Huntress Escalations

Huntress Escalations

Overview

Escalations are high-priority notifications from the Huntress SOC to MSP partners. When the Huntress SOC identifies activity requiring partner attention or action, they create an escalation. MSPs must review escalations promptly and resolve them after taking appropriate action.

Key Concepts

Escalation vs Incident

• Incidents are confirmed threats with recommended remediations
• Escalations are SOC-to-partner communications requiring human review and decision-making
• Escalations may be related to incidents but can also cover other situations

Escalation Priority

Escalations from the Huntress SOC indicate urgency. Treat all open escalations as time-sensitive communications requiring prompt review.

Anti-triggers

• A confirmed threat with a remediation to approve — that is an incident, a separate object with its own approve/reject flow; an escalation is a message asking a human to decide. Use huntress-incidents.
• A detection that no analyst has looked at yet — pre-triage telemetry never reaches the partner as an escalation; use huntress-signals.

API Patterns

List Escalations

huntress_escalations_list

Parameters:

• organization_id — Filter by organization
• status — Filter by status
• page_token — Pagination token

Example response:

{
  "escalations": [
    {
      "id": "esc-321",
      "title": "Active Ransomware — Immediate Action Required",
      "severity": "critical",
      "status": "open",
      "organization_id": "org-456",
      "created_at": "2026-02-26T09:00:00Z",
      "summary": "Huntress SOC has identified active ransomware encryption on ACME-WS-042. Immediate network isolation recommended."
    }
  ],
  "next_page_token": null
}

Get Escalation Details

huntress_escalations_get

Parameters:

• escalation_id — The escalation ID

Example response:

{
  "escalation": {
    "id": "esc-321",
    "title": "Active Ransomware — Immediate Action Required",
    "severity": "critical",
    "status": "open",
    "organization_id": "org-456",
    "created_at": "2026-02-26T09:00:00Z",
    "summary": "Huntress SOC has identified active ransomware encryption on ACME-WS-042. Immediate network isolation recommended.",
    "details": "The Huntress SOC detected file encryption activity consistent with ransomware...",
    "recommended_actions": [
      "Isolate ACME-WS-042 from the network immediately",
      "Check for lateral movement to other endpoints",
      "Preserve forensic evidence before remediation"
    ],
    "related_incidents": ["inc-789"]
  }
}

Resolve Escalation

huntress_escalations_resolve

Parameters:

• escalation_id — The escalation to resolve

Common Workflows

Escalation Review

1. List open escalations with huntress_escalations_list
2. Prioritize by severity
3. Get full details for each escalation
4. Review recommended actions
5. Take appropriate action (isolate, investigate, notify client)
6. Resolve the escalation

Escalation-Incident Correlation

1. Get escalation details to find related_incidents
2. Investigate related incidents with huntress_incidents_get
3. Handle remediations for related incidents
4. Resolve both the incident and escalation

Error Handling

Escalation Not Found

Cause: Invalid escalation ID Solution: List escalations to verify the correct ID

Escalation Already Resolved

Cause: Attempting to resolve an already-resolved escalation Solution: Check escalation status first

Best Practices

• Check for new escalations multiple times daily
• Treat all escalations as time-sensitive
• Document actions taken before resolving
• Correlate escalations with related incidents
• Create PSA tickets for client-facing escalations
• Track escalation response times for SLA compliance

Related Skills

• api-patterns - Pagination and error handling
• incidents - Related incidents
• organizations - Client context
• agents - Affected endpoints