sync: auto-sync from HOWARD-HOME at 2026-07-07 11:15:40

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 11:15:40

.claude/scripts/edr-isolation-watch.sh

@@ -17,7 +17,7 @@ set -uo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 EDR="bash $ROOT/.claude/scripts/py.sh $ROOT/.claude/skills/datto-edr/scripts/edr.py"
 DM="bash $ROOT/.claude/scripts/discord-dm.sh"
-export STATE="$ROOT/.claude/scripts/.edr-watch-state.json"
+export STATE="${STATE:-$ROOT/.claude/scripts/.edr-watch-state.json}"
 TARGET="dev"   # #dev-alerts = Mike + Howard, private
 
 # Pull last 24h of detections (list includes responseData) and emit any NEW
@@ -61,6 +61,10 @@ while IFS='|' read -r aid host org sev rule ts; do
 - Time: $ts
 - This machine was cut off the network by an EDR automated response. Verify it is intended before restoring.
 - Console: https://azcomp4587.infocyte.com  (alert id: $aid)"
+    if [ "${DRY_RUN:-0}" = "1" ]; then
+        printf '[DRY_RUN] would post to #%s:\n%s\n\n' "$TARGET" "$msg"
+        continue
+    fi
     if ! printf '%s' "$msg" | $DM "$TARGET" 2>/dev/null; then
         bash "$ROOT/.claude/scripts/log-skill-error.sh" "edr-isolation-watch" "discord post failed for $host ($aid)" 2>/dev/null || true
     fi