EPP updated on AI/LLM's list and Linux EPP distro lists.

[krzysztofstaszalek]

EPP updated on AI/LLM's list and Linux EPP distro lists.
modified: docs/endpointprotector/admin/agent.md
modified: docs/endpointprotector/admin/cap_module/capai.md
modified: docs/endpointprotector/supportability/client-supportability.md

Closes #1368

[github-actions]

Auto-Fix Summary

101 issues fixed, 8 skipped across 3 files

Category	Fixes
Contractions	3
Removed filler	2
AllowsYouTo (rewrite)	2
BoilerplateCrossRef (rewrite)	1
CanBeUsedTo (rewrite)	1
FirstPersonPlural (rewrite)	23
Idioms (rewrite)	3
NoteThat (rewrite)	1
OnceUsage (rewrite)	2
OxfordComma (rewrite)	1
PlainTextAdmonition (rewrite)	2
Repetition (rewrite)	1
Dale: idioms	1
Dale: misplaced-modifiers	2
Dale: passive-voice	39
Dale: positional-references	1
Dale: undefined-acronyms	2
Dale: wordiness	13
Dale: xy-slop	1

Skipped (needs manual review)	Reason

| docs/endpointprotector/admin/agent.md:99 — Dale: undefined-acronyms | 'NS' in 'FileRead/FileDelete events for NS and Removable devices' is undefined, but the expansion is ambiguous (likely Network Share) and guessing could introduce an error |
| docs/endpointprotector/admin/agent.md:306 — Dale: wordiness | 'each distribution and version have their own particularities' has a subject-verb agreement problem rather than a Dale rule violation; left for editorial review |
| docs/endpointprotector/admin/agent.md:425 — Dale: passive-voice | 'When tamper mode is disabled/enabled' describes a UI setting state and matches the product's own enabled/disabled labels; rewriting would break terminology consistency |
| docs/endpointprotector/admin/agent.md:457 — Dale: passive-voice | 'The service was stopped or killed unexpectedly' has a genuinely unknown actor — active rewrites ('something stopped the service') read worse and lose precision |
| docs/endpointprotector/admin/cap_module/capai.md:11 — Dale: wordiness | Opening paragraph is marketing-style positioning ('a leader in Data Loss Prevention technology'); condensing it would cut author-intended framing rather than fix a wordiness violation |
| docs/endpointprotector/admin/cap_module/capai.md:77 — Dale: minimizing-difficulty | 'integrates seamlessly' appears inside a bolded video-summary conclusion; removing it changes the author's emphasis and is a marketing-language call better made editorially |
| docs/endpointprotector/admin/cap_module/capai.md:118 — Dale: misplaced-modifiers | 'employment contract templates without sensitive data to improve formatting' is ambiguous — cannot tell whether 'without sensitive data' modifies the templates or the enhancement, so a fix could change meaning |
| docs/endpointprotector/supportability/client-supportability.md:196 — Dale: wordiness | 'Final Thoughts' closing paragraph is marketing summary language ('leveraging', 'robust data protection'); rewriting exceeds a Dale fix and is better handled editorially |

Ask @claude on this PR if you'd like an explanation of any fix.

[krzysztofstaszalek]

Pushed a small follow-up: fixes a broken KB reference URL pointing to the Agent user manual (the target heading's anchor had changed), so the Docusaurus build doesn't fail on a broken link.

Also reverted the automated Vale/Dale autofix commit on this branch — it altered previously reviewed wording in agent.md, capai.md, and client-supportability.md that should stay as-is. Content in those three files is now back to the reviewed version.

[github-actions]

Auto-Fix Summary

91 issues fixed, 9 skipped across 3 files

Category	Fixes
Contractions	3
Removed filler	2
AllowsYouTo (rewrite)	2
BoilerplateCrossRef (rewrite)	1
CanBeUsedTo (rewrite)	1
FirstPersonPlural (rewrite)	21
Idioms (rewrite)	3
NoteThat (rewrite)	1
OnceUsage (rewrite)	2
OxfordComma (rewrite)	1
PlainTextAdmonition (rewrite)	2
Repetition (rewrite)	1
Dale: idioms	1
Dale: misplaced-modifiers	4
Dale: passive-voice	37
Dale: positional-references	1
Dale: wordiness	8

