sync: auto-sync from HOWARD-HOME at 2026-07-07 11:15:40

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 11:15:40

.claude/scripts/edr-isolation-watch.sh

@@ -17,7 +17,7 @@ set -uo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 EDR="bash $ROOT/.claude/scripts/py.sh $ROOT/.claude/skills/datto-edr/scripts/edr.py"
 DM="bash $ROOT/.claude/scripts/discord-dm.sh"
-export STATE="$ROOT/.claude/scripts/.edr-watch-state.json"
+export STATE="${STATE:-$ROOT/.claude/scripts/.edr-watch-state.json}"
 TARGET="dev"   # #dev-alerts = Mike + Howard, private
 
 # Pull last 24h of detections (list includes responseData) and emit any NEW
@@ -61,6 +61,10 @@ while IFS='|' read -r aid host org sev rule ts; do
 - Time: $ts
 - This machine was cut off the network by an EDR automated response. Verify it is intended before restoring.
 - Console: https://azcomp4587.infocyte.com  (alert id: $aid)"
+    if [ "${DRY_RUN:-0}" = "1" ]; then
+        printf '[DRY_RUN] would post to #%s:\n%s\n\n' "$TARGET" "$msg"
+        continue
+    fi
     if ! printf '%s' "$msg" | $DM "$TARGET" 2>/dev/null; then
         bash "$ROOT/.claude/scripts/log-skill-error.sh" "edr-isolation-watch" "discord post failed for $host ($aid)" 2>/dev/null || true
     fi

.claude/scripts/register-edr-watcher.ps1

@@ -0,0 +1,45 @@
+# register-edr-watcher.ps1
+# Register the "ClaudeTools - EDR Isolation Watcher" scheduled task on this Windows
+# machine (the same box that runs GPS-RMM-AutoEnroll et al). The task runs
+# edr-isolation-watch.sh every 10 minutes, which polls Datto EDR for hosts auto-
+# isolated by an EDR response and posts each NEW one to #dev-alerts (Mike + Howard).
+#
+# Interim alerting until the GuruRMM EDR webhook integration (Feature 6) lands.
+# Idempotent: -Force replaces any existing task with the same name.
+#
+# Run from an ordinary (non-admin) PowerShell:
+#   powershell -ExecutionPolicy Bypass -File C:\claudetools\.claude\scripts\register-edr-watcher.ps1
+
+$ErrorActionPreference = "Stop"
+$TaskName = "ClaudeTools - EDR Isolation Watcher"
+
+# Bash launcher (mirrors the GPS-RMM-AutoEnroll task action)
+$BashExe = "C:\Program Files\Git\bin\bash.exe"
+if (-not (Test-Path $BashExe)) { Write-Host "[ERROR] Git bash not found at $BashExe" -ForegroundColor Red; exit 1 }
+
+$ScriptPosix = "/c/claudetools/.claude/scripts/edr-isolation-watch.sh"
+$ScriptWin   = "C:\claudetools\.claude\scripts\edr-isolation-watch.sh"
+if (-not (Test-Path $ScriptWin)) { Write-Host "[ERROR] Watcher not found at $ScriptWin" -ForegroundColor Red; exit 1 }
+
+$Action = New-ScheduledTaskAction -Execute $BashExe -Argument "-lc $ScriptPosix"
+
+# Every 10 minutes, indefinitely (10-year duration avoids the MaxValue quirk).
+$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).Date `
+    -RepetitionInterval (New-TimeSpan -Minutes 10) `
+    -RepetitionDuration (New-TimeSpan -Days 3650)
+
+# Run as the current user, only when logged on (needs the interactive vault/env,
+# same posture as the GrepAI watcher). No admin required.
+$Principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType Interactive -RunLevel Limited
+
+$Settings = New-ScheduledTaskSettingsSet `
+    -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
+    -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
+    -MultipleInstances IgnoreNew
+
+Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger `
+    -Principal $Principal -Settings $Settings `
+    -Description "Polls Datto EDR every 10 min for auto-isolated hosts; posts new ones to #dev-alerts. Interim until GuruRMM EDR webhook (Feature 6)." -Force | Out-Null
+
+Write-Host "[OK] Registered scheduled task: $TaskName (every 10 min)" -ForegroundColor Green
+Get-ScheduledTask -TaskName $TaskName | Select-Object TaskName, State | Format-Table -AutoSize