A Super Admin must configure Managed Threat Hunting (MTH) before the MTH team can monitor your Nebula console.
Note: The MTH team can only monitor endpoints with the Endpoint Detection and Response policy settings enabled. See ThreatDown recommended policy for Nebula.
New accounts require the initial admin to complete a setup wizard before they can access the rest of the Nebula pages. The next two admins invited by the first user are prompted to update and verify the MTH settings at login.
Existing customers who add MTH to their subscription or upgrade their bundles can go to the Managed Services page in Nebula and a pop-up displays prompting admins to configure MTH.
At any time, an admin can go to Managed Services > Edit Configurations to update their MTH settings.
MTH Contacts
The MTH team needs Nebula Super Admins to contact when remediation steps are required for a detection or suspicious activity.
Select Super Admins who have verified their account for primary, backup, and alternate contacts for the MTH team to notify.
Nebula notifications are created for all contacts selected on this page. For more information, see Set up Managed Threat Hunting notifications in Nebula.
When deleting a Super Admin who is an MTH contact from the Settings > Users page, you are prompted to select a new contact.
Return to Managed Threat Hunting guide for Nebula.