Windows Server: AV/EDR - Sophos, Huntress, Defender Installed

Windows Server: Software Compliance - Sophos, Huntress, Defender Installed

Category: Software Compliance

Description:
This metric pulls a list of all installed software from endpoints, specifically filtering for security-related software such as Sophos, Huntress, and Microsoft Defender. It displays both the software name and its version number.

Purpose:
The purpose of this metric is to ensure that critical security software is installed, up to date, and actively running on devices in the environment. This helps to maintain a robust security posture by confirming the presence of essential endpoint protection solutions.

How It Works:
The metric queries the software inventory from connected endpoints using JMESPath. It filters for software whose name contains "Sophos," "Huntress," or "Defender" and then returns the Name and DisplayVersion fields for each match. This allows teams to monitor the specific security software deployed across their managed devices.

Beneficiaries:

• MSPs (Managed Service Providers): To ensure compliance with endpoint security policies.

• Security Teams: To track the versioning and presence of endpoint protection software.

• Compliance Officers: To verify that security software requirements are met for regulatory or internal audit purposes.

Notes for Quick Modifications:

• Add more security vendors: You can quickly expand this metric to include other security solutions by simply appending more software names in the contains(Name, 'YourSoftware') part of the query.

• Filter by specific versions: If there is a need to ensure all devices run a particular version of the software, you can add an additional filter for DisplayVersion in the query.

Why Make Changes:

• Customizing for your toolset: If your organization uses additional security tools beyond Sophos, Huntress, or Defender, expanding the query ensures those tools are monitored as well.

• Version-specific filtering: Keeping software updated is a critical security task, so adding version-specific checks will help ensure all endpoints run the latest secure versions.