Security tools (Huntress, SentinelOne, Defender, Have I Been Pwned)
See each client's protected devices, open incidents and breached email addresses next to their documentation, with alerts.
Connect the security tools you already run, and each organization's overview gets a 🚨 Security card: which devices are protected, which servers and workstations aren't, and every open incident, with alerts when something new turns up.
| Tool | What comes in | Connect it under |
|---|---|---|
| Huntress | Organizations, protected devices (agent, last check-in, Microsoft Defender and firewall status) and open incident reports | Admin → Integrations → Huntress |
| SentinelOne | Sites, protected devices (status, version, network isolation, active threats) and unresolved threats | Admin → Integrations → SentinelOne |
| Microsoft Defender | Open alerts from Defender for Endpoint, Office 365, Identity and Cloud Apps, for each client tenant | Your Microsoft 365 connection |
| Have I Been Pwned | Email addresses at your clients' domains that turned up in known data breaches | Admin → Integrations → Have I Been Pwned |
Knowpoint only reads from these tools. It never changes anything in them, and never isolates, quarantines or resolves anything there.
Huntress and SentinelOne
They connect like an RMM: Test connection, Match companies (Huntress organizations and SentinelOne sites match organizations by name), then 🔄 Sync now.
Devices. Each agent is matched to the asset it already is (serial number, name or short hostname). Most of your devices are already documented from your PSA or RMM, so a security tool only fills in blank fields and never overwrites what's there. Devices that don't match an asset are added. Each asset gets a card, such as From Huntress, with its protection status.
Coverage. The Security card counts the protected devices, and lists the servers and workstations that no Huntress or SentinelOne agent covers, so you can find the gaps.
Incidents. Open Huntress incident reports and unresolved SentinelOne threats show on the organization and on the asset, with their severity, details and a link to the tool. When the tool closes one, the next sync marks it resolved.
Microsoft Defender
Turn on Microsoft Defender alerts under What to sync on your Microsoft 365 connection. The app needs the SecurityAlert.Read.All permission, granted in each tenant again (Add from Partner Center does them all at once). Open alerts show on the organization, and on the device when Defender names one Knowpoint knows by its hostname.
Have I Been Pwned
Have I Been Pwned checks every domain under Domains & SSL. Each breach that addresses at a domain appeared in becomes an incident on its organization, such as 2 addresses at contoso.com were in the Adobe breach, with what was exposed. The domain's page lists every address and the breaches it was in.
- Buy a Have I Been Pwned subscription that includes domain search, and copy the API key.
- In its Domain search dashboard, verify each client domain once (by DNS, email or a file on the website). Have I Been Pwned only answers for verified domains; the integration page lists the ones that aren't.
- In Admin → Integrations → Have I Been Pwned, paste the key, choose your subscription so Knowpoint keeps to its rate limit, and choose Check now.
Breaches are history, so they never resolve themselves. When you've dealt with one (new passwords, MFA on), choose Mark resolved.
Alerts
Add the New security incident rule under Admin → Notifications, or choose Add recommended rules. Pick the lowest severity to alert on: High by default, which includes breaches that exposed passwords. Each incident alerts once, to the people who can see the organization (and the device, if it's restricted).
Marking incidents resolved
Anyone who can edit documentation can choose Mark resolved on an open incident, for example once it's handled in the tool. It stays resolved even if the tool still lists it.