Team: Huntress Managed Endpoint Detection and Response (EDR)
Summary: This article defines every metric in the Security Insights Report and shows how Huntress calculates hours saved.
In this Article
Overview
How to Read the Numbers
How Hours Saved Is Calculated
Incident Severity
Remediation Types
Metric Glossary
Related Articles
Overview
The Security Insights Report uses a consistent set of metrics across its pages. This article explains the reporting period, how activity is counted, how hours saved is calculated, and what each metric means.
How to Read the Numbers
A few rules apply to every number in the report:
- Reporting period: Monthly reports cover the previous calendar month, quarterly reports cover the previous calendar quarter, and custom reports cover the date range you choose. Period boundaries use Coordinated Universal Time (UTC).
- Activity counts: These add up everything that happened during the period, such as events analyzed, investigations, incidents resolved, and data ingested.
- Current counts: These describe your environment as of the last day of the reporting period, such as protected endpoints, total identities, and log sources.
- Account and organization scope: An account-level report covers every organization in the account. An organization-level report covers one organization.
- Executive Summary and product pages: Product pages count only that product's activity, and some activity is counted differently on each page. As a result, product pages don't always add up to the Executive Summary totals.
- Moved and deleted organizations: The report reflects the organizations in the account at the end of the reporting period. Whether activity from organizations moved or deleted during the period is included depends on the section. Incident counts, the Incident Log, and Top Investigated Organizations leave those organizations out. Some other counts include an organization's activity for the days it belonged to the account.
- Incidents: Unless a label says otherwise, the report counts Critical and High incidents resolved during the period, including incidents opened in an earlier period. For example, Incidents Sent in SOC Performance counts incidents by the date Huntress sent them. Low-severity incidents aren't included.
How Hours Saved Is Calculated
Hours saved is an estimate of the analyst work Huntress performed for you during the reporting period. It credits a fixed amount of time for each piece of work:
| Work Huntress performed | Time credited | What counts |
|---|---|---|
| Signals generated | 1 minute each | Signals Huntress generated from your events for review during the period |
| SOC investigations | 10 minutes each | Every investigation the Huntress Security Operations Center (SOC) opened during the period, including investigations that became incidents |
| Incidents sent | 15 minutes each | Critical and High incident reports Huntress sent during the period, excluding incidents Huntress dismissed and simulated incidents |
| SOC remediations | 1 minute each | Containment and assisted remediations Huntress completed on those incidents |
| Managed ISPM actions | 15 minutes each | Controls that Huntress Managed Identity Security Posture Management (ISPM) made compliant or brought back into compliance, and conditional access policies that completed Learning Mode |
Example. During one month, an account had 1,200 signals generated, 12 investigations, three incidents sent with five Huntress remediations, and two Managed ISPM actions:
| Work | Calculation | Minutes |
|---|---|---|
| Signals generated | 1,200 × 1 | 1,200 |
| SOC investigations | 12 × 10 | 120 |
| Incidents sent | 3 × 15 | 45 |
| SOC remediations | 5 × 1 | 5 |
| Managed ISPM actions | 2 × 15 | 30 |
| Total | 1,400 minutes, about 23 hours |
In most accounts, reviewing signals makes up the largest share of hours saved. Huntress does that review continuously, even in months without incidents.
Hours saved appears in these places:
- SOC Performance on the Executive Summary of account-level reports. Organization-level reports don't include it.
- Only when Huntress saved your team time during the period. When there was no qualifying work, the SOC Performance section isn't shown.
- The Managed ISPM page on account-level reports, which shows the portion that came from Managed ISPM work. That portion is already included in the Executive Summary total, so don't add the two together.
Hours saved is an estimate of work Huntress performed, not a measurement of your own team's time. It counts only the work listed in the table.
Incident Severity
Huntress assigns each incident a severity. The Security Insights Report includes Critical and High incidents:
| Severity | Meaning | In the report |
|---|---|---|
| Critical | A hands-on-keyboard threat actor, dangerous malware, or active compromise that requires immediate containment. For identities, hands-on attacker activity serious enough to isolate the identity. | Included |
| High | Serious confirmed malware that requires urgent remediation but not isolation. For identities, suspicious and actionable compromise activity without enough context or confidence to disable the identity. | Included |
| Low | Potentially unwanted programs, browser add-ons, freeware, and malware artifacts | Not included |
You can still see Low-severity incidents in Huntress. For more detail, see Incident Report Overview.
Remediation Types
Remediations are the steps that resolve an incident. The report groups them by who performs them:
- Containment remediations: Actions Huntress takes to contain a threat, such as isolating an endpoint, disabling an identity, or revoking sessions.
