Managed Threat Hunting (MTH) must be configured by a Global Administrator before the MTH team can begin to hunt for threats in your OneView sites. You'll be prompted to configure MDR once you subscribe to the MTH service. For more information on subscribing, see the following resources:
Note: The MDR team can only monitor endpoints with the Endpoint Detection and Response policy settings enabled. See ThreatDown recommended policy for OneView.
MTH Contacts
When adding this service to a site, the MTH team must know which OneView users to contact when remediation steps are required for detections or suspicious activities.
Select OneView users who have verified their account for primary, backup, and alternate contacts that the MTH team can notify.
Note: The selectable contact users are either Global Administrators or Site Administrators assigned to the site in OneView.
OneView notifications are created for all contacts selected on this page. For more information, see Set up Managed Threat Hunting notifications in OneView.
When deleting a OneView user who is an MTH contact from the Settings > Users page, you are prompted to select a new MTH contact.
Update MTH settings
To edit these settings later, follow these steps:
- In OneView, go to Manage > Sites.
- Click on the site.
- In the slideout, click Manage Subscription > Manage Subscription.
- Click Next to go to the Services screen.
- Update the fields as needed.
- Click Next.
- Click Save.
Return to Managed Threat Hunting.