> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/hardware-management/edr-status-monitoring.md). # EDR Status Monitoring EDR Status Monitoring lets you automatically detect and report on endpoint protection gaps across your entire device fleet. Harmony runs the monitoring workflow on a recurring schedule, evaluates each device against your configured detection thresholds, and generates a ticket with a full CSV report listing every flagged device. This works the same way as Low Storage and Device Uptime monitoring, giving IT admins a consistent and centralized approach to fleet health. You configure everything directly from the AI Agents interface - no external tooling required. *** ### How It Works When the monitoring workflow runs, Harmony evaluates every managed device against the detection thresholds you define. Any device that matches one or more conditions is flagged. After the evaluation completes, Harmony creates a ticket and attaches a CSV report containing the full list of flagged devices and their relevant status details. *** ### Configuring EDR Status Monitoring To set up or update your EDR Status Monitoring configuration, open the AI Agents interface and navigate to the EDR Status Monitoring workflow. The configuration panel is divided into the following sections. #### Schedule Define when the monitoring workflow runs using a cron expression. You can also select the appropriate timezone so the schedule aligns with your team's working hours or maintenance windows. * Enter a valid cron expression to control the run frequency (for example, daily, weekly, or at a custom interval). * Select a timezone from the dropdown to ensure the schedule fires at the correct local time. #### Detection Thresholds Choose which conditions cause a device to be flagged. You can enable any combination of the following: * **Missing EDR agent** - Flags devices that have no EDR agent installed. Use this to identify endpoints that are completely unprotected. * **Inactive agent status** - Flags devices whose EDR agent is present but has a status of `inactive`. * **Degraded agent status** - Optionally flags devices whose EDR agent has a status of `degraded`. You can enable or disable this independently of the inactive status condition. * **Outdated agent version** - Flags devices running an EDR agent version that falls below a threshold you specify. This helps you track rollout compliance after agent updates. A device is included in the report if it matches at least one of the enabled conditions. #### Notifications Configure how and where Harmony sends alerts when flagged devices are detected. Notification settings follow the same model used by other monitoring workflows, allowing you to route alerts to the appropriate channels or team members. *** ### Output Each time the workflow runs and finds flagged devices, Harmony: 1. Creates a ticket summarizing the monitoring run. 2. Attaches a CSV report listing every flagged device along with the specific condition or conditions that triggered the flag. If no devices are flagged during a run, no ticket is created. *** ### Related Monitoring Workflows EDR Status Monitoring is part of a broader set of automated fleet health workflows available in AI Agents. You may also want to review: * **Low Storage Monitoring** - Detects devices running low on disk space. * **Device Uptime Monitoring** - Identifies devices that have been offline or unreachable for longer than expected. All three workflows share the same schedule-and-threshold configuration model, so the setup experience is consistent across each one. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.harmony.io/ai-agents/hardware-management/edr-status-monitoring.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.