Request a demoDemo
Menu

Connect · Reconcile against IT’s lists

On the wire, but unknown to IT.

Compares the wire with Active Directory, Entra ID, Intune, CrowdStrike, Defender and DHCP lists. An import never approves a device.

Request a demoTechnical detail
Status
Available
Screens
Designed, not built yet
Command line
appliance reconcile

The problem

“Is every device on your network one you know about, and does each one run endpoint protection?” Banks answer it with a week of spreadsheet lookups.

Cloud asset tools need API connectors that vendor management will not approve.

How it works, illustrated

Reconcile: the wire compared with IT's listsDevices on the wire, devices in IT's lists, and devices with a reporting EDR agent, overlapping. Each region is one of the lists the appliance produces. An import never approves a device.On the wiremonitored ports, last 30 daysIn IT’s listsAD, Entra ID, Intune, DHCP, EDREDR agent reporting: CrowdStrike, Defender1234ad-computers.csvsha256 3f9c…e1a0The lists it produces1unknownOn the wire, unknown to IT2not-seenKnown to IT, not seen in 30 days3without-edrNo EDR agent, or one that has notreported within 14 days4matchedOn the wire and known to IT, withhigh, medium or low confidence5mismatchesRecords that disagree: a MAC or namethat differs, a disabled accountlogged: reconcile_import · file SHA-256An import never approves a device.Joined by MAC, then a unique host name, then IP. A DHCP host name never makes a device known.Reconcile: the wire compared with IT's listsDevices on the wire, devices in IT's lists, and devices with a reporting EDR agent, overlapping. Each region is one of the lists the appliance produces. An import never approves a device.On the wirelast 30 daysIn IT’s listsAD, Entra, Intune, DHCPEDR agent reporting1234ad-computers.csvsha256 3f9c…e1a01unknownOn the wire, unknown to IT2not-seenKnown to IT, not seen in 30 days3without-edrNo EDR agent reporting4matchedHigh, medium or low confidence5mismatchesRecords that disagreelogged: reconcile_import · file SHA-256An import never approves a device.A DHCP host name never makes a device known.
Reconcile. The switch tables are the ground truth. Every import is logged by its file hash, and an import never approves a device.
What this shows

Two overlapping sets. On the left, what is on the wire: every device seen on a monitored switch port in the last 30 days. On the right, what IT's lists hold: Active Directory, Entra ID, Intune, DHCP leases, a spreadsheet, and the EDR consoles. Inside IT's lists is a smaller set, the devices whose EDR agent (CrowdStrike or Defender) is reporting. An import file, ad-computers.csv, drops into IT's lists with its SHA-256. The regions are the lists the appliance produces: 1, unknown: on the wire but in no IT list. 2, not-seen: known to IT but not seen in 30 days. 3, without-edr: on the wire and known, but with no EDR agent, or one that has not reported within 14 days. 4, matched: on the wire and known to IT, with high, medium or low confidence. 5, mismatches: records that disagree, such as a MAC or host name that differs, or a disabled account. Records are joined by MAC, then by a unique host name, then by IP, and a DHCP host name never makes a device known. Each import is a reconcile_import entry in the log with the file's SHA-256. An import never approves a device.

appliance reconcile -kind active_directory computers.csv# reads the export the way an import would, prints its SHA-256, records nothingappliance reconcile -kind crowdstrike -data-dir /var/lib/appliance \    -list without-edr hosts.csv# lists: unknown, not-seen, mismatches, without-edr, matched
Command-line usage from the appliance’s reference.

Today reconcile runs on the command line, which checks a file the way an import would read it, and through the appliance’s data routes.

Its screens are designed and arrive with the new interface.

How it works

  • Five lists: on the wire but unknown to IT; known to IT but not seen in 30 days; mismatches; devices without a working EDR agent; and matches, with high, medium or low confidence.
  • Records are joined by MAC address, then by a host name that is not generic, then by IP. A DHCP host name, which the device chooses itself, can never make a device known to IT.
  • EDR coverage needs the agent to have reported within 14 days of the device’s last sighting. Phones, printers, cameras and access points are exempt by their maker, not by the port they sit on.
  • Reads CSV and LDIF exports, ISC dhcpd leases, Kea JSON and your own spreadsheet. Entra ID and Intune can also be pulled from your own tenant through Microsoft Graph, if you opt in.
  • Every file is treated as hostile: size and row limits, values cleaned, and every parser fuzzed.

What it proves

Every import is logged with the file’s SHA-256, so an examiner can hash the bank’s own copy of the export and match it. The anti-malware question is answered with the switch tables as ground truth.

What it records

Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.

  • reconcile_importThe list, the file’s SHA-256 and a hash of the normalized records, written in the same transaction as the records.

Limits

What it does not do yet, stated plainly. The technical page lists every known gap.

  • The screens are not built yet.
  • CrowdStrike and Defender are read from CSV exports. API connectors are not built.
  • The Defender and Intune column headers and the Graph fields still need checking against real consoles.
  • Evidence packs do not carry the reconcile lists yet.

Technical detail

Docs · Feature referenceReconcile against IT’s lists: how it is builtWhat it does, how it works, what it records, security notes, limits and known gaps, the command line, data routes and the review summary.

Also in Connect

Integrations

Sends alerts to Splunk, Microsoft Sentinel, syslog (CEF, LEEF), Teams, Slack, ServiceNow, ConnectWise, Autotask, HaloPSA, PagerDuty, email and your NMS (SNMP informs or traps), filtered per destination, and streams the evidence log to Splunk, Sentinel, syslog and signed webhooks.

CSV and NDJSON exports

Seven lists download as formula-safe CSV or NDJSON with the same columns everywhere, and every export from the interface is logged.

Your policy, measured

Time to detect, time to decision, coverage over time and policy pass or fail, measured from the signed log against the targets your board set.

Early access: now taking pilot customers.

See it on your own network.

A live demo with the engineers who built it. We bring a simulated network; you bring your questions.

Request a demoDocumentation