M365 ● Sealed v1.0 (treated)

SharePointOnPrem

Discovers SharePoint on-premises farm topology, patch levels, and KEV vulnerability status.

What it does

Provides exported functions for enumerating on-prem SharePoint farms: - Get-SharePointOnPremFarmInventory: farm topology (web apps, service apps, content DBs) - Get-SharePointOnPremPatchLevel: SPFarm.BuildVersion from each farm endpoint - Test-SharePointKEVVulnerability: flags farms below CVE-2026-45659 Jul 2026 CU baseline (legacy single-CVE; retained for back-compat) - Get-SharePointActiveKevCatalog: pulls dynamic CISA KEV catalogue filtered to SharePoint* with 6h local cache at /tmp/cisa_kev_cache.json - Test-SharePointKEVAllActive: enumerates ALL currently active SharePoint KEV + the CRUCIBLE-tagged PT-patched attractive targets (CVE-2026-55040, CVE-2026-58644) and flags every farm below the corresponding baseline; reports the failing CVE identifier.

How the app exposes it

The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.

Route in app:
/discovered/share-point-on-prem

Outputs

Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.