Whether endpoint protection actually reacts, per host, as evidence
That endpoint protection is installed is in the inventory. Whether it reacts when a thousand files are encrypted on a host within a minute is written nowhere, until it happens. The protection test fills that gap with scenarios that reproduce exactly that without damaging anything: EICAR self-test, simulated mass encryption on self-generated files, a ransom note as text, a decoy file, reading process patterns, entropy burst, load pattern with DNS query. The agent observes locally whether the control blocks; the server correlates with EDR and Wazuh alerts whether it alerts. Whatever neither blocks nor alerts is a control gap, per host and scenario, as a finding.
Per scenario the agent reports only verdict, exit code, duration and possibly an error text. File contents, the test string, commands and process output are not part of the reporting schema, and a guard rejects anything that looks like content rather than observation. The server stores nothing that would trigger antivirus in a backup.
Switch on the module, tenant release with a scenario allowlist, agent task, local switch in the agent configuration. If one is missing, nothing runs. The local switch lets a device owner exclude individual hosts, whatever the server says. A scenario outside the catalogue cannot be enabled.
The coverage of a run is the share of blocked and alerted among the assessed scenarios. Every "ignored" becomes a finding per host and scenario, carried forward on recurrence and closed automatically after a later successful run.
Evidence that endpoint protection on this host reacts to this pattern, instead of the assumption that it is installed.
Schedule a no-obligation demo – we will show you the module with your own use cases.
