EndpointProtection
EDR / Endpoint Protection Coverage Discovery Module
What it does
Discovers EDR agent coverage across endpoints via: - Windows SecurityCenter2 WMI namespace (registered AV/EDR products) - Get-MpComputerStatus (Windows Defender real-time status) - Registry checks for CrowdStrike, SentinelOne, Carbon Black, Cylance, Sophos, Trend Micro, Symantec - Microsoft Graph API - Intune device list with complianceState (optional, gracefully degrades) Output files (written to $OutputPath): EDRCoverage.csv - one row per discovered endpoint with per-agent coverage columns EDRSummary.json - aggregate coverage statistics CSV Columns: Hostname, Platform, OsVersion, OsBuild, DefenderEnabled, DefenderVersion, DefenderEngineVersion, DefenderSignatureVersion, DefenderSignatureAge, RealTimeProtectionEnabled, QuickScanAge, FullScanAge, CrowdStrikeInstalled, CrowdStrikeSensorVersion, CrowdStrikeAgentId, SentinelOneInstalled, SentinelOneVersion, SentinelOneAgentId, CarbonBlackInstalled, CarbonBlackVersion, CylanceInstalled, CylanceVersion, SophosInstalled, SophosVersion, TrendMicroInstalled, TrendMicroVersion, SymantecInstalled, SymantecVersion, PrimaryAgent, CoverageStatus, CoverageScore, IntuneManaged, IntuneComplianceState, SecurityCenterProducts, DiscoveredAt
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/endpoint-protection Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.