Team: Huntress Managed Identity Threat Detection and Response (ITDR)
Product: Microsoft 365, Google Workspace
Summary: This article explains the two Managed ITDR pages in the Security Insights Report: identity security activity and Identity Capabilities.
In this Article
Overview
Identity Protection through Managed ITDR
Identity Capabilities
Related Articles
Overview
Accounts and organizations with Huntress Managed Identity Threat Detection and Response (ITDR) get two pages in the Security Insights Report. They show how many identities Huntress protects, what the Huntress Security Operations Center (SOC) found and did, and how your identity protections are configured.
Identity Protection through Managed ITDR
This page shows how many identities Huntress protects and the security work performed across them. It has these sections:
- Total Identities: Identities that Managed ITDR monitors. Select View all identities to see them in Huntress.
- Mapped Organizations: On account-level reports, organizations with Managed ITDR connected and organizations without it.
- Billable Breakdown: Billable and non-billable identities. An identity is billable when a person uses it for daily work with a standard, human-facing license. Shared mailboxes without a billable license, room and resource mailboxes, and unlicensed admin accounts aren't billed. For the full rules, see Billable and Non-billable Identities.
- Identity Breakdown: Identities by provider, either Microsoft 365 or Google Workspace. The provider counts are calculated separately from Total Identities, so they might not add up to exactly the same number.
- Identity Security Activity: How identity events, such as sign-ins and mailbox activity, became investigations and incidents. It shows the events Huntress analyzed, the Managed ITDR investigations the SOC completed, and the Critical and High Managed ITDR incidents resolved during the period.
- Top Investigated Organizations (ITDR): On account-level reports, the organizations with the most Managed ITDR investigations.
- Threat Breakdown: Managed ITDR incidents by attack vector, such as Unwanted Access, Shadow Workflows, and Rogue Applications. Only attack vectors with incidents appear. Some incidents involve more than one attack vector, so the rows can add up to more than the incident count.
- Actions Taken: Containment remediations Huntress completed for Managed ITDR incidents, such as revoking sessions and disabling identities. Steps for you to complete aren't counted here. They appear in the Incident Log
Identity Capabilities
This page explains how Managed ITDR protects identities, in three sections.
Unwanted Access
Unwanted Access rules help Huntress understand what normal access looks like for your identities. Huntress monitors for suspicious activity 24/7 whether or not you configure rules. This section shows:
- Location Rule Breakdown and VPN Rule Breakdown: The number of active rules, split into Expected (access you allow) and Unauthorized (access you don't allow).
- Scope: Whether each rule applies at the identity, organization, or account level.
To set up rules, see ITDR: Unwanted Access Overview.
Rogue Applications
This section shows known rogue applications detected in your environment during the period, and whether Huntress removed them. If none were detected, the card says no unapproved applications were found accessing your environment.
Inbox Rules
This section shows malicious inbox rules detected during the period. Attackers create inbox rules to redirect or hide email. If none were detected, the card says no hidden rules were found redirecting or hiding email activity.
Related Articles
These articles cover Managed ITDR reporting and billing in more detail: