AssurIQ Endpoint Agent: capability model and EDR-ready foundation

Overview

The AssurIQ Endpoint Agent is an architecture, not a rebrand: the collector you deploy today is its first form. The agent is modelled as seven capabilities — Asset Sensor, Configuration Sensor, Vulnerability Sensor, Security Sensor, Threat Sensor, Response Engine and Evidence Engine — each negotiated by key and version at heartbeat. Agents that do not report capabilities keep working unchanged; the control plane infers Asset Sensor from the collector version and marks everything else Not reported.

Canonical telemetry model

Every endpoint observation is written to an append-only event log with tenant, site, device, event type, observed and received times, source (agent / provider / integration / manual / system), provider, severity, agent version, provenance, safe reference metadata, evidence link and a retention class. Idempotency keys make retries harmless.

• Collected today: host identity, open services from network scan, interfaces/VLANs/neighbors/routes.
• Not yet collected: services, installed software, persistence, Defender state, firewall, encryption, patch state, removable media, executable/install events, third-party AV/EDR health.
• Feature-gated (privacy): processes/process trees, PowerShell/script activity, local users/admins, authentication failures, connections.

Security providers and posture facts

Provider posture is provider-agnostic: presence, health, active state, coverage evidence, last observed time and source per device. Posture facts (encryption, firewall, patch, local admins, EDR sensor, real-time protection, …) carry state, value, source, provider, agent version and observed time. Both tables write append-only history automatically so insurance and audit reports can show coverage over time.

Operators may record a manual attestation for a fact that no agent reports. Manual attestations are clearly labelled, lower confidence, and can never overwrite an agent-sourced fact (AIQ-EDR-007).

Agent wire extension (optional)

"agent": {
  "contract_version": "1.1",
  "capabilities": [{"key":"asset_sensor","version":"0.2.0"},{"key":"security_sensor","version":"0.1.0"}],
  "spool": {"depth": 0},
  "resync_status": "in_sync",
  "update_ring": "canary"
}

"security_posture": {
  "providers": [{"key":"defender_for_endpoint","name":"Microsoft Defender for Endpoint","kind":"edr","presence":"present","health":"healthy","active":true}],
  "facts": [{"key":"encryption","state":"compliant","value":{"method":"BitLocker"}},{"key":"firewall","state":"compliant"}]
}

The heartbeat response now includes agent.permitted_capabilities derived from platform flags, so an agent learns which sensors it may run.

Feature flags and safety controls

Flags are platform-scoped; a customer override can restrict a destructive capability but cannot enable one the platform has off. Only Platform Admins can change flags and every change is written to an append-only audit.

Response action contracts

A response action records who requested what against which endpoint, with a reason, an idempotency key, a nonce, an expiry (30 minutes by default), signature fields reserved for signed dispatch, and preserve_management_connectivity = true. Approval is required and the requester cannot approve their own request (AIQ-EDR-005).

1. Request → pending_approval (or blocked_by_flag while gated).
2. Approve / reject / cancel by a second operator.
3. Dispatch, acknowledge, complete, fail and expire are reserved for the control plane and refused for app users (AIQ-EDR-003).
4. Every transition is appended to response_action_audit.

• AIQ-EDR-001Native EDR capability inactive
  A native AssurIQ detection or response capability was requested while its feature flag is OFF. The request is recorded for audit only; nothing was sent to the endpoint.
• AIQ-EDR-002Response execution blocked by feature flag
  An attempt was made to move a response action into an execution state while its flag is OFF.
• AIQ-EDR-003Execution state reserved for the control plane
  Only the control plane may mark a response action dispatched, acknowledged, completed or failed. App users can only approve, reject or cancel.
• AIQ-EDR-004Response action is terminal
  The action already reached a terminal state (completed, failed, expired, cancelled, rejected or blocked) and cannot change.
• AIQ-EDR-005Requester cannot self-approve
  Sensitive response actions need a second person; the requester cannot approve their own request.

Detection rule lifecycle

Rules are versioned metadata with draft, simulation and enforce modes. Every edit snapshots a new version. Enforce is refused while detection_rule_enforcement is OFF (AIQ-EDR-006). No agent evaluates rules today.

Agent lifecycle, rings and tamper status

• Update rings: test → canary → stable, alongside the existing release channel and rollback version recorded per scheduled update.
• Heartbeat/stale monitoring: Healthy, Degraded, Stale (3 missed intervals), Offline (5 minutes).
• Offline spool depth/age and resync status are reported by the agent when supported.
• Tamper status defaults to Not implemented; it is only shown as Protected once an agent build implements and reports it.

Cyber-insurance crosswalk and retention

The insurance evidence crosswalk maps endpoint evidence hooks — EDR coverage, monitoring state, endpoint protection, encryption, patching, MFA-related endpoint evidence and response capability — to universal controls (for example AIQ-NS-002, AIQ-EN-001, AIQ-VM-002/003, AIQ-ID-004, AIQ-MO-001, AIQ-IR-001). Retention is configurable per telemetry class; process, user and network telemetry are minimized and short-lived by default while security-state history is retained for audits.

• Collector API v1 reference
  Request/response shapes for the collector-facing API v1 endpoints: enroll, heartbeat and observations, plus tenant/site binding rules and error codes.
• What the v0.1 collector does today
  A plain list of what the native v0.1 collector supports right now versus what is designed but not yet active, and what the DEV build badge means.
• Collector health states explained
  Healthy, Degraded, Offline, Enrollment Pending, Update Required and Revoked — what each state means and what to check.