Skip to main content

Huntress Managed ESPM (Early Access) Readiness, Requirements, and FAQ

Nick
  • Updated

TEAM: Huntress Managed Endpoint Detection and Response (EDR), SIEM
PRODUCT: Huntress ESPM 
ENVIRONMENT: Windows Only
SUMMARY: How to prepare and enroll for Early Access into ESPM (Endpoint Security Posture Management)

 

Requirements

Onboarding and Early Access Frequently Asked Questions (FAQ)

ESPM Functionality FAQ

App Blocking FAQ

How to Enable or Disable ESPM for an Organization

General FAQ

 

 

Requirements

  • Supported Operating Systems
    • Windows - Professional, Enterprise, Education, and Education/SE. - Home is currently not supported.
      • Windows 10 patch 1903+ 32-bit and 64-bit
      • Windows 11 32-bit and 64-bit
      • Server 2022+
  • [Coming soon!] Microsoft Defender for Endpoint for Vulnerability Visibility. 
  • Huntress EDR version 0.7.75 or higher

Due to the nature of how our ESPM product functions, other security vendors may falsely flag the Huntress Agent as malicious once ESPM is deployed. Before enrolling in ESPM, please configure your third-party security tools to allow Huntress. Following the Allow List Huntress in Third Party Software guide beforehand will prevent potential software conflicts. 

 

Onboarding and Early Access FAQ

  • How to enroll in ESPM?
    • Click on the ESPM icon on the far left on your Huntress dashboard.
  • What are the ESPM capabilities and features being launched with EA?
    • Application Control - in development
    • Vulnerability Visibility (via Microsoft Defender for Endpoint)
    • Dashboards and Reporting
    • App blocking is not included in EA, ESPM is read-only currently!
  • Are any other Huntress products required to join ESPM EA?
    • As of August 4th, there are no other products required.
  • Is EDR required to join the ESPM EA?
    • No, but it's highly recommended to see the full benefit However, Managed EDR + Managed SIEM customers are great candidates to see the benefits of how ESPM can reduce the attack surface threat actors commonly abuse in order to establish and maintain persistence on an endpoint to move laterally through a network in order to achieve their goals. 
  • How long will the Huntress portal be in learning mode/"Pre-Deployment Verification" before going active?
    • Typically this takes about 24 hours. If there hasn't been movement in 24 hours, the ticket likely needs to be escalated to Support Internal.

ESPM Functionality FAQ

  • How will Application Control work?
    • At EA, Application Control will focus on two capabilities:
      • auditing applications on endpoints with the intent to configure policies to allow known-good applications.
      • blocking unwanted RMM tools
    • In the future, policies will be configurable at the account, organization, and host levels.
  • Will I be able to apply App Control policies at different levels?
    • Yes, as we progress through the EA period and into GA, policies will be available at the account, organization, and endpoint levels.
  • What does the "New" tag mean in the RMM Guard dashboard?
    • It means the tool is new to that MSP's environment, typically triggered when a new customer is onboarded and brings a remote tool that hadn't been seen before. The tag clears once someone approves or rejects the application.
  • How does ESPM handle application updates?
    • Microsoft's WDAC supports an inheritance model where updates to previously approved applications can be automatically approved without partner intervention — essentially, if QuickBooks was approved, a QuickBooks update inherits that approval. For partners running deny-by-default, anything not approved or associated with an approved parent application will be blocked.
  • What is Huntress ‘managing’ for partners/customers?
    • ESPM uses threat intel and adversary activity insights to inform App Control (i.e. managing WDAC). ESPM also provides notifications and guidance when new apps or updates are discovered to allow partners to determine how to react.
  • What is the role of the SOC in ESPM?
    • Managed ESPM is a proactive solution so it doesn’t generate incidents, but it provides context to SOC investigations when used with Managed EDR, ITDR, and SIEM. Additionally, Huntress’ threat experts and SOC is the intelligence engine behind ESPM. EDR incidents tell us which attack paths and applications are most abused, and where ESPM can improve posture. Managed ESPM operationalizes threat intel and attacker tradecraft to help reduce the endpoint attack surface.

App Blocking FAQ

Note that application blocking is not available yet! Learning mode only for this phase of EA.

  • How to unblock an app or undo an app rejection?
    • Click the app in RMM Guard and a window should slide out of the right side with the "Unreject" option"
  • Where will ESPM blocked events and alerts surface in the Huntress Portal?
    • Blocked events are currently visible in the dashboard, and in the future will appear in one of the existing Huntress notification categories (incident report, escalation, platform action, etc -> TBD the exact route).
  • Does blocking an app prevent installation or execution?
    • It depends. For tools like ScreenConnect, which don't require a traditional installer, the executable is blocked even if it's not actually "installed" on the machine.
  • What does the end user see when an app is blocked?
    • Windows will display a generic "App Control for Business" block message. We will likely change this in the future to have a Huntress or Partner-specific message to help the user understand who to contact.
  • Does blocking an app remove the app from the machine?
    • No, blocking only prevents the execution, it can't uninstall the app (possibly a future improvement).
  • Does removing Huntress revert WDAC policy?
    • Yes! The CIP file is queued for deletion, and the CI Policies are refreshed.
  • Why is _____ driver or ____ device getting blocked when ESPM is enabled, despite the driver/device not being on the block list?
    • There was a known issue with Microsoft's WDAC where poorly signed, revoked, or non-WHQL drivers can be rejected by WDAC even without a specific policy and even in audit mode. We think we fixed this in early August 2026 (by removing the "Require WHQL" option from policy we deploy), so if this is still occurring post in Support Internal!
  • Can ESPM block software by version (not just hash/cert)?
    • Yes in some cases. 

 

How to Enable and Disable ESPM for an Organization

Enablement

  1. Log in to the Huntress Dashboard
  2. Select the ESPM button from the Icon bar on the left side of the screen. 
  3. Select Settings
    1. By Default, Account Settings will be set to disabled. 
  4. To enable an orginization, select the + Add Organization Overide button. Override functionality allows you to override the Account-level settings to enable/disable ESPM for specific organizations without impacting the entire account.
  5. In the Organization drop-down menu, select the organization for which you would like it enabled
  6. Under Settings, select enabled
  7. Select the Save button.

Disablement

  1. Log in to the Huntress Dashboard
  2. Select the ESPM button from the Icon bar on the left side of the screen. 
  3. Select Settings
    1. By Default, Account Settings will be set to disabled. 
  4. To Disable an orginization, select the "Remove Override" button located next to the organization.
  5. Confirm in the pop-up window that you would like to remove the Override to disable ESPM for a specific organization. 

General FAQ

  • When will ESPM be Generally Available?
    • The specific date is to be determined. 
  • Is this a new product or an add-on?
    • ESPM is a net-new product.
  • Is Linux or Mac Supported?
    • No. Linux and Mac are currently not supported. We want to focus on our Windows launch before pursuing other operating systems. 
  • How should I report any bugs to the ESPM team?
    • Reach out to your Account Manager with any bugs you may encounter. 
  • How does an EA participant provide feedback or request a new feature on their Managed ESPM experience?
  • I am not seeing any ESPM data. Is there an issue?
    •  ESPM data does currently require a restart to see the RMM services.  We will not be able to establish the initial connection until either the Endpoint/Host/Agent or the RMM is restarted. 
      • The First thing to check is that you meet the above minimum requirements.
      • The second thing to do is to attempt to either restart the Endpoint or the RMMs services. 
      • It can take up to 24 hours, but the process can be sped up by the bullet point listed above. 
  • What is Learning Mode? 
    • Learning mode, AKA Audit mode. Learning mode is currently the only mode available during this stage of EA. We are using Learning mode to audit and collect specific information related to Apps and RMM's. We monitor running applications across your endpoints and build a clear picture of normal activity for your environment. Once that baseline is established and unexpected activity has been reduced, enforcement can then be introduced with greater confidence. This helps ensure decisions are informed by real-world usage before anything is blocked. 
      • Enforcement Mode - coming soon. 
  • Is there a separate Huntress-managed block policy beyond what partners configure?
    • This is planned for future improvements.
  • Will ESPM support compliance framework mapping (PCI, HIPAA, Essential 8)?
    • This is planned for the future. The longer-term goal is for the Huntress console to serve as a single pane of glass for demonstrating compliance posture. Third-party validation (similar to what DefCert did for CMMC) is on the post-GA roadmap.
  • Will ESPM have control over removable media?
    • Not at EA. It is being discussed as a future feature.

Related articles