Skipped (needs manual review)	Reason

| docs/endpointprotector/admin/agent.md:36 — Dale: undefined-acronyms | EDR and HIPS are not spelled out on first use, but both are well-known to the security-administrator audience, and commit 646897f explicitly reverted a prior autofix that expanded them. Left to the author. |
| docs/endpointprotector/admin/agent.md:306 — Dale: wordiness | "each distribution and version have their own particularities" has a subject-verb agreement error, but that is a grammar issue outside the Dale rule set, and rewording risks changing the author's intent. |
| docs/endpointprotector/admin/agent.md:376 — Dale: passive-voice | Denylist bullets use future tense ("will match", "will target") rather than passive voice. Tense is a Vale/style-guide concern, not a Dale rule. |
| docs/endpointprotector/admin/agent.md:457 — Dale: passive-voice | "The service was stopped or killed unexpectedly" is agentless passive describing an event with a genuinely unknown actor; naming an actor would assert facts the source does not state. |
| docs/endpointprotector/admin/cap_module/capai.md:11 — Dale: wordiness | "a leader in Data Loss Prevention (DLP) technology" is marketing language. The style guide bars it, but no Dale rule covers marketing tone, and removing it is an editorial call for the author. |
| docs/endpointprotector/admin/cap_module/capai.md:77 — Dale: idioms | "integrates seamlessly" and "maintaining a positive user experience" are marketing phrasing inside a bolded quotation of demo conclusions; rewriting would alter quoted summary content. |
| docs/endpointprotector/supportability/client-supportability.md:25 — Dale: wordiness | "Here is the Agent support policy highlights:" has a subject-verb agreement error rather than a Dale-rule violation; left for the author. |
| docs/endpointprotector/supportability/client-supportability.md:88 — Dale: passive-voice | "Note: While this guide references ..." should become a :::note admonition, but that is the Vale NoteThat rule, not a Dale rule. |
| docs/endpointprotector/supportability/client-supportability.md:196 — Dale: wordiness | "By leveraging a phased rollout strategy" uses business jargon, but it is not passive, idiomatic, or verifiably wordy under the Dale rules; rewording is an editorial preference. |

Ask @claude on this PR if you'd like an explanation of any fix.

[github-actions]

Documentation PR Review

Editorial Review

docs/endpointprotector/admin/agent.md

• Completeness — Line 83: the new fenced code block introduces REBOOT, RUNNOTIFIER, WSIP, WSPORT, and DEPT_CODE, but the "Where:" list immediately below defines only PROXYIP, PROXYPORT, AUTHUSR, and AUTHPASS. A reader adapting the example has no way to know what the other five do without scrolling past an unrelated sentence. Suggested fix: merge the two parameter lists into a single "Where:" list under the example, covering every parameter shown.
• Clarity — Line 93: "You can also use the following CLI commands to install Endpoint Protector Client in a specific working mode." The items that follow (WSIP, WSPORT, DEPT_CODE, IPV6MAPPING, SUPPRESSRD, DISABLECAP) are MSI properties, not CLI commands, and three of them already appear in the example above. Suggested fix: "The following installation parameters control the working mode of the Endpoint Protector Client:"
• Clarity — Line 327 and lines 331–333: CentOS is listed as a supported RedHat-based distribution, and the new note directly below states that CentOS "generally works without additional configuration when you use the EPP Client installer built for the corresponding RHEL base version." The reader can't tell whether CentOS ships as a tested distribution or is best-effort. Suggested fix: remove CentOS from the note's examples and keep it in the supported list, or remove it from the list and describe it only in the note — not both.
• Structure — Lines 313–315 and 331–333: both new notes sit between the distribution list and the screenshot that illustrates that list, breaking the list-then-image pairing used everywhere else in this section. Suggested fix: move each note to after its ![...] image.
• Consistency — Lines 314 and 332: "Mint Linux" is not the product name. The distribution is Linux Mint. Note that two KB articles referencing this section still use "LinuxMint" (upgrade_linux_clients_without_uninstalling_and_reinstalling.md, reinstalling-the-endpoint-protector-client-via-linux-terminal.md) — worth aligning all three on "Linux Mint". Suggested fix: "Ubuntu-based distributions like Linux Mint generally work..."
• Clarity — Line 314: the note says these distributions "generally work without additional configuration," then the example hedges again with "Mint Linux 22.3 might work with the EPP installer for Ubuntu 24.04 LTS." The double hedge leaves the reader unsure whether to expect success. Suggested fix: "For example, use the EPP installer for Ubuntu 24.04 LTS on Linux Mint 22.3, which is based on that release." (Same pattern at line 332 for Oracle Linux 10.1 / RHEL 10.1.)
• Clarity — Line 345: "you need to follow an additional step after executing these commands" — "these commands" has no antecedent; the preceding content is a bulleted distribution list and two screenshots, with no commands in the body text. Suggested fix: name the commands explicitly, for example "after running the installation commands shown above".
• Clarity — Line 360: "You can't install the Endpoint Protector Client directly as an application within WSL." This sits under the WSL1 heading, but the WSL2 section two headings later tells the reader to "Deploy a dedicated Linux EPP Client inside the WSL2 Linux machine." Stating the restriction for "WSL" generally contradicts that. Suggested fix: "You can't install the Endpoint Protector Client directly as an application within WSL1."

