What are Escalations?

Currently Unwanted Access escalations will come via the integration Email (Escalations) if no PSA integration is present, or via PSA only if the PSA integration is present. It is not possible to get Unwanted Access escalations to PSA and email.

What is a Huntress Escalation?

An Escalation is used to notify Huntress account administrators that a situation requires their attention. Below are some common use cases:

• The Huntress security platform is unable to send incident reports to your PSA system and we need you to reconfigure the integration.
• SOC suspects that an application being flagged as malicious is a false positive and we want to get your authorization to allow-list the application moving forward.
• A potential threat flagged by Managed Antivirus requires additional information (file path details, etc.) in order for Huntress to provide actionable assisted remediation steps.
• A login event occurred from an unexpected country or VPN and Huntress would like partner feedback on whether that event should be expected or unauthorized.

Every Escalation will include a question for the account admin and an associated workflow to respond or resolve the Escalation. Escalations are not incident reports, however they do have severities (low, high, critical) associated with them that dictate an expected response time.  If no response is received, account administrators will be re-notified.

Unexpected login escalations are resolved when a rule is created for the associated identity, organization, or account.

Responding to an Escalation?

NOTE: Only Account-Level Users and Organization-Level Admins can access Escalations. Organization Admins are unable to respond to an Escalation. More on user permissions here.

Who can respond?

Account administrators are ultimately responsible for responding to Escalations. All accounts users can view Escalations by navigating to the page at the top of the Dashboard , but only admins can respond within the Portal. 

From the Escalations Dashboard users can click into the details of an Escalation to see what happened and respond by working through the steps to resolve.

How do I manage who gets notified? 

Partners can manage Escalation notification settings within Integration Settings. By default all account admins will receive Escalation notifications. Admins can edit the notified recipients, but at least 1 account admin email contact is required.

In the future, Partners will be able to configure PSAs to receive Escalation notifications for products other than ITDR Unwanted Access.

Escalation severities and expected response times

Huntress wants to provide the best possible service to our partners. Not responding to an Escalation event can degrade that level of service. Our goal is never to spam partners with notifications, but to only use Escalations when absolutely necessary. Let's walk through a couple scenarios:

• Scenario 1: A critical malware incident report failed to make it to your company's PSA, thus the event went unnoticed by your team. Huntress will send an Escalation with the same severity as the incident report to bring your attention to the event.
• Scenario 2: Multiple hosts have had the Microsoft Defender Real-time Protection engine disabled for an extended period of time across your account. We would escalate this as a high severity Escalation because it is a preventive security measure that requires action but not immediate action.

Response Time Expectations by Escalation Severity

Critical = Overdue after 12 hrs

High = Overdue after 48 hrs

Low = Overdue after 7 days

Why not reach out via Support?

Huntress Support Staff have the ability to manually escalate situations to account administrators via email and sometimes over the phone. However, these escalations are human-powered and the process can be inconsistent and sometimes cumbersome, requiring multiple follow-ups by both Huntress and the partner. By providing a standardized and automated process for escalated inquiries, we can reduce the back and forth and give our partner's another one-click solution to address complex situations. Some Escalations may require more than one-click from partners (i.e. fixing a misconfigured PSA), but Huntress will strive to automate all possible remediation actions based on your response.

Types of Escalations

Escalations fall into different categories: Integrations, System Health, Potential Threats, etc. The below table describes the supported Escalation use cases. Huntress will continue to add coverage for new use cases.