Team: Huntress Managed Endpoint Detection and Response (EDR)
Summary: This article explains each section of the Executive Summary page and where its numbers come from.
In this Article
Overview
Incidents Resolved
Incident Comparison by Product
Incident Trend
SOC Performance
Cybersecurity Coverage
SOC Analysis Breakdown
Breakdown by Severity
Top Investigated Organizations
Related Articles
Overview
The Executive Summary answers one question: what did Huntress accomplish for this account during the reporting period? It's written so that a business owner can read it without knowing Huntress product terms, which makes it the page most often shared with clients and leadership.
The Executive Summary covers the whole account or organization across all of its Huntress products. The product pages later in the report show activity one product at a time and count some activity differently, so their numbers don't always add up to the Executive Summary totals.
Incidents Resolved
The top of the page shows how many incidents the Huntress Security Operations Center (SOC) resolved during the period. For example: This period we resolved 3 Incidents.
The count includes Critical and High incidents resolved during the period, including incidents opened in an earlier period. Low-severity incidents aren't included, so the Security Insights Report can show fewer incidents than the legacy Threat Report for the same month.
When there are incidents, View this report's incident log opens the Incident Log, which lists each one. If there were no incidents, the page says Your account had no targeted attacks for this time frame. Huntress still monitored your environment during that time, and the SOC Analysis Breakdown shows that work.
Incident Comparison by Product
This bar chart splits the period's incidents by the product that detected them, such as Managed EDR, Huntress Managed Identity Threat Detection and Response (ITDR), or Huntress Managed Security Information and Event Management (SIEM). Use it to see where activity started.
Incident Trend
This line chart shows incidents resolved in each of the 6 most recent months, so you can see whether activity is steady, improving, or spiking.
All 6 month labels always appear. Months that ended before the account or organization was created have no data point, so a first report can show a single point. If trend data isn't available yet, the chart says Chart will populate once trend data is available.
SOC Performance
SOC Performance translates the work the Huntress SOC did into time your team didn't have to spend. It appears on account-level reports only, and only when Huntress saved your team time during the period.
The section leads with Hours Saved, an estimate of the analyst work Huntress performed for you. Up to two cards follow, chosen in this order of priority:
- Incidents Sent with SOC Remediations: incident reports Huntress sent during the period and the remediations Huntress completed on them
- SOC Investigations: investigations the SOC opened during the period
- Posture Activity Actions: security controls that Huntress Managed Identity Security Posture Management (ISPM) made compliant or corrected, and conditional access policies that completed Learning Mode
- Signals Generated: signals Huntress generated from your events for review
For the full calculation and a worked example, see How Are Metrics and Hours Saved Calculated?
Cybersecurity Coverage
This section shows each Huntress product active on the account and how much of your environment it covers. Each product reports coverage in its own unit:
| Product | Coverage shown |
|---|---|
| Managed EDR | Endpoints |
| Managed ITDR | Billable identities |
| Managed ISPM | Identities |
| Managed SIEM | Log sources |
| Huntress Managed Security Awareness Training (SAT) | Learners |
Managed ITDR coverage counts billable identities only. The Managed ITDR page shows both total and billable identities.
Each product also shows its status:
- Active: The product is in use.
- Trial (N days left): The account is trialing the product, with that many days remaining.
- Trial: The account is trialing the product.
SOC Analysis Breakdown
This section shows how much activity Huntress filtered to find the incidents that mattered:
- Events Across All Your Environments: Endpoint and identity events Huntress analyzed, such as process events, autoruns, antivirus detections, monitored files, and Microsoft 365 and Google Workspace events. Managed SIEM log events aren't included here. They appear on the Managed SIEM page.
- Filtered for Suspicious Activity: Potential threats Huntress surfaced from those events for review.
- Investigations: Potential threats the Huntress SOC investigated.
- Incidents Resolved: Investigations confirmed as incidents and resolved during the period.
Most events never become investigations, and most investigations never become incidents. A low incident count means your environment was monitored and nothing needed action.
Breakdown by Severity
This section shows the period's incidents by severity, either Critical or High. For what each severity means, see How Are Metrics and Hours Saved Calculated?
Top Investigated Organizations
On account-level reports, this section lists the organizations with the most investigations during the period and how many investigations each had. It doesn't appear when there were no investigations.
The list reflects the organizations in the account at the end of the reporting period. If an organization was moved to another account or deleted during the period, it isn't listed.
Related Articles
These articles explain the rest of the report: