<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-endpoint-inventory-management
description: >-
  Build and maintain comprehensive endpoint inventories covering hardware, software, OS versions, and security agent status.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - inventory
  - asset-management
  - cmdb
  - discovery
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Performing Endpoint Inventory Management

## Overview

You cannot secure what you do not know exists. Endpoint inventory management
maintains an accurate, continuously updated catalog of all endpoint assets.
Accurate inventory is prerequisite for vulnerability management, compliance
reporting, and incident response scope assessment.

## Prerequisites

| Requirement | Install |
|---|---|
| MDM / SCCM / Intune | Endpoint management platform |
| Network scanner | Nmap or similar for discovery |
| CMDB | ServiceNow or asset management database |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Discovery Methods

- **Agent-based** — MDM/EDR agent reports device details
- **Network scanning** — Active discovery of IP-connected endpoints
- **DHCP/DNS correlation** — Passive discovery from network service logs
- **AD/Azure AD query** — Domain-joined device enumeration
- **NAC integration** — Network access control device profiling

### Inventory Data Model

| Category | Attributes |
|---|---|
| Hardware | Hostname, serial, model, CPU, RAM, disk |
| OS | Type, version, build, patch level |
| Software | Installed apps, versions, licenses |
| Security | EDR status, encryption, AV signatures |
| Network | IP, MAC, last seen, location |

### Drift Detection

Compare current state against approved baseline:
- Unauthorized software installations
- Missing security agents
- OS versions past end-of-life
- Devices not seen in > 30 days (ghost assets)

## Workflow

1. **Deploy discovery agents** — install MDM/EDR agents on managed endpoints
2. **Run network discovery** — scan subnets for unmanaged devices
3. **Correlate sources** — merge agent, network, and directory data
4. **Establish baseline** — define approved hardware, software, and OS versions
5. **Configure drift alerts** — notify on deviation from approved baseline
6. **Reconcile inventory** — compare CMDB against discovered assets quarterly
7. **Report coverage** — calculate managed vs. unmanaged device ratio

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Endpoint Inventory Management Detection
id: 94e29116-6228-40fb-8cfe-e0e30d6b97c5
status: experimental
description: Detects suspicious activity related to performing endpoint inventory management techniques in endpoint security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*endpoint*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.execution
falsepositives:
  - Endpoint management software performing routine maintenance tasks
```

## Verification

| Check | Method |
|---|---|
| Agents deployed | MDM agent installed on >95% of known endpoints |
| Discovery complete | Network scan covers all corporate subnets |
| Data merged | Inventory reflects agent + network + directory sources |
| Drift detected | Unauthorized software installation triggers alert |
| Coverage reported | Managed device ratio calculated and tracked |

## References

- [CIS Control 1 — Inventory of Enterprise Assets](https://www.cisecurity.org/controls)
- [CIS Control 2 — Inventory of Software Assets](https://www.cisecurity.org/controls)
- [NIST SP 800-53 CM-8](https://csrc.nist.gov/)
- [Microsoft Intune Device Inventory](https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-inventory)