- Assisted remediations: Other remediation actions Huntress completes for you, after you approve them on the incident or according to your pre-approval settings.
- Manual remediations: Steps for you to complete. They appear in the Incident Log but aren't counted as SOC remediations.
SOC Remediations in the report count only the containment and assisted remediations Huntress completed.
Metric Glossary
This table defines each metric, whether it's an activity count or a current count, and where it appears:
| Term | Definition | Type | Appears on |
|---|---|---|---|
| Analyzed Services | Services Huntress found running on your externally available ports, marked Risky or Normal | Current | External Recon |
| Billable Identities | Identities counted toward Managed ITDR billing. See Billable and Non-billable Identities. | Current | Executive Summary, Managed ITDR |
| Billable Sources | Log sources associated with a SIEM-enabled organization that ingested data in the last 30 days | Current | Managed SIEM |
| Canary Files | Ransomware Canaries placed on protected endpoints | Current | Detection Capabilities |
| Compliance Rating | How many recommended security protections are in place and working as expected | Current | Managed ISPM |
| Containment Remediations / Assisted Remediations | Remediations Huntress completed, by type. See Remediation Types. | Activity | Managed EDR, Managed ITDR |
| Data Filtered Out | Data Smart Filtering removed during the period because it had no security value | Activity | Managed SIEM |
| Data Pool | The total data volume available for the full duration of your Managed SIEM subscription | Current | Managed SIEM |
| Defender Exclusions | Settings that stop Microsoft Defender Antivirus from scanning specific areas of an endpoint, marked Risky or Normal | Current | Managed Antivirus |
| Events | Data Huntress analyzed for a product, such as process, autorun, antivirus, identity, or log events | Activity | Product pages |
| Events Across All Your Environments | Endpoint and identity events analyzed during the period. Doesn't include Managed SIEM log events. | Activity | Executive Summary |
| Events Ingested Across All Your Sources | Log events Managed SIEM analyzed after Smart Filtering | Activity | Managed SIEM |
| External IP Addresses / Externally Available Ports | IP addresses and open ports exposed to the internet, found using Shodan | Current | External Recon |
| Filtered for Suspicious Activity | Potential threats surfaced from analyzed events for review | Activity | Executive Summary |
| Hours Saved | An estimate of analyst work Huntress performed. See How Hours Saved Is Calculated. | Activity | Executive Summary and Managed ISPM (account-level) |
| Incidents Resolved | Critical and High incidents resolved during the period, including incidents opened earlier | Activity | Executive Summary, product pages |
| Incidents Sent | Critical and High incident reports Huntress sent during the period. This can differ from Incidents Resolved, because an incident can be sent in one period and resolved in another. | Activity | SOC Performance |
| Investigations / SOC Investigations | Potential threats the Huntress SOC investigated | Activity | Executive Summary, product pages |
| Log Sources | Data sources sending logs to Managed SIEM | Current | Managed SIEM |
| Mapped Organizations / enabled organizations | Organizations with the product connected | Current | Managed ITDR, Managed SIEM, Managed ISPM |
| Microsoft Secure Score | The percentage of Microsoft's recommended security protections in place, grouped as high risk (below 60%), medium risk (60% to 80%), or low risk (80% or higher) | Current | Managed ISPM |
| Posture Activity Actions | Controls Managed ISPM made compliant or corrected, and CAPs that completed Learning Mode | Activity | Executive Summary, Managed ISPM |
| Protected Endpoints | Endpoints with the Huntress Agent installed and reporting | Current | Managed EDR |
| Protected User Profiles | Windows user profiles where Ransomware Canaries are deployed. This can be lower than the endpoint count in mixed Windows and macOS environments. | Current | Detection Capabilities |
| Remediations (Incident Log) | All remediation steps on an incident, including steps for you to complete | Activity | Incident Log |
| Signals Generated | Signals Huntress generated from your events for review | Activity | SOC Performance |
| SOC Remediations | Containment and assisted remediations Huntress completed. Doesn't include steps for you to complete. | Activity | Executive Summary, product pages |
| Stored (Smart Filtering) | Data Managed SIEM ingested and stored during the period, after filtering. It's a separate amount from Data Filtered Out, so it can be larger. | Activity | Managed SIEM |
| Threat Breakdown | Incidents grouped by attack vector. Some incidents have more than one attack vector, so the rows can add up to more than the incident count. | Activity | Managed EDR, Managed ITDR |
| Total Identities | Identities Managed ITDR monitors | Current | Managed ITDR |
Related Articles
These articles explain the report pages that use these metrics: