Who does what
Provider
- Investigate enabled Huntress product alerts
- Create incident reports and escalation tickets
- Perform enabled, authorized containment and assisted remediation
Your team
- Deploy agents and connect telemetry
- Maintain permissions and approve required actions
- Complete manual remediation, recovery and communication
Coverage
- Endpoints
- Identity & Access
- Network
- SaaS Applications
- Cloud Workloads
Details
Service scope
Best for MSPs and smaller teams wanting managed endpoint and identity response
Enabled actions
Endpoint isolation, assisted remediation and Microsoft 365 identity actions depend on the purchased product and permissions.
Platform coverage
ITDR monitors Microsoft 365 and Google Workspace. Managed EDR response uses the Huntress agent. A third-party SIEM log source does not confer equivalent response authority.
Module pricing
Published examples use 100 units per module. Direct/reseller orders have a 50-unit per-product minimum. MSPs set their own client service packages.
Full service analysis
Huntress analysts investigate alerts from the EDR, ITDR and SIEM modules you purchase and execute enabled containment and remediation. You or your MSP maintain deployment and permissions, resolve manual steps and own recovery and communication.
- Your team owns
- Deploying agents and configuring Microsoft 365, SIEM, PSA, and ticketing integrations
- Granting and reviewing the permissions Huntress needs for containment actions
- Approving or completing remediation steps that require customer action
- Client communication, recovery work, policy decisions, and broader incident response
Containment and follow-through
Managed Response can isolate hosts, remove malicious files and persistence and act on Microsoft 365 identities when enabled. High-severity reports can still require manual work. Reboots, patches, recovery and business decisions stay with your team or MSP.
Purchase route
An MSP can add deployment and daily administration. Direct or reseller purchases leave that work with the buyer. Compare the service responsibilities and modules alongside the license rate.
Pricing & contract
EDR: $7.99 USD/endpoint/month Official 100-endpoint volume example. MSRP is $8.99 per endpoint/month. Identity, SIEM and partner operations are separate.
The $7.99 USD rate is the Managed EDR example for 100 endpoints, not a full-platform price. ITDR and SIEM are separate modules. Huntress describes 12-month standard terms and a 50-unit minimum per product for direct/reseller purchases. MSP client packaging can differ.
- Billing
- Per-endpoint, Per-user, Per-asset, Custom
- Trial
- Available
Tradeoffs & buying questions
Strengths
-
24/7 analyst investigation and incident reports
Human analysts investigate alerts and prepare incident reports around the clock.
-
Enabled containment and remediation
Enabled Managed Response executes containment and selected remediation through the Huntress platform.
-
Published module pricing examples
The current pricing page gives module-specific units, volume examples and channel terms.
Considerations
-
Deployment and permissions need an owner
Buyers or MSPs must maintain agents, integrations and response permissions.
-
Manual steps and recovery remain
High-severity incidents and failed actions can still require manual remediation and recovery.
-
Module and channel scope changes the total
Each module and partner operating service needs its own commercial scope.
Ask before buying
- Which EDR, ITDR, SIEM, training and posture modules are included?
- Which containment actions run automatically, and which need approval?
- How do incident reports, isolation actions and remediation tickets reach our PSA or on-call team?
Customer feedback
Customers value
-
2025 accounts value configuration, monitoring and support
July 2025 TrustRadius accounts value manageable configuration, monitoring and detection support.
-
MSP reviewers use several modules. Several reviews are incentivized.
MSP accounts describe using EDR, ITDR and SIEM to support smaller clients. Several reviews are incentivized.
Reported concerns
-
A 2025 account sought SIEM, reporting and billing improvements
A July 2025 MSP reviewer wanted improvements to SIEM, reporting and billing by client. Test current workflows.
-
One July 2025 account reported update disruption
Another July 2025 account reported disruption from an update. This is a dated individual experience, not a measured failure rate.
Integrations
Platform / SIEM
- Huntress Managed SIEM
Endpoint
- Huntress EDR agent
- Microsoft Defender Antivirus
- Microsoft Defender for Endpoint
Cloud
- AWS
- Microsoft Azure
Other integrations
- Microsoft Entra ID
- Duo
- Cisco Umbrella
6 more integrations
- CrowdStrike Falcon
- SentinelOne
- Cisco Secure Endpoint
- NinjaOne
- Microsoft 365
- Google Workspace
Common questions
Is Huntress an MDR provider or a full SOC replacement?
Huntress is best treated as MDR with managed endpoint, identity, and SIEM modules backed by a 24/7 SOC. Its SOC investigates and can contain supported threats inside the Huntress platform, but the buyer still owns deployment, permissions, recovery, internal communications, and response work outside the contracted scope.
What happens when Huntress finds a real incident?
Huntress analysts investigate suspicious activity, create an incident report, and deliver it through configured channels such as email or PSA integrations. Depending on the enabled module and permissions, Huntress can isolate an endpoint, run assisted endpoint remediation, revoke Microsoft 365 sessions, disable a compromised identity, or remove malicious inbox rules.
How does Huntress pricing work?
Huntress publishes examples at 100 units: EDR $7.99 USD per endpoint/month, ITDR $3.60 per licensed identity/month and SIEM $3.50 per source/month. Modules are separate. Standard terms are 12 months. Channel, volume and partner-managed work affect the quote.
Company details
- Headquarters
- Columbia, Maryland
- Founded
- 2015