the abbreviated name, requiring us to reach out to the partner and possibly cause delays in reporting. 

If you have a situation where many of your names may not match, please reach out to support@huntress.io, and we can discuss the best way to sync up and ensure we can report incidents efficiently.