Latest Updates

We're excited to announce that all ITDR incident reports now include an Executive Summary. The Executive Summary automatically turns deep technical ITDR findings into plain-English executive summaries you can hand directly to business leaders, insurers, and legal without rewriting. The summary clearly explains what happened, why it matters, and what’s been done/what to do, saving hours per incident while building client trust and speeding decisions. The Executive Summary appears in plain text at the top of every ITDR incident report, and is also available to download as a standalone PDF from the portal, ready to share directly with your client. Simply click the “Export PDF” button at the top of the incident report, and a PDF download will be queued.

Huntress Managed ITDR has officially begun using per-identity escalations for new Unexpected Country and Unexpected VPN activity. With this change, each identity that generates new escalatable activity will receive its own Huntress escalation and notification—making it easier to see exactly which identity needs your attention. What this means for you: You may see more email or PSA notifications when multiple identities are involved in the same type of activity. If your PSA integration receives Huntress Escalation notifications, each per-identity escalation can generate its own PSA ticket. This does not mean one notification per login. Repeated activity for the same identity may continue to update an existing escalation until it’s resolved. Existing grouped escalations will remain unchanged; the new model applies to new escalation records created on or after August 19. No action is required to receive per-identity escalations. However, we recommend reviewing your account-level notification and PSA settings today to make sure the right categories and recipients are configured for your team. You can review your options in Huntress Platform and Alert Notifications and learn more in ITDR: Unwanted Access Overview .

Managed EDR now displays all IPv4 addresses collected by the Base Agent survey, not just the first. That makes a server with multiple NICs or a laptop on wired and wireless easier to match to firewall logs, network alerts, and investigation findings. The Internal IP / IP Address field still shows one address; hover the additional-address indicator to see the rest, or pull the full list from exports and the ipv4_addresses REST API field.