EDR Status Monitoring
EDR Status Monitoring lets you automatically detect and report on endpoint protection gaps across your entire device fleet. Harmony runs the monitoring workflow on a recurring schedule, evaluates each device against your configured detection thresholds, and generates a ticket with a full CSV report listing every flagged device. This works the same way as Low Storage and Device Uptime monitoring, giving IT admins a consistent and centralized approach to fleet health.
You configure everything directly from the AI Agents interface - no external tooling required.
How It Works
When the monitoring workflow runs, Harmony evaluates every managed device against the detection thresholds you define. Any device that matches one or more conditions is flagged. After the evaluation completes, Harmony creates a ticket and attaches a CSV report containing the full list of flagged devices and their relevant status details.
Configuring EDR Status Monitoring
To set up or update your EDR Status Monitoring configuration, open the AI Agents interface and navigate to the EDR Status Monitoring workflow. The configuration panel is divided into the following sections.
Schedule
Define when the monitoring workflow runs using a cron expression. You can also select the appropriate timezone so the schedule aligns with your team's working hours or maintenance windows.
Enter a valid cron expression to control the run frequency (for example, daily, weekly, or at a custom interval).
Select a timezone from the dropdown to ensure the schedule fires at the correct local time.
Detection Thresholds
Choose which conditions cause a device to be flagged. You can enable any combination of the following:
Missing EDR agent - Flags devices that have no EDR agent installed. Use this to identify endpoints that are completely unprotected.
Inactive agent status - Flags devices whose EDR agent is present but has a status of
inactive.Degraded agent status - Optionally flags devices whose EDR agent has a status of
degraded. You can enable or disable this independently of the inactive status condition.Outdated agent version - Flags devices running an EDR agent version that falls below a threshold you specify. This helps you track rollout compliance after agent updates.
A device is included in the report if it matches at least one of the enabled conditions.
Notifications
Configure how and where Harmony sends alerts when flagged devices are detected. Notification settings follow the same model used by other monitoring workflows, allowing you to route alerts to the appropriate channels or team members.
Output
Each time the workflow runs and finds flagged devices, Harmony:
Creates a ticket summarizing the monitoring run.
Attaches a CSV report listing every flagged device along with the specific condition or conditions that triggered the flag.
If no devices are flagged during a run, no ticket is created.
Related Monitoring Workflows
EDR Status Monitoring is part of a broader set of automated fleet health workflows available in AI Agents. You may also want to review:
Low Storage Monitoring - Detects devices running low on disk space.
Device Uptime Monitoring - Identifies devices that have been offline or unreachable for longer than expected.
All three workflows share the same schedule-and-threshold configuration model, so the setup experience is consistent across each one.
Last updated
Was this helpful?