SharePoint On-Premises
Discovers SharePoint on-premises farm topology, patch levels, and KEV vulnerability status.
What it does
Provides exported functions for enumerating on-prem SharePoint farms: - Get-SharePointOnPremFarmInventory: farm topology (web apps, service apps, content DBs) - Get-SharePointOnPremPatchLevel: SPFarm.BuildVersion from each farm endpoint - Test-SharePointKEVVulnerability: flags farms below CVE-2026-45659 Jul 2026 CU baseline (legacy single-CVE; retained for back-compat) - Get-SharePointActiveKevCatalog: pulls dynamic CISA KEV catalogue filtered to SharePoint* with 6h local cache at /tmp/cisa_kev_cache.json - Test-SharePointKEVAllActive: enumerates ALL currently active SharePoint KEV + the CRUCIBLE-tagged PT-patched attractive targets (CVE-2026-55040, CVE-2026-58644) and flags every farm below the corresponding baseline; reports the failing CVE identifier.
How the app exposes it
The module feeds into the ACQI app's dedicated results view. From there, conflicts, dependencies, and readiness scores roll up into the deal workspace.
/discovered/share-point-on-prem Outputs
Each module produces a CSV with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact columns vary by module — the app's results view shows the live schema.