Findings
Generator
Configuration
Lucidum Reverse
Architecture
Statistics
← All Findings
Vendor:
CyberArk Endpoint Privilege Manager
FIN-758
Weight:
5
4
3
2
1
Confidence:
High
Medium
Low
Edited:
2026-03-27 16:10
Not Verified
What It Detects
Endpoint has a CyberArk EPM agent in an Inactive state. Unlike a Disconnected agent, an Inactive agent is recognized by the EPM server but has stopped actively communicating or enforcing policies. This may indicate the agent service has been stopped, the endpoint is powered off for an extended period, or the agent has been tampered with.
MITRE ATT&CK Techniques
Comma-separated, e.g. T1078, T1190
Checks
read-only
Field
Operator
Value
Connectors
equals
CyberArk
Status
equals
Inactive
Remediation
×
×
×
×
×
+ Add item
Why It Matters
×
×
×
×
+ Add item
Save Changes
Export Lucidum