Troubleshoot the Security Insights Report – Huntress Support

Team: Huntress Managed Endpoint Detection and Response (EDR)

Environment: Huntress Platform

Summary: Find the cause of common Security Insights Report issues, such as numbers that don't match Huntress, missing pages, and reports that didn't arrive.

Numbers Differ from What You See in Huntress

The report covers a fixed period, and its current counts, such as protected endpoints, are as of the period's last day. Huntress shows live data. Differences usually come from one of these causes:

Cause	What to check
Different date range	Make sure the view in Huntress uses the same dates as the report period. Report periods use Coordinated Universal Time (UTC) calendar days.
Resolved versus opened	The report counts incidents resolved during the period. Some views in Huntress count incidents opened during the period.
Sent versus resolved	Hours saved and the Incident Log dates use the date an incident was sent. Incident counts use the date it was resolved. An incident sent at the end of one month and resolved in the next counts in different months.
Product scope	Product pages count only that product's activity, and some activity is counted differently on each page. Product page numbers don't always add up to the Executive Summary.
Moved or deleted organizations	Incident counts, the Incident Log, and Top Investigated Organizations leave out organizations moved or deleted during the period. Some other counts include their activity for the days they belonged to the account.
Changes after the report was generated	Investigations, incidents, or organizations that changed after the report was generated aren't reflected until the next report.

Numbers Differ from the Legacy Threat Report

During the transition, Huntress generates both reports for the same period, and their numbers can differ. The Security Insights Report counts incidents differently:

It counts only Critical and High incidents. The legacy report also counted Low-severity incidents.
It counts incidents resolved during the period, including incidents opened earlier.

Use the Security Insights Report as your reference going forward.

The Threat Breakdown Doesn't Match the Incident Count

The Threat Breakdown groups incidents by attack vector. Some incidents involve more than one attack vector, so the rows can add up to more than the incident count. An incident that doesn't match any listed attack vector isn't shown in any row, so the rows can also add up to less.

A Product Page Is Missing

The report includes a product's pages only when that product was set up for the account or organization during the reporting period. A product counts as set up when it meets the condition in this table:

Product	Counts as set up when
Managed EDR, including the Managed Antivirus, Firewall Status Monitoring, External Recon, and Detection Capabilities pages	At least one Agent at the end of the period, or any endpoint events, investigations, or resolved incidents during it
Managed ITDR, including the Identity Capabilities page	At least one identity at the end of the period, or any identity events, investigations, or resolved incidents during it
Managed SIEM	At least one log source at the end of the period, or any ingested logs, investigations, or incidents during it
Managed ISPM	At least one identity tracked by Managed ISPM

If you expect a page and don't see it, check that the product is active for that account or organization and meets the condition in the table.

Some sections appear only on account-level reports, such as hours saved and organization comparisons. For the full list, see What Is the Security Insights Report?

Hours Saved Is Missing

Hours saved appears in SOC Performance on account-level reports only. Organization-level reports don't include it. On an account-level report, the section appears only when Huntress saved your team time during the period. For how it's calculated, see How Are Metrics and Hours Saved Calculated?.

A Recipient Didn't Receive the Report

Reports go to the recipient list for each account or organization, and a few things can stop one from arriving. To find the cause:

Check that the account or organization has recipients and that this recipient is on the right list. Without recipients, reports are generated but not emailed. Account-level reports go to Account Report Recipients, and organization reports go to that organization's Branded Report Recipients. See Configure Recipients, Branding, and Language
Check the timing. Reports are generated on the first day of the month or quarter, and the email can arrive up to about two hours later.
Ask the recipient to check spam and quarantine for a message with the subject [Huntress] Monthly Report for followed by the organization name.
Confirm that the recipient isn't expecting a weekly or monthly summary email. Those are separate emails for individual Huntress users, set in Preferences.
In the meantime, download the report from the Reports page and share it directly.

The Report Isn't in the Selected Language

The report is available in English, Spanish, French, and Dutch. The Report Language setting applies to the whole account. To check it, go to Account > Settings > Brand Settings.

I Received Two Different Reports

From November 16, 2026, through February 1, 2027, your report recipients receive both the Security Insights Report and the legacy Threat Report, and the two look different. On the Reports page, the Security Insights Report is listed as Monthly Summary (New) or Quarterly Summary (New). For what each report contains, see What Is the Security Insights Report?

Contact Support

If none of these steps help, contact Huntress Support and include:

The account or organization name
The report period
A screenshot of the page and number in question

In this Article