What is Endpoint Truthfinder?

A free open tool that checks whether directory inventory hosts are checking in to your endpoint sensor. Presence and freshness only — not posture.

Can I run Truthfinder without Python?

Yes. Use Truthfinder.exe (Windows) or truthfinder-linux-x86_64.bin (Linux). Source zip is optional.

Why does Windows SmartScreen warn about Truthfinder.exe?

The Windows build is unsigned. Verify the SHA-256 on this page, then More info → Run anyway if you trust it.

What do PRESENT, STALE, ABSENT, UNKNOWN, and ERROR mean?

PRESENT: found, recent check-in. STALE: found, check-in too old. ABSENT: queried, host not there. UNKNOWN: could not query (not wired / missing setup) — never invents PRESENT. ERROR: query failed.

Are the scorecard screenshots a customer environment?

No. Most rows are EXAMPLE (sample/mock). Only LIVE rows are a real API.

Is the Windows build code-signed?

No. The public Windows build is unsigned.

How do I send feedback?

Email info@senninsecurity.com with [Truthfinder] in the subject. No secrets. No paid support on this free tool.

Endpoint Truthfinder

Checks whether computers in your directory inventory are actually checking in to your endpoint sensor.

Version 0.3.0 · Free · Native Windows exe and Linux binary (no Python) · Source zip optional

Directory inventory and endpoint sensor lists drift apart. Truthfinder reconciles them into a plain scorecard: matches, gaps, and stale check-ins.

Vendor-agnostic connectors: CrowdStrike Falcon is live; Microsoft Defender for Endpoint, SentinelOne, Tanium, Trellix, Wazuh, Fleet (osquery), Velociraptor, and Elastic Fleet ship for sample demos or your own read-only API credentials. Unwired sources stay UNKNOWN — never invents PRESENT.

How to read the scorecard

Scorecard status meanings
Status	Meaning
PRESENT	Found, and the last check-in is recent enough
STALE	Found, but the last check-in is too old
ABSENT	The system answered, and this host is not there
UNKNOWN	We could not query this source (missing setup or not wired yet). We will not invent a PRESENT result
ERROR	We tried and failed (login, network, or parse problem)

Example output

Lab screenshots. Most rows are EXAMPLE (sample/mock — pink badges). Only green LIVE rows are a real API. Not a customer multi-EDR estate.

Example Truthfinder multi-connector scorecard with EXAMPLE and LIVE mode labels — Multi-connector scorecard (0.2.1) — EXAMPLE vs LIVE labeled.

Example endpoint-sensor row on the scorecard — Endpoint sensor row.

Example directory row on the scorecard — Directory row.

Example fleet reconcile scorecard — Fleet reconcile view.

Download

Windows: Build is unsigned. SmartScreen may say “Windows protected your PC.” Expected. Verify SHA-256 below; if it matches and you trust this checksum, choose More info → Run anyway.

Download Windows Truthfinder.exe

Windows SHA-256
ab8e44442ed2935f5ec0af90a2cd2c3ad0fe885bf4cbd195433902181de2bd78

Checksum file: Truthfinder.exe.sha256

certutil -hashfile Truthfinder.exe SHA256
:: PowerShell: Get-FileHash .\Truthfinder.exe -Algorithm SHA256

Download Linux binary

Linux SHA-256
b4486bc4e9e3797eb90eb51e05a115f0827b81eb17a8d80f7a82bcc6596bfff8

Checksum file: truthfinder-linux-x86_64.bin.sha256

chmod +x truthfinder-linux-x86_64.bin
sha256sum -c truthfinder-linux-x86_64.bin.sha256

Prefer source? Use the 0.2.1 zip (venv + ./etc / etc.cmd).

Download source zip 0.2.1

Source zip SHA-256
0981d1561ceb733f3ad186a25e4756399427629adf9d96da009cbba746f7bf3e

Checksum file: endpoint-truthfinder-0.2.1.zip.sha256

Quick start

Verify SHA-256, then run check --help. Put API credentials in a local .env beside the binary — never shipped inside it. Docs: source zip docs/INDEX.md.

Windows (Truthfinder.exe)

certutil -hashfile Truthfinder.exe SHA256
Truthfinder.exe check --help

Linux (native binary)

chmod +x truthfinder-linux-x86_64.bin
sha256sum -c truthfinder-linux-x86_64.bin.sha256
./truthfinder-linux-x86_64.bin check --help

Source zip — Unix (Linux / macOS)

unzip endpoint-truthfinder-0.2.1.zip
cd endpoint-truthfinder-0.2.1

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt

./etc check --help
# or: .venv/bin/python endpoint_truth_check.py check --help

Source zip — Windows

tar -xf endpoint-truthfinder-0.2.1.zip
cd endpoint-truthfinder-0.2.1

python -m venv .venv
.venv\Scripts\pip install -r requirements.txt

etc.cmd check --help
:: or: .\etc.ps1 check --help
:: or: python endpoint_truth_check.py check --help

Directory lookup is optional (honest fixture until wired). Pink EXAMPLE = sample/mock; green LIVE = real API. Keep .env out of git; never paste secrets into email.

Version history

0.3.0 — 2026-09-14 · Native Truthfinder.exe + truthfinder-linux-x86_64.bin (unsigned Windows; verify SHA-256). EXAMPLE vs LIVE unchanged; no secrets in binary. Document Look v1b page chrome. Source zip 0.2.1 still available.

Download: Truthfinder.exe · Windows SHA-256 · truthfinder-linux-x86_64.bin · Linux SHA-256 · source zip 0.2.1

0.2.1 — 2026-09-10 · EXAMPLE mode clarity for sample/fixture rows. endpoint-truthfinder-0.2.1.zip · SHA-256

0.2.0 — 2026-09-10 · Multi-vendor connectors; Windows launchers. endpoint-truthfinder-0.2.0.zip · SHA-256

0.1.0 — 2026-09-10 · First public pack. endpoint-truthfinder-0.1.0-prefer0.zip · SHA-256

Feedback

Email info@senninsecurity.com with subject [Truthfinder]

No paid support on this free tool. Never paste secrets, passwords, tokens, or tenant dumps.

FAQ

What is it?
Free open tool: are directory hosts checking in to your endpoint sensor? Presence/freshness only — not posture.

Does presence mean ready?
No. Presence is not readiness.

Python required?
No. Use Truthfinder.exe or truthfinder-linux-x86_64.bin. Source zip optional.

Why SmartScreen / is it signed?
Windows build is unsigned. Verify SHA-256 here, then More info → Run anyway if you trust it.

Status meanings?
See the scorecard table above.

Are screenshots a customer estate?
No. Most rows EXAMPLE (sample/mock); only LIVE is a real API.

Feedback?
info@senninsecurity.com, subject [Truthfinder]. No secrets.