Endpoint Protection
EDR / Endpoint Protection Coverage
What it does
Discovers EDR agent coverage across endpoints via: - Windows SecurityCenter2 WMI namespace (registered AV/EDR products) - Get-MpComputerStatus (Windows Defender real-time status) - Registry checks for CrowdStrike, SentinelOne, Carbon Black, Cylance, Sophos, Trend Micro, Symantec - Microsoft Graph API - Intune device list with complianceState (optional, gracefully degrades) Output files (written to $OutputPath): EDRCoverage.csv - one row per discovered endpoint with per-agent coverage columns EDRSummary.json - aggregate coverage statistics CSV Columns: Hostname, Platform, OsVersion, OsBuild, DefenderEnabled, DefenderVersion, DefenderEngineVersion, DefenderSignatureVersion, DefenderSignatureAge, RealTimeProtectionEnabled, QuickScanAge, FullScanAge, CrowdStrikeInstalled, CrowdStrikeSensorVersion, CrowdStrikeAgentId, SentinelOneInstalled, SentinelOneVersion, SentinelOneAgentId, CarbonBlackInstalled, CarbonBlackVersion, CylanceInstalled, CylanceVersion, SophosInstalled, SophosVersion, TrendMicroInstalled, TrendMicroVersion, SymantecInstalled, SymantecVersion, PrimaryAgent, CoverageStatus, CoverageScore, IntuneManaged, IntuneComplianceState, SecurityCenterProducts, DiscoveredAt
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/endpoint-protection Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.