Skip to main content
Oso integrates with your EDR (Endpoint Detection and Response) platform to discover what AI agent software is installed across your fleet. This lets you find unsanctioned agents before they’re used, without waiting for network traffic to appear.

​
How it works

  1. Connect your EDR: provide a read-only API key to your EDR platform. Oso uses this to pull data from your endpoints.
  2. Scanning: Oso queries your EDR for managed devices and looks for known agent software from the agent catalog, including desktop apps, CLI tools, and background processes. The first scan starts shortly after the integration is connected, and Oso re-scans every 12 hours. Scans can also be triggered on demand from the Oso settings page.
  3. Inventory updates: discovered agents appear in the inventory after each scan.

​
What it detects

Oso scans for agent binaries, NPM packages, and OS-packaged software across known installation paths:

​
Desktop apps

Claude Desktop, Cursor, Antigravity, OpenClaw, Microsoft Copilot, GitHub Copilot, Kiro, Windsurf

​
CLI tools

Claude Code, Codex, Gemini CLI

​
Supported EDR platforms

Support for additional EDR platforms is planned. If you use a platform not listed here, reach out to us to discuss your needs.
If you use Jamf or another MDM to manage devices, you can use it to deploy Oso alongside EDR-based discovery. See Managed Deployment.

​
What appears in the inventory

Agents discovered via EDR appear in the same agent inventory as browser and proxy-discovered agents:
ColumnDescription
AgentThe agent name and environment type (Terminal, Desktop)
DevicesWhich devices the agent was found on
UsersUsers associated with those devices
Last SeenWhen the agent was last detected on the endpoint
The detection source shows the EDR name (e.g. “CrowdStrike”, “SentinelOne”) so you can distinguish it from browser extension or proxy discoveries.

​
EDR vs. other discovery methods

Other discovery methods (edge proxy, browser extension) detect agents when they generate network traffic. EDR detects agents when they are installed, even if they have never been launched. EDR discovery does not include session content. To monitor what agents are doing inside their sessions, route their traffic through the edge proxy or use the browser extension.