Edrgap

Part of the Cognis Neural Suite by Cognis Digital Cognis Open Collaboration License (COCL) v1.0 · domain: blue-team

PyPI CI License: COCL 1.0 Suite

EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories.

Blue Team / Defense — detection, deception, and monitoring for small teams.

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ edrgap-emit --version
edrgap 0.1.0

$ edrgap-emit --help
usage: edrgap [-h] [--version] {scan} ...

EDR coverage & bypass detector -- reconciles MDM, EDR and Active Directory host inventories to find endpoints with missing, stale, or degraded EDR protection.

positional arguments:
  {scan}
    scan      Reconcile inventories and report coverage gaps.

options:
  -h, --help  show this help message and exit
  --version   show program's version number and exit

Example:
  edrgap scan --ad ad.csv --mdm mdm.json --edr edr.json
  edrgap scan --edr edr.json --ad ad.csv --format json

Blocks above are real edrgap output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"findings": [
    {
        "id": "123456",
        "title": "Suspicious Activity Detected",
        "description": "An unknown entity has accessed a sensitive system.",
        "created_by": "John Doe",
        "created_at": "2023-02-20T14:30:00Z"
    }
]
}

Usage — step by step

1. Install the CLI (console-script: edrgap):

   pipx install "git+https://github.com/cognis-digital/edrgap.git"
   edrgap --version
   

2. Reconcile your AD/MDM/EDR inventories and print a coverage-gap table:

   edrgap scan --ad ad.csv --mdm mdm.csv --edr edr.csv
   

3. Tune what counts as a finding — flag stale assets and raise the severity floor:

   edrgap scan --ad ad.csv --mdm mdm.csv --edr edr.csv --stale-days 14 --min-severity high
   

4. Emit machine-readable JSON for dashboards or downstream tooling:

   edrgap scan --ad ad.csv --mdm mdm.csv --edr edr.csv --format json > gaps.json
   jq '.[] | select(.severity=="high")' gaps.json
   

5. In CI, run the scan and let a non-zero exit fail the pipeline on coverage gaps:

   edrgap scan --ad ad.csv --mdm mdm.csv --edr edr.csv --min-severity high || exit 1
   

Why

Security and intelligence teams need EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories without standing up heavyweight infrastructure. edrgap is single-purpose, scriptable, CI-friendly, and self-hostable: point it at a target, get prioritized findings in the format your workflow already speaks (table, JSON, SARIF, HTML), and wire it into agents over MCP when you want it autonomous.

Install

pip install cognis-edrgap
# or, from this repo:
pip install -e ".[dev]"

Quick start

edrgap --version
edrgap scan demos/                      # run against the bundled demo
edrgap scan demos/ --format sarif --out r.sarif --fail-on high
edrgap scan demos/ --format html --out report.html
edrgap mcp                              # expose as an MCP server (Cognis.Studio / Claude Desktop / Cursor)

Built-in demo scenarios

Each scenario folder includes a SCENARIO.md describing the situation and the findings to expect.

• demos/01-basic/
• demos/01-enterprise-200-endpoints/
• demos/02-acquisition-merge/
• demos/03-clean-shop/

Output formats

• Table (default) — human-readable terminal summary
• JSON — machine-readable findings for pipelines
• SARIF — drops into GitHub code-scanning / IDE problem panes
• HTML — shareable report with severity rollups

How it fits the Cognis Neural Suite

edrgap is one of 52 tools in the Cognis Neural Suite. Every tool ships an MCP server, so Cognis.Studio agents can call them as scoped capabilities.

Sibling tools in blue-team: sentrylog, canarynet, phishforge, sbomgate, honeytrace

Architecture & roadmap

• Design notes: docs/ARCHITECTURE.md
• Planned work: ROADMAP.md

Contributing

PRs, new detections, and demo scenarios are welcome under the collaboration-pull model. See CONTRIBUTING.md and SECURITY.md.

Interoperability

edrgap composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

Integrations

Forward edrgap's findings to STIX/MISP/Sigma/Splunk/Elastic/Slack/webhooks via cognis-connect. See INTEGRATIONS.md.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

Responsible use

This is dual-use security software. Use it only against systems, data, and identities you own or are explicitly authorized in writing to test, and in compliance with applicable law.

About

Cognis Digital — Wyoming, USA · Making Tomorrow Better Today: Advanced Cybersecurity, AI Innovation, and Blockchain Expertise.