Epp 20260910

[krzysztofstaszalek]

Updated debug script, and minor feature description updates.

[bturlea]

Ideally in the external User Guides on the web site I wouldn't want us to expose our "internal kitchen" what we use under the hood.

So I wouldn't mentioned directly mySQL, but instead "RDBMS".
And CrateDB <-> Distributed SQL Database or "Logs Database" which under the hood is a "Distributed SQL Database"

[github-actions]

Auto-Fix Summary

82 issues fixed, 12 skipped across 5 files

Category	Fixes
Dale: formatting	1
Dale: idioms	1
Dale: misplaced-modifiers	7
Dale: passive-voice	55
Dale: undefined-acronyms	1
Dale: wordiness	17

Skipped (needs manual review)	Reason

| docs/endpointprotector/admin/dc_module/globalsettings.md:645 — Dale: undefined-acronyms | MIP/NDC in "including metadata (MIP/NDC)" are undefined, but the intended expansions (Microsoft Purview Information Protection? Netwrix Data Classification?) can't be confirmed from this page |
| docs/endpointprotector/admin/dc_module/globalsettings.md:265 — Dale: undefined-acronyms | SLED is a third-party Linux distribution name; expanding it risks an incorrect product name |
| docs/endpointprotector/admin/dc_module/globalsettings.md:111 — Dale: undefined-acronyms | OTP first appears in a UI setting label ("Mandatory OTP Justification"), and the full term "Offline Temporary Password" appears in the same list item; changing the UI label text would misstate the interface |
| docs/endpointprotector/admin/dc_module/globalsettings.md:110 — Dale: passive-voice | the recurring "if enabled" / "when checked" elliptical openers in the settings lists are established shorthand across this page; expanding every one would bloat the lists without improving clarity |
| docs/endpointprotector/admin/dc_module/globalsettings.md:837 — Dale: wordiness | "file transfers to storage devices (Device Control) to control applications (Content Aware Protection)" is garbled; the intended relationship between the two clauses is ambiguous, so only the surrounding passive constructions were fixed |
| docs/endpointprotector/admin/dc_module/globalsettings.md:156 — Dale: misplaced-modifiers | "you can select from the dropdown list a custom notification" has awkward word order but no genuinely misattached modifier; a reorder is stylistic only |
| docs/endpointprotector/admin/dc_module/globalsettings.md:612 — Dale: wordiness | "Office Files DOCX, XLSX, PPTX, DOC, XLX, PPT)" is missing an opening parenthesis and lists "XLX", which may be a typo for XLS; the correct file-type list can't be confirmed |
| docs/endpointprotector/admin/systemdashboard.md:52 — Dale: wordiness | "You will view more specific dashboards on the Device Control, Content Aware Protection and eDiscovery sections" reads oddly, but whether it means "you can view" or "more specific dashboards appear" is ambiguous |
| docs/endpointprotector/admin/systemdashboard.md:80 — Dale: undefined-acronyms | APNS is undefined, but this is Apple platform terminology rather than a product-specific Netwrix acronym, and the exact expansion Netwrix prefers isn't established elsewhere in the doc set |
| docs/endpointprotector/requirements/client.md:43 — Dale: wordiness | "one of the smallest footprints of any similar solution on the market" is a marketing claim rather than a Dale rule violation; removing it would change the author's intent |
| docs/endpointprotector/requirements/components.md:48 — Dale: undefined-acronyms | "Data Loss Prevention (DLP)" is re-expanded here after being defined at the top of the page; redundant but not a violation, and collapsing it is a judgment call |
| docs/endpointprotector/gettingstarted.md:92 — Dale: wordiness | "Setup eDiscovery Scans" / "Setup User Remediation" should use the verb "Set up", but this is a spelling issue Vale owns, not a Dale rule |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/endpointprotector/admin/dc_module/globalsettings.md

