Huntress adds fleet-wide automated defences to its Agentic Security Platform (ITDR, EDR, SIEM, SAT, ISPM)
Huntress announced new capabilities across its Agentic Security Platform. They turn intelligence from live attacks into protections for the whole customer base, which the company calls "herd immunity". It cites visibility across nearly 300,000 businesses, 17 million identities and 6 million endpoints. This is vendor product news, not a vulnerability or an incident. It has no direct threat impact on defenders.
Detalhes técnicos
- Managed ITDR, Adversary Infrastructure: when Huntress confirms hosting, relay or proxy infrastructure used in an identity attack, it pushes a blocking Conditional Access policy the same day. The policy goes to every eligible, opted-in Microsoft 365 tenant.
- Managed ITDR, service principals: it detects suspicious service principals and automatically disables compromised applications. It builds on Huntress' investigation of the ConnectWise/SkyKick vendor compromise, in which stolen vendor credentials were used to access Microsoft 365 environments. It requires Microsoft Entra ID P1 or higher.
- Managed ITDR, Lookback: it reviews up to 180 days of login history for newly onboarded tenants. It looks for credential theft, token theft, adversary-in-the-middle activity, suspicious browsers and data centre logins. During early access it helped an MSP uncover a compromised $2 million real estate wire transfer.
- Managed EDR, Ransomware Canaries: Huntress says nearly 30% of the ransomware cases it saw this year originated from an unprotected system. The feature blocks communication between protected systems and the compromised unprotected machine. It becomes generally available on 30 November.
- Managed SIEM, Brute Force Sentry: it detects brute-force activity across Windows RDP, RD Gateway, RDWeb and Linux SSH, and correlates failed sign-ins with later successes. It becomes generally available on 18 November.
- Managed ISPM: it adds an on-demand Identity Posture Assessment of a Microsoft 365 tenant.
- Managed SAT, Defense Drills: these are simulations built from tradecraft recently seen by the Huntress SOC. When EDR blocks a ClickFix attack, the user gets a pop-up and a short drill.
The article states these claims on the vendor's behalf, and no independent verification was found.
Linha do tempo
-
Huntress adds fleet-wide automated defences to its Agentic Security Platform (ITDR, EDR, SIEM, SAT, ISPM)
ler a análise desta fonte ocultar
Huntress announced new capabilities across its Agentic Security Platform. They turn intelligence from live attacks into protections for the whole customer base, which the company calls "herd immunity". It cites visibility across nearly 300,000 businesses, 17 million identities and 6 million endpoints. This is vendor product news, not a vulnerability or an incident. It has no direct threat impact on defenders.
Technical Details
- Managed ITDR, Adversary Infrastructure: when Huntress confirms hosting, relay or proxy infrastructure used in an identity attack, it pushes a blocking Conditional Access policy the same day. The policy goes to every eligible, opted-in Microsoft 365 tenant.
- Managed ITDR, service principals: it detects suspicious service principals and automatically disables compromised applications. It builds on Huntress' investigation of the ConnectWise/SkyKick vendor compromise, in which stolen vendor credentials were used to access Microsoft 365 environments. It requires Microsoft Entra ID P1 or higher.
- Managed ITDR, Lookback: it reviews up to 180 days of login history for newly onboarded tenants. It looks for credential theft, token theft, adversary-in-the-middle activity, suspicious browsers and data centre logins. During early access it helped an MSP uncover a compromised $2 million real estate wire transfer.
- Managed EDR, Ransomware Canaries: Huntress says nearly 30% of the ransomware cases it saw this year originated from an unprotected system. The feature blocks communication between protected systems and the compromised unprotected machine. It becomes generally available on 30 November.
- Managed SIEM, Brute Force Sentry: it detects brute-force activity across Windows RDP, RD Gateway, RDWeb and Linux SSH, and correlates failed sign-ins with later successes. It becomes generally available on 18 November.
- Managed ISPM: it adds an on-demand Identity Posture Assessment of a Microsoft 365 tenant.
- Managed SAT, Defense Drills: these are simulations built from tradecraft recently seen by the Huntress SOC. When EDR blocks a ClickFix attack, the user gets a pop-up and a short drill.
The article states these claims on the vendor's behalf, and no independent verification was found.