SharePointOnPrem
Discovers SharePoint on-premises farm topology, patch levels, and KEV vulnerability status.
What it does
Provides exported functions for enumerating on-prem SharePoint farms: - Get-SharePointOnPremFarmInventory: farm topology (web apps, service apps, content DBs) - Get-SharePointOnPremPatchLevel: SPFarm.BuildVersion from each farm endpoint - Test-SharePointKEVVulnerability: flags farms below CVE-2026-45659 Jul 2026 CU baseline (legacy single-CVE; retained for back-compat) - Get-SharePointActiveKevCatalog: pulls dynamic CISA KEV catalogue filtered to SharePoint* with 6h local cache at /tmp/cisa_kev_cache.json - Test-SharePointKEVAllActive: enumerates ALL currently active SharePoint KEV + the CRUCIBLE-tagged PT-patched attractive targets (CVE-2026-55040, CVE-2026-58644) and flags every farm below the corresponding baseline; reports the failing CVE identifier.
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/share-point-on-prem Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.