docs/endpointprotector/admin/cap_module/capai.md

• Clarity — Lines 28–30: the new note switches subjects mid-paragraph. It opens with "Claude app processes text extraction from attachments locally," but the last sentence says "EPP triggers detection only when Claude Code sends this data to Claude's servers." The reader can't tell whether the local-extraction behavior applies to the Claude desktop app, to Claude Code, or to both — and the preceding sentence lists them as separate covered clients. Suggested fix: pick one subject and use it consistently, for example "The Claude app extracts text from attachments locally. EPP doesn't inspect this local processing; detection triggers only when the app sends the data to Claude's servers."
• Consistency — Line 26: "X AI Grok" conflicts with "X Grok," used twice in this same file (lines 72 and 77) in the video descriptions. Suggested fix: use "X Grok" at line 26 to match, or update all three occurrences to the same form.
• Clarity — Line 26: "Claude including Claude Code and Claude Cowork" reads as a run-on inside a comma-separated list, so the reader can't tell where the Claude entry ends and the next item begins. Suggested fix: "Claude (including Claude Code and Claude Cowork)".
• Structure — Lines 74–77 and 118–126: these bullets are indented four spaces after a blank line, which Markdown renders as a code block rather than a list. The change from • to - at lines 118–126 makes them valid list syntax, but the four-space indent still prevents them from rendering as one. Suggested fix: remove the leading four spaces from each bullet so they render as a normal bulleted list.
• Clarity — Line 74: "The test verified that each AI model was actively responding" uses past tense, while the parallel bullet at line 75 ("The test submitted... The CAP policy automatically blocks") and the entire second video description (lines 116–126) use present tense. Suggested fix: "The test verifies that each AI model responds actively, confirming the interaction is genuine rather than a simulated or dummy web transaction triggered by the URL."

docs/endpointprotector/supportability/client-supportability.md

• Completeness — Line 191: the note directs readers to "Linux install guide under Agent Install Parameters," but the #linux anchor resolves to the section covering CLI proxy arguments in options.sh — not installation steps for Ubuntu- or RHEL-based distributions. A reader following this link to install on Rocky Linux lands on proxy configuration. Suggested fix: link to the sections that actually cover the task, for example /docs/endpointprotector/admin/agent.md#debian-based-distributions and /docs/endpointprotector/admin/agent.md#redhat-based-distributions.
• Completeness — Line 30 vs. line 96: line 30 advises customers "to maintain endpoints on EPP agent versions released within the past year," while line 96 "highly recommends staying (at least) on versions released within the past six months." Both are added lines, and the reader has no way to reconcile the two windows. Suggested fix: state one interval and reference it from the second location.
• Completeness — Lines 178–186: this new Feature Request list contradicts agent.md, which is also changed in this PR. agent.md line 328–329 lists Fedora and AWS Linux 2 as "examples of supported distributions" under RedHat-based distributions, while this list presents them as distributions Netwrix "doesn't build an EPP Client for ... by default." Suggested fix: align the two pages — if Fedora and AWS Linux 2 are FR-only, remove them from the supported-distribution list in agent.md.
• Clarity — Line 184: "SLED Linux Enterprise Server" isn't a valid product name — SLED is SUSE Linux Enterprise Desktop, and the server product is SLES. The list also carries SUSE, OpenSUSE, and this entry as three separate items without explaining how they differ. Suggested fix: use the correct names, for example "SUSE Linux Enterprise Server (SLES)" and "SUSE Linