Team: Huntress Email Security (ES)
Product: Huntress Email Security
Environment: Microsoft 365, Google Workspace
Summary: This article provides an overview of Huntress Email Security, including its core capabilities, requirements, and early access limitations.

Overview

Huntress Email Security protects Microsoft 365 and Google Workspace mailboxes from email-borne attacks, phishing, business email compromise (BEC), malware, credential harvesting, and malicious QR codes. Delivered through a partnership with Sublime Security, their detection engine powers the analysis and remediation that are surfaced to you directly within the Huntress platform.

Huntress Email Security connects to your tenant through an API integration. There is no MX record change, no mail routing change, and no agent to deploy.

Requirements

A Microsoft 365 or Google Workspace tenant.
Global Administrator (Microsoft 365) or Super Admin (Google Workspace) to authorize the integration.
A Huntress account with ES entitlement enabled.

What ES Does

Capability	What it means for you
Inbound threat detection	Analyzes messages arriving from outside your organization for phishing, BEC, malware, and malicious links or attachments.
Post-delivery remediation	Pulls a malicious message out of the inbox after delivery, including messages that were benign at delivery time and later weaponized.
Historical ingestion	Analyzes your recent mail history during onboarding to show what ES would have caught and to establish a baseline. See Historical Ingestion, Passive Mode, and Enforcement.
User-reported phishing (coming soon!)	Routes employee phishing reports into ES for automatic analysis and grouping. See Configuring the Abuse Mailbox.
Attack grouping	Clusters related messages so remediating one report remediates the whole campaign across every affected mailbox.

How It Works

Connect: Authorize the ES integration against your Microsoft 365 or Google Workspace tenant from the Huntress platform.
Ingest: ES begins reading mail through the provider API. Historical ingestion runs automatically to backfill and establish a baseline.
Learn: ES runs in a brief Passive Mode, analyzing and flagging without taking remediation actions, so you can tune the system before anything is touched.
Enforce: Once enabled, high-confidence detections are remediated automatically. The message is removed from the inbox and held in a location where it can be released if needed.
Review: Triage flagged messages, user reports, and remediation history from the Email Security section of the Huntress platform.

What Huntress ES Is Not

A Secure Email Gateway: ES does not sit inline in front of your mail flow by default and does not require an MX record change.
A replacement for Microsoft Defender or Google's native filtering: ES layers on top of your provider's built-in protection to catch what gets through.
A spam filter: ES focuses on targeted attacks. Bulk and graymail handling is a secondary function.

Early Access Scope and Limitations

During Early Access:

No SOC Escalations or Incident Reports are generated for ES. All ES activity is self-contained within the Email Security section of the Huntress Dashboard. You will not receive Huntress Incident Reports, and the Huntress SOC does not triage ES detections on your behalf during EA.
ES findings do not appear in existing Huntress reporting, alerting, or integrations.
Feature availability and dashboard layout may change without notice.

What is Huntress Email Security (ES)?

In this Article