> ## Documentation Index
> Fetch the complete documentation index at: https://www.osohq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EDR

> Discover AI agents installed on employee devices via your EDR platform.

Oso integrates with your EDR (Endpoint Detection and Response) platform to discover what AI agent software is installed across your fleet. This lets you find unsanctioned agents **before** they're used, without waiting for network traffic to appear.

## How it works

1. **Connect your EDR**: provide a read-only API key to your EDR platform. Oso uses this to pull data from your endpoints.
2. **Scanning**: Oso queries your EDR for managed devices and looks for known agent software from the [agent catalog](/oso-for-agents/shadow-ai), including desktop apps, CLI tools, and background processes. The first scan starts shortly after the integration is connected, and Oso re-scans every 12 hours. Scans can also be triggered on demand from the Oso settings page.
3. **Inventory updates**: discovered agents appear in the inventory after each scan.

## What it detects

Oso scans for agent binaries, NPM packages, and OS-packaged software across known installation paths:

### Desktop apps

Claude Desktop, Cursor, Antigravity, OpenClaw, Microsoft Copilot, GitHub Copilot, Kiro, Windsurf

### CLI tools

Claude Code, Codex, Gemini CLI

## Supported platforms

### EDR

* [**CrowdStrike**](/oso-for-agents/integrations/edr/crowdstrike)
* [**SentinelOne**](/oso-for-agents/integrations/edr/sentinelone)

### MDM

* **JAMF**

<Note>
  Support for additional EDR and MDM platforms is planned. If you use a platform not listed here, [reach out to us](https://www.osohq.com/meet-the-oso-founder-ceo) to discuss your needs.
</Note>

## What appears in the inventory

Agents discovered via EDR appear in the same [agent inventory](/oso-for-agents/shadow-ai) as browser and proxy-discovered agents:

| Column        | Description                                             |
| ------------- | ------------------------------------------------------- |
| **Agent**     | The agent name and environment type (Terminal, Desktop) |
| **Devices**   | Which devices the agent was found on                    |
| **Users**     | Users associated with those devices                     |
| **Last Seen** | When the agent was last detected on the endpoint        |

The detection source shows the EDR name (e.g. "CrowdStrike", "SentinelOne") so you can distinguish it from browser extension or proxy discoveries.

## EDR vs. other discovery methods

Other discovery methods (edge proxy, browser extension) detect agents when they generate network traffic. EDR detects agents when they are **installed**, even if they have never been launched.

EDR discovery does not include session content. To monitor what agents are doing inside their sessions, route their traffic through the [edge proxy](/oso-for-agents/integrations/edge-proxy) or use the [browser extension](/oso-for-agents/integrations/browser-extension).