• Structure — Line 996: The new #### Advanced Options section sits after the #### Windows and #### macOS procedures as a third peer heading. A Windows reader who completes the three Windows steps and stops there never learns that the script accepts -dpi and --output. Suggested fix: add a pointer at the end of each OS procedure — "To also collect DPI diagnostics or change the output folder, see Advanced Options." — or move the Advanced Options content above the two OS procedures.
• Completeness — Line 999: "Both scripts delete the destination folder if it already exists and recreate it" is a destructive behavior buried in body prose. A reader who points --output at an existing folder can lose its contents without warning. Suggested fix: pull it into an admonition — :::warning "Both scripts delete the destination folder if it already exists and recreate it. Don't point --output at a folder that holds data you need to keep." :::
• Completeness — Line 986: macOS Step 1 previously offered a DPI-on variant (... _mac.sh 1) and a DPI-off variant; it now shows a single parameterless command with no indication that DPI diagnostics are skipped by default. Line 1016 documents only 1 and 0, so the parameterless form in Step 1 is undocumented. Suggested fix: state the default in Step 1 — "This collects basic logs and configuration only; omitting the parameter is the same as passing 0. To include DPI diagnostics, see Advanced Options." — and note the same for Windows Step 1 (line 972), which has the same gap.
• Clarity — Line 1005: The Windows advanced example is epp_collect_dpi_info.bat -dpi --output="C:\epp_logs", but Step 1 (line 974) invokes the script by its full quoted path. A reader copying the example gets "command not recognized" because the script isn't on the path. Suggested fix: "C:\Program Files\CoSoSys\Endpoint Protector\Resources\epp_collect_dpi_info.bat" -dpi --output="C:\epp_logs"
• Clarity — Line 292: "particularly those like Cisco ANYConnect" stacks two hedges on one example, and the product name is misspelled. Suggested fix: "supports integration with custom VPN and proxy solutions such as Cisco AnyConnect." Also add the missing sentence-ending period after "or later".
• Clarity — Line 307: The rewritten second sentence now reads as a direct contradiction of the first: the warning says disabling Peer Certificate Validation "will not impact Endpoint Protector functionality," then tells the reader to disable it only under one narrow condition. Suggested fix: "Disabling Peer Certificate Validation doesn't affect other Endpoint Protector functionality, but Endpoint Protector stops validating website certificates. Disable it only when an alternative network traffic inspection product, such as a Secure Web Gateway solution, validates website certificates."
• Completeness — Lines 191 and 233: "Endpoint Protector blocks keyboards either when a third keyboard connects to the same computer or after 48 hours" leaves the reader without a starting point for the 48 hours. Suggested fix: name the trigger — "or 48 hours after the Client enters Transparent mode" (confirm the actual trigger with engineering; the same sentence needs the fix in the Panic Mode list at line 233).
• Clarity — Line 66: The note changed from "A machine or service reboot is recommended after enabling this setting" to the imperative "Reboot the machine or restart the service ... for it to take effect," which converts a recommendation into a requirement. If the setting really does need a reboot, say so plainly; if it's still optional, keep it a recommendation. Suggested fix: "This setting takes effect after you reboot the machine or restart the service." (if required) — and confirm which is accurate before merging.

docs/endpointprotector/requirements/components.md

• Clarity — Line 63: The sentence is broken by the edit: "uses a lastest MySQL LTS database that stores configuration data, agent provisioning settings." The list has no conjunction and no second item, and "lastest" is a typo. Suggested fix: "The Endpoint Protector server uses the latest MySQL LTS release to store configuration data and agent provisioning settings. MySQL handles agent registration, policy definitions, entity management, and other provisioning data."
• Completeness — Line 71: The **CrateDB** rewrite dropped the deployment guidance the old "Relational Database Management System" paragraph carried — that you can deploy it as a single node on the EPP server appliance or as a multi-node cluster for high log volumes, and that nodes can be added with minimal downtime. That's the only place on the page a reader sizing a high-volume deployment could find it. Suggested fix: restore the deployment sentences under the CrateDB heading: "You can deploy CrateDB as a single node on the Endpoint Protector (EPP) server appliance or as a multi-node cluster for environments that generate high log volumes. You can add cluster nodes with minimal downtime and availability impact." Also trim the trailing whitespace at the end of the line.
• Completeness — Line 34: Merging the CrateDB and Redis bullets removed Redis from the server-side component list, but Redis is still documented in the migration procedures (install/migrationprocedure/faq.md, troubleshooting.md, migration-legacy-5x.md, migration-current-image.md). A reader who hits Redis there now has no page that says what it is. Suggested fix: if Redis is still part of the architecture, keep its bullet; if it was removed in 2608, say so in the note at line 66 so the migration pages have something to point to.
• Structure — Lines 10–22: The new opening paragraph runs 13 lines and covers five separate topics (client-server model, scale, module list, policy granularity, policy actions, System Departments) before the page reaches its actual subject — the component inventory. System Departments is a delegated-administration feature, not a component, so a reader scanning this page for architecture wouldn't expect it here. Suggested fix: cut the intro to two or three sentences on the server and Client roles, and move the granularity, policy-action, and System Departments material to the product overview page (or link to System Departments from the admin section that covers it).
• Clarity — Lines 14–19: "This architecture delivers full Device Control alongside Content Aware Protection, eDiscovery, and Enforced Encryption" and "scales from small business environments to large, distributed enterprises" read as marketing copy rather than technical description, which the style guide rules out. Suggested fix: "The Server enforces policies for Device Control, Content Aware Protection, eDiscovery, and Enforced Encryption. You can scope each policy globally or to individual users, computers, and groups."
• Clarity — Line 66: "this data now lives in CrateDB instead" is informal. Suggested fix: "CrateDB stores this data instead."

docs/endpointprotector/gettingstarted.md

• Clarity — Lines 9–14: The new first sentence says "across Windows, macOS, and Linux," and the retained sentence four lines later says "connect seamlessly to Windows, Mac, or Linux computers" — the same OS list twice in one paragraph, with "macOS" and "Mac" used inconsistently. Suggested fix: change the later sentence to "These devices connect to any of these computers, increasing the risk of data theft or accidental loss."
• Structure — Lines 71–74: The Content Aware Protection paragraph ends with a sentence about "Content Aware Protection and eDiscovery policies" recognizing third-party classification labels, 12 lines before eDiscovery is introduced at line 86. A reader meeting eDiscovery for the first time here has no idea what it is. Suggested fix: scope the sentence to CAP in this section and add the eDiscovery half to the eDiscovery paragraph at lines 86–90.
• Structure — Lines 49, 66, 86, 165: Each new concept paragraph opens with a link to the module page, and each section still closes with "For more information, see module." The duplicate link adds nothing. Suggested fix: drop the trailing "For more information, see ..." line in the four sections that now open with a linked concept paragraph, or leave the trailing line and make the opening mention plain text.
• Clarity — Lines 67 and 87: "data in motion" and "data-at-rest" are introduced without definition and hyphenated inconsistently between the two sections. The audience includes readers new to DLP. Suggested fix: "data in motion (data being transferred off the endpoint)" and "data at rest (data stored on the endpoint)", and use the unhyphenated form in both places.
• Clarity — Lines 130–133: The heading is "Deploying Agents" but the new paragraph — and the steps below it — call the component the "Endpoint Protector Client." Nothing tells the reader the two are the same thing. Suggested fix: open with "The Endpoint Protector Client (the agent) runs natively on Windows, macOS, and Linux distributions ..."

docs/endpointprotector/requirements/client.md

• Clarity — Lines 9–11: The new intro claims the Client enforces "the same data protection policies regardless of operating system or CPU architecture," which line 33 then contradicts — the Enforced Encryption Client isn't available for Linux. Suggested fix: qualify the claim — "enforcing Device Control, Content Aware Protection, and eDiscovery policies consistently across operating systems and CPU architectures. See Cross-OS Feature Parity for the exceptions."
• Completeness — Line 66: "These CPU figures apply equally to x86 64-bit and ARM64 architectures" singles out CPU, leaving the reader to wonder whether the RAM and bandwidth rows in the same table also hold on ARM64. Suggested fix: "The figures in this table apply equally to x86 64-bit and ARM64 architectures." (or state explicitly which rows differ).

docs/endpointprotector/admin/systemdashboard.md

• Completeness — Line 11: The rewrite dropped the default appliance IP address. The previous sentence stated the default (https://192.168.0.201); the new sentence presents that address as an arbitrary example, so a reader accessing a freshly deployed appliance for the first time has nothing to type. It also repeats line 9, which already says to use the assigned IP address. Suggested fix: "The default Appliance IP address is https://192.168.0.201. If a different address was assigned during deployment, use that address instead."
• Structure — Lines 36–38: The session timeout paragraph sits under the "Configuration Wizard" heading, but the 300-second timeout applies to the whole management console, not just the wizard. A reader looking up session timeout behavior wouldn't scan for it here. Suggested fix: move the paragraph and its note into its own short subsection under "Server Functionality", or add a lead-in clause — "The management console applies a session timeout across all pages, including the wizard: ..."

Summary

21 editorial suggestions across 5 files. Vale and Dale issues are auto-fixed separately.

Two items are worth resolving before merge because they change technical meaning: the broken MySQL sentence at components.md:63, and the removed default appliance IP at systemdashboard.md:11. Two more need a factual confirmation rather than a wording change: whether the Tamper Mode reboot is required or recommended (globalsettings.md:66), and whether Redis is still an architecture component (components.md:34).

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

23 issues fixed, 9 skipped across 5 files

Category	Fixes
OxfordComma (rewrite)	1
Dale: misplaced-modifiers	1
Dale: passive-voice	18
Dale: wordiness	3

Skipped (needs manual review)	Reason

| docs/endpointprotector/admin/dc_module/globalsettings.md:54 — Dale: passive-voice | 'When enabled, EPP Client installation folders have limited access ... daemons macOS' — the sentence also contains an apparent word-order error ('daemons macOS'); rewriting risks changing the technical claim |
| docs/endpointprotector/admin/dc_module/globalsettings.md:109 — Dale: passive-voice | 'if enabled' appears as a fixed pattern across ~20 setting descriptions in this file; rewriting every instance would be a large stylistic rewrite beyond a targeted fix, and the elliptical form is consistent throughout the page |
| docs/endpointprotector/admin/dc_module/globalsettings.md:613 — Dale: passive-voice | 'files copied to MTP devices, by hooking Windows API functions responsible with printing' — the surrounding sentence has independent grammar problems ('responsible with'); a passive-only fix would leave it incoherent and a full rewrite risks changing meaning |
| docs/endpointprotector/admin/dc_module/globalsettings.md:643 — Dale: undefined-acronyms | 'metadata (MIP/NDC)' — likely Microsoft Information Protection and Netwrix Data Classification, but not confident enough to assert the expansions |
| docs/endpointprotector/admin/dc_module/globalsettings.md:674 — Dale: passive-voice | 'The old extensions will soon be deprecated.' — the actor performing the deprecation isn't stated anywhere in the surrounding text |
| docs/endpointprotector/admin/dc_module/globalsettings.md:1007 — Dale: undefined-acronyms | 'WFP' in a parenthetical list — probably Windows Filtering Platform, but expanding it without confirmation risks introducing an error |
| docs/endpointprotector/admin/systemdashboard.md:79 — Dale: undefined-acronyms | 'APNS Certificate' — Apple platform standard rather than a product-specific acronym; borderline against the rule's exclusion list |
| docs/endpointprotector/requirements/client.md:57 — Dale: passive-voice | 'when all modules are enabled, functions are active, and policies are configured for a stress test' — describes a test condition/state rather than an action with an actor; recasting would read less naturally |
| docs/endpointprotector/requirements/components.md:66 — Dale: xy-slop | 'MySQL no longer stores ... this data now lives in CrateDB instead' — genuine before/after release-change statement, not rhetorical negative-positive framing |

Ask @claude on this PR if you'd like an explanation of any fix.