What is Endpoint Truthfinder?

A free open tool that checks whether directory inventory hosts are checking in to your endpoint sensor. Presence and freshness only — not posture.

Can I run Truthfinder without Python?

Yes. Use Truthfinder.exe (Windows) or truthfinder-linux-x86_64.bin (Linux). Source zip is optional.

Why does Windows SmartScreen warn about Truthfinder.exe?

The Windows build is unsigned. Verify the SHA-256 on this page, then More info → Run anyway if you trust it.

What do PRESENT, STALE, ABSENT, UNKNOWN, and ERROR mean?

PRESENT: found, recent check-in. STALE: found, check-in too old. ABSENT: queried, host not there. UNKNOWN: could not query (not wired / missing setup) — never invents PRESENT. ERROR: query failed.

Is the example output a customer environment?

No. Most rows are EXAMPLE (sample/mock). Only LIVE rows are a real API.

Is the Windows build code-signed?

No. The public Windows build is unsigned.

How do I send feedback?

Email info@senninsecurity.com with [Truthfinder] in the subject. No secrets. No paid support on this free tool.

Free tool

Endpoint Truthfinder

Checks whether computers in your directory inventory are actually checking in to your endpoint sensor.

Version 0.3.0 · Free · Native Windows exe and Linux binary (no Python) · Source zip optional

Download Windows Truthfinder.exe Download Linux binary

1
Export your directory list
2
Run Truthfinder
3
Read the scorecard

Directory inventory and endpoint sensor lists drift apart. Truthfinder reconciles them into a plain scorecard: matches, gaps, and stale check-ins.

Vendor-neutral connectors: a leading commercial EDR platform is supported live with your own read-only API credentials, and several other endpoint and directory sources ship with sample data for demos. Sources that are not connected stay UNKNOWN; the tool never invents a PRESENT result.

How to read the scorecard

Scorecard status meanings
Status	Meaning
PRESENT	Found, and the last check-in is recent enough
STALE	Found, but the last check-in is too old
ABSENT	The system answered, and this host is not there
UNKNOWN	We could not query this source (missing setup or not wired yet). We will not invent a PRESENT result
ERROR	We tried and failed (login, network, or parse problem)

Technical details

Downloads and SHA-256 checksums

Windows: Build is unsigned. SmartScreen may say “Windows protected your PC.” Expected. Verify SHA-256 below; if it matches and you trust this checksum, choose More info → Run anyway.

Download Windows Truthfinder.exe

Windows SHA-256
ab8e44442ed2935f5ec0af90a2cd2c3ad0fe885bf4cbd195433902181de2bd78

Checksum file: Truthfinder.exe.sha256

certutil -hashfile Truthfinder.exe SHA256
:: PowerShell: Get-FileHash .\Truthfinder.exe -Algorithm SHA256

Download Linux binary

Linux SHA-256
b4486bc4e9e3797eb90eb51e05a115f0827b81eb17a8d80f7a82bcc6596bfff8

Checksum file: truthfinder-linux-x86_64.bin.sha256

chmod +x truthfinder-linux-x86_64.bin
sha256sum -c truthfinder-linux-x86_64.bin.sha256

Prefer source? Use the 0.2.1 zip (venv + ./etc / etc.cmd).

Download source zip 0.2.1

Source zip SHA-256
0981d1561ceb733f3ad186a25e4756399427629adf9d96da009cbba746f7bf3e

Checksum file: endpoint-truthfinder-0.2.1.zip.sha256

Quick start

Verify SHA-256, then run check --help. Put API credentials in a local .env beside the binary — never shipped inside it. Docs: source zip docs/INDEX.md.

Windows (Truthfinder.exe)

certutil -hashfile Truthfinder.exe SHA256
Truthfinder.exe check --help

Linux (native binary)

chmod +x truthfinder-linux-x86_64.bin
sha256sum -c truthfinder-linux-x86_64.bin.sha256
./truthfinder-linux-x86_64.bin check --help

Source zip — Unix (Linux / macOS)

unzip endpoint-truthfinder-0.2.1.zip
cd endpoint-truthfinder-0.2.1

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt

./etc check --help
# or: .venv/bin/python endpoint_truth_check.py check --help

Source zip — Windows

tar -xf endpoint-truthfinder-0.2.1.zip
cd endpoint-truthfinder-0.2.1

python -m venv .venv
.venv\Scripts\pip install -r requirements.txt

etc.cmd check --help
:: or: .\etc.ps1 check --help
:: or: python endpoint_truth_check.py check --help

Directory lookup is optional (honest fixture until wired). Pink EXAMPLE = sample/mock; green LIVE = real API. Keep .env out of git; never paste secrets into email.

Version history and older downloads

0.3.0 — 2026-09-14 · Native Truthfinder.exe + truthfinder-linux-x86_64.bin (unsigned Windows; verify SHA-256). EXAMPLE vs LIVE unchanged; no secrets in binary. Document Look v1b page chrome. Source zip 0.2.1 still available.

Download: Truthfinder.exe · Windows SHA-256 · truthfinder-linux-x86_64.bin · Linux SHA-256 · source zip 0.2.1

0.2.1 — 2026-09-10 · EXAMPLE mode clarity for sample/fixture rows. endpoint-truthfinder-0.2.1.zip · SHA-256

0.2.0 — 2026-09-10 · Multiple endpoint connectors; Windows launchers. endpoint-truthfinder-0.2.0.zip · SHA-256

0.1.0 — 2026-09-10 · First public pack. endpoint-truthfinder-0.1.0-prefer0.zip · SHA-256

FAQ

What is it?

Free open tool: are directory hosts checking in to your endpoint sensor? Presence/freshness only — not posture.

Does presence mean ready?

No. Presence is not readiness.

Python required?

No. Use Truthfinder.exe or truthfinder-linux-x86_64.bin. Source zip optional.

Why SmartScreen / is it signed?

Windows build is unsigned. Verify SHA-256 here, then More info → Run anyway if you trust it.

Status meanings?

See the scorecard table above.

Is the example output a customer estate?

No. Most rows EXAMPLE (sample/mock); only LIVE is a real API.

Feedback?

info@senninsecurity.com, subject [Truthfinder]. No secrets.

Feedback

Email info@senninsecurity.com with subject [Truthfinder]

No paid support on this free tool. Never paste secrets, passwords, tokens, or tenant dumps.