On this page

Antivirus Agent Logs Guide

1. Purpose of this Guide

This artefact proves that all your company’s devices are actively protected by anti-virus or endpoint detection and response (EDR) software. Cyber Essentials demands proof that:

  • Anti-malware tools are installed on every endpoint.

  • Agents are deployed and reporting in.

  • Connection status and updates are monitored.

Think of it as your “shield wall” — showing no device is left exposed.

2. What You Will Submit

You will need:

  • A screenshot from your anti-virus / EDR system showing:

    • A list of protected devices (endpoint inventory).

    • Their status (active, installed, connected, last check-in).

    • Agent version or update status.

  • Examples of suitable systems: Palo Alto Cortex XDR, Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Sophos Central, Kaspersky, Avast Business.

3. How to Collect / Obtain / Generate This Evidence

Palo Alto Cortex XDR (bundled with StrongKeep):

  1. Navigate to PROTECTION > ENDPOINTS in your StrongKeep dashboard

  2. Capture a screenshot showing:

    • Endpoint names, timestamps, and policy actions.

    • Status (Success, Informational, High severity alerts).

    • Agent version.

Microsoft Defender for Endpoint (included with Microsoft 365 Business Premium):

  1. Go to the Microsoft 365 Security & Compliance Center → Endpoints → Device inventory.

  2. Filter the view to show all registered devices.

  3. Capture a screenshot that includes:

    • Device names (showing multiple endpoints)

    • Antivirus/EDR status (Active, Healthy, Not reporting)

    • Last seen or last update time

    • Agent version (if visible)

Sophos Central:

  1. Log in to the Sophos Central Admin Console.

  2. Navigate to Devices.

  3. Take a screenshot showing:

    • Device list with user/hostname

    • Protection status (green ticks for healthy devices)

    • Last check-in time

    • Policy compliance status (enabled, disabled, out of date)

CrowdStrike Falcon:

  1. Log in to the CrowdStrike Falcon Console.

  2. Go to Host Management → Host setup.

  3. Screenshot the table that shows:

    • Hostname / user

    • Sensor version

    • Last seen timestamp

    • Connection status (Online, Offline)

4. Evidence Format

  • Accepted file types: PNG, JPG, PDF.

  • Suggested naming format:
    YourCompanyName_AntivirusAgentLogs_YYYY-MM-DD.png

5. What “Good” Looks Like

  • Visible endpoint names (shows coverage across multiple devices).

  • Agent status (installed, active, last logon, last update).

  • Version number or timestamp (to prove agents are current).

  • Clear evidence of monitoring/alerts (audit logs or dashboards).

Why this matters: auditors want to see that you’re not just relying on “we think it’s installed” — but that there’s proof in the logs.

6. Tips

  • Redact sensitive details (e.g. usernames, hostnames) if needed.

  • Make sure the screenshot is recent — ideally within the last 3 months.

  • Capture enough rows/devices to show broad coverage, not just one machine.