EDR coverage gaps, measured by address

What it measures

An endpoint console knows which agents it has. It does not know which machines exist. MagenX takes the machines from the discovery sweep, which found them by asking the network, and the agents from SentinelOne and CrowdStrike Falcon, read through their APIs, and joins the two. A machine with no agent is a gap. An agent whose last check-in is weeks before the moment its machine answered the sweep is a gap with a different name. Both are placed on the host's page, in the device ledger and in the posture number, and neither is ever produced by a console that could not be read.

The join is the whole difficulty, and the rules below are the ones that were learned on real estates, where the first version of each rule produced a confident wrong answer.

A name is not an address

A host's name can come from the host itself, in an NTLM challenge, an LDAP root, a NetBIOS reply or the certificate its remote desktop presents, or it can come from a lookup: a reverse DNS record, the name on a web certificate, a short name matched against the console's list. The first kind is a claim the machine made about itself. The second kind is a claim somebody else recorded about the address, possibly years ago.

The rule, stated by an operator twice and now the product's: a name obtained by lookup matches an agent only when the console lists the swept address for that agent. Otherwise it is not a match, the row says no agent, and it says why: "CrowdStrike holds an agent named X, but lists it at 10.7.5.20, not at 10.7.112.9". A reverse DNS record the console refutes is retired before the host is named, so a stale record cannot lend a machine somebody else's agent. The case that made the rule was a network appliance whose reverse record still carried the name of a Windows server that had moved, printing that server's agent beside it.

Staleness is anchored to the host, never to the clock

A sweep of a real estate runs for hours. If an agent's silence were measured from the moment the console was read, every host swept early would be judged against a moment long after anyone looked at it, and every laptop that went home would become a finding; on a large estate that would be most of the output. Every swept address carries the instant it answered, the console inventory is read once after identification, and the verdict compares the agent's last check-in with that instant. "Alive on the network with its protection silent for 21 days" is anchored to two measured events. "Offline right now" is never asked and never reported.

The cell says the console and one of two words, online or offline, from the console's own status at the time it was read: "CrowdStrike (online)". The day buckets stay behind it on the row.

The matching ladder

The hardware address, where the sweep or a lease supplied one
The fully qualified name, with the domain on both sides
The address, bounded in time: the console listed this address for this agent within a window of the moment the host answered
A unique short name, tried under every name the host goes by, because a console that holds hosts under the bare short name with no domain recorded cannot be matched by the qualified name, and the first version of the ladder tried one candidate and stopped
Ambiguity is reported with the candidates named, never resolved by picking one; and trying more names never becomes "keep looking until something matches"

The host firewall, from the same console

The endpoint console also holds the host firewall policy it applies to each machine: which policy is assigned, whether it is enforced or in test mode, its default inbound and outbound actions, and its rules in precedence order. MagenX reads that policy per host from CrowdStrike Falcon, compiles it per host, and hands it to the reachability engine, which consults it as the last hop of every path to that machine. First match wins over ordered rule groups; the fallback is the policy's own default and never the operating system's; local means this machine and remote means the other end; an empty address or port list means any; a rule in monitor mode logs and does not block. Three states that render identically as an empty rule list are kept apart: not permitted to read, not licensed, and genuinely no rules. Only the third is a claim about the estate.

What a console that fails produces

Nothing that looks like an answer. A connector that cannot authenticate, a scroll cursor that expired, a rate limit that bit, each leaves every row Unknown, never Not installed, and the scope card names the console that was not read. An unreachable console reported as an unprotected estate would be the worst output this feature could produce, and the rule is enforced by the gate that runs the coverage fixture before every release, 332 checks of it.

What it does not do

It does not install, restart or reconfigure an agent, and it does not read the agent on the machine; it reads the console's record of the agent. It does not query a machine's local firewall directly; the host firewall policy is the console's, and a host with no console-managed policy is reported as not consulted. Consoles other than SentinelOne and CrowdStrike Falcon are not read.

FAQ

Which consoles are supported?

SentinelOne and CrowdStrike Falcon, through their APIs with read permission. The host firewall policy read needs the Falcon Firewall Management read permission in addition; without it, the assignment is still read and the rules are reported as not permitted rather than as none.

What does "no agent" mean when a machine does have one?

Usually that the console lists the machine at a different address than the one the sweep asked, or under a name the sweep could not confirm. The row says which agent was refused and where the console places it, so the mismatch is the finding, and a stale reverse DNS record is the most common cause.

Why is a laptop that went home not a gap?

Because staleness is measured from the moment the laptop answered the sweep, not from the moment the console was read. A machine that did not answer is not on the network and is not judged. A machine that answered while its agent had been silent for weeks is.

Does coverage feed a score?

It is one axis of the sweep's posture number, measured on general-purpose computers only, with the denominator stated. It raises no finding on its own; the host page and the ledger carry it, and the reachability engine uses the host firewall it came with.

Can it run without a console?

Yes. The sweep runs without it and every coverage cell reads Unknown, with the scope card saying no console was configured, which is a different statement from an estate where every host was checked and none had an agent.