Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Microsoft Defender Antivirus, Shodan
Environment: Windows, macOS, Linux
Summary: This article explains the five Managed EDR pages in the Security Insights Report: endpoint activity, Detection Capabilities, Managed Antivirus, Firewall Status Monitoring, and External Recon.
In this Article
Overview
Endpoint Detection and Response through Managed EDR
Detection Capabilities
Managed Antivirus
Firewall Status Monitoring
External Recon
Related Articles
Overview
Accounts and organizations with Huntress Managed Endpoint Detection and Response (EDR) get five pages in the Security Insights Report. Together they show how many endpoints Huntress protects, what the Huntress Security Operations Center (SOC) found and did, and how well your endpoints are configured.
Endpoint Detection and Response through Managed EDR
This page shows how many endpoints Huntress protects and the security work performed across them. It has these sections:
- Protected Endpoints: Endpoints with the Huntress Agent installed and reporting, and the number of New Endpoints Installed during the period. Select View all agents to see them in Huntress.
- Endpoint Breakdown: Protected endpoints by operating system: Windows, macOS, and Linux.
- Organization Breakdown: On account-level reports, organizations with and without active agents. Organizations without active agents have no endpoints reporting to Huntress.
- Endpoint Security Activity: How endpoint events became investigations and incidents. It shows the events Huntress analyzed, the Managed EDR investigations the SOC completed, and the Critical and High Managed EDR incidents resolved during the period.
- Top Investigated Organizations (EDR): On account-level reports, the organizations with the most Managed EDR investigations.
- Threat Breakdown: Managed EDR incidents by attack vector (see the next section).
- Actions Taken: Remediations Huntress completed for Managed EDR incidents, split into Containment Remediations and Assisted Remediations. For what each type means, see How Are Metrics and Hours Saved Calculated?
Threat Breakdown
The Threat Breakdown groups the period's Managed EDR incidents by attack vector. These five rows always appear, even at zero:
- Process Insights
- Managed Antivirus
- Persistent Footholds
- AI Misuse
- Ransomware Canaries
Additional rows appear only when they have incidents. These include Monitored Files, Defender for Endpoint, Favicon Detections, Behavioral Detections, and App Control.
Some incidents involve more than one attack vector, so the rows can add up to more than the incident count. An incident that doesn't match any listed attack vector, such as a vulnerability notification, isn't shown in any row. The page names the attack vector with the most incidents as your most targeted attack vector.
Detection Capabilities
Three cards explain how Managed EDR finds threats on your endpoints. This table shows what each capability does and what its card counts:
| Capability | What it does | What the card shows |
|---|---|---|
| Ransomware Canaries | Places small, lightweight files on protected endpoints. If they're modified, Huntress investigates. | Canary Files placed, Protected User Profiles, and ransomware incidents |
| Persistent Footholds | Finds mechanisms attackers use to keep long-term access, such as programs that start automatically (autoruns) | Autorun events analyzed, autorun investigations, and autorun incidents |
| Process Insights | Detects hidden processes attackers use before causing disruption | Process events analyzed, process investigations, and process incidents |
Zero incidents on a card means the capability was working and found nothing to act on. Zero canary files or protected user profiles means Ransomware Canaries aren't deployed, so check your Ransomware Canaries settings. Protected user profiles can be lower than your endpoint count in mixed Windows and macOS environments, because canaries are placed in Windows user profile folders.
Managed Antivirus
This page shows how Huntress manages Microsoft Defender Antivirus across your endpoints. It has these sections:
- Hosts Running Defender: Endpoints running Defender. Select Antivirus Dashboard to open it.
- Defender Event Summary: Defender events, investigations, and incidents during the period.
- Defender Host System Status: How many endpoints have real-time protection enabled, signatures up to date, Tamper Protection disabled, and a scan within the past week. To get an alert when Defender real-time protection has been off for more than 2 hours on an online host, set up a configurable alert to your email or professional services automation (PSA) tool.
- Defender Exclusions: Exclusions that stop Defender from scanning parts of an endpoint, marked Risky or Normal. Broad exclusions reduce antivirus effectiveness. Huntress analyzes risky exclusions and can remove them automatically or surface them for your review. Select View Defender Exclusions to review them.
Firewall Status Monitoring
This page shows Windows Firewall status across eligible endpoints, and conflicts between local and domain Group Policy Object (GPO) firewall policies. The report counts endpoints in these groups:
| Status | Meaning |
|---|---|
| Firewall enabled | Windows Firewall is on. |
| Firewall disabled | Windows Firewall is off. |
| Policy conflict | The local firewall policy conflicts with the GPO. These endpoints are also counted as enabled or disabled. |
A policy conflict is a configuration finding, not an incident. When endpoints need attention, Engineering Insights links to the Disabled Firewall Agents page. To see an endpoint's firewall policy, open its Agent overview page.
External Recon
This page shows what your network exposes to the internet, which is where attackers often look first. It has these sections:
- External IP Addresses and Externally Available Ports: Found using Shodan, which Huntress checks every few days.
- Analyzed Services: Services running on those ports, marked Risky or Normal. Huntress marks services as risky when attackers are more likely to use them. Every service exposed to the internet adds some risk.
- View External Recon: Opens the details and next steps in Huntress.
If Huntress didn't find any exposed IP addresses or ports, the page shows No Open Ports or Addresses Detected.
Related Articles
These articles explain each capability in more detail: