EDR coverage: the machines your endpoint console does not protect
Every machine that answers on the network, checked against the endpoint console: protected, no agent, an agent gone silent while the machine kept working, or unknown because the console could not be read.
What you get
An endpoint console knows the agents it has. It cannot know the machines it is missing. MagenX starts from the devices that actually answer on the network and checks each one against SentinelOne or CrowdStrike Falcon, so the answer is a list of named machines rather than an install count.
Every machine gets one of four answers, and the answer appears on the device row, on the host page and in the posture of the sweep.
| Machine | Class | Site | Endpoint agent | Answer |
|---|---|---|---|---|
| DC01 | Domain controller | HQ | SentinelOne (online) | Protected |
| FS02 | Server | HQ | SentinelOne (online) | Protected |
| SQL01 | Server | DR | CrowdStrike (offline) | Silent for 21 days |
| WKS-0412 | Workstation | HQ | None for this machine | No agent |
| LAB-SRV-02 | Server | Branch | None | No agent |
| KIOSK-07 | Workstation | Branch | Not read | Unknown |
Sample data. Names, addresses and rules are illustrative.
Gaps that hide inside an install count
A console can count a machine as covered when the agent it holds belongs to something else. A server that moved, a reused name or an old DNS record can lend one machine another machine's agent. MagenX refuses those matches and says so on the row, naming the agent and where the console places it, so the mismatch itself becomes the thing to fix.
WKS-0412
- On the network
- Answered today, at 10.7.112.9
- The console holds
- A CrowdStrike agent named WKS-0412, listed at 10.7.5.20
- Answer
- No agent for this machine
- Why
- The named agent belongs to the machine the console lists at the other address
- Next step
- Confirm which machine carries the agent, then protect the other one
Sample data. Names, addresses and rules are illustrative.
Agents that went quiet
An agent that stopped reporting still looks like coverage in every dashboard that counts installs. MagenX compares each agent's last report with the moment its machine was seen working on the network, so a server that has run for three weeks with silent protection is named, and a laptop that simply went home is not.
| Machine | Seen working | Agent last reported | Silent for |
|---|---|---|---|
| SQL01 | Today | 21 days earlier | 21 days |
| WKS-0388 | Today | 34 days earlier | 34 days |
| APP-03 | Yesterday | 9 days earlier | 9 days |
Sample data. Names, addresses and rules are illustrative.
Where the gaps sit
Coverage can be cut by site and by device class with the page filters, because a gap on a domain controller and a gap on a kiosk are different conversations, and because a branch with no agents usually has a single cause.
| Site | Machines seen | Protected | No agent | Silent | Unknown |
|---|---|---|---|---|---|
| HQ | 412 | 398 | 9 | 3 | 2 |
| Branch | 96 | 71 | 21 | 1 | 3 |
| DR | 58 | 55 | 1 | 2 | 0 |
Sample data. Names, addresses and rules are illustrative.
The host firewall each machine carries
Where your console is CrowdStrike Falcon, MagenX also reads the host firewall policy Falcon applies to each machine: which policy it carries, whether it is enforced or in test mode, and what it allows inbound. That is how MagenX knows what can really reach each machine.
| Machine | Policy | Mode | Inbound by default |
|---|---|---|---|
| DC01 | Tier 0 servers | Enforced | Block |
| FS02 | Servers default | Test mode | Allow |
| WKS-0412 | Workstations | Enforced | Block |
| APP-07 | None | None assigned | N/A |
Test mode logs and does not block, so FS02 is open to anything the network firewall allows. Sample data.
When a console cannot be read
Every row reads Unknown, and the scan names the console that was not read. An unreachable console is never reported as an unprotected estate, and an estate scanned with no console configured says that as well, which is a different statement from one where every machine was checked and none had an agent.
What it does not do
It does not install, restart or reconfigure an agent, and it does not look inside the agent on the machine; it reports what the console records. The host firewall shown is the policy the console applies, not a reading of the machine itself. Consoles other than SentinelOne and CrowdStrike Falcon are not checked.
FAQ
Which consoles are supported?
SentinelOne and CrowdStrike Falcon, through their APIs with read permission. The host firewall policy read needs the Falcon Firewall Management read permission in addition; without it, the assignment is still read and the rules are reported as not permitted rather than as none.
What does "no agent" mean when a machine does have one?
Usually that the console lists the agent at a different address, so it most likely belongs to another machine. The row names the agent and where the console places it, so you can see which machine really carries it.
Why is a laptop that went home not a gap?
A machine is judged only when it was seen working on the network. A laptop that is off or away is not judged; a server that kept working while its agent was silent is.
Does coverage feed a score?
It counts toward the posture of the scan, measured on general-purpose computers only. It raises no finding on its own; it appears on every device row and host page, and the host firewall it brings is used when MagenX works out what can reach a machine.
Can it run without a console?
Yes. The sweep runs without it and every coverage cell reads Unknown, with the scope card saying no console was configured, which is a different statement from an estate where every host was checked and none had an agent.
Read next
Every machine checked here comes from asset discovery. Asset discovery: every device, what it is, and whether it is exposed
The host firewall policy shown here is part of what the reachability analysis evaluates. Reachability analysis, from the source to the last hop
Where an unprotected machine sits, and what shares its subnet, is the network assessment. Network security assessment
Last revised 2026-10-27.
Every finding above is evidence you can hand to the person who owns the object.
Get a demo