Huntress at MSP scale

Account vs Organization vs Reseller, the role matrix at each layer, how RBAC actually scopes visibility, and the partner-access patterns that show up in the field.

The two billing notifications, the Billing Detail Report, ITDR's billable-user model, agent counts vs Unresponsive cleanup, and a monthly reconciliation routine that catches drift before it shows up on an invoice.

Account creation through 30-day review, sequenced so each step depends only on the previous one. The order that scales: Organization, agent rollout, integrations, ITDR, SAT pilot, baseline review.

The REST API surface, authentication, the Swagger preview, the MCP server for AI assistants, and patterns to build (and patterns not to build) on top.

Severity-driven response paths, host isolation as a containment lever, identity isolation for ITDR, customer communication during an active incident, and the post-incident review that turns an incident into operational improvement.

A customer-exit runbook for Huntress, covering EDR agents, ITDR integrations, SAT, SIEM sources, PSA mapping, API credentials, retained reports, billing, and customer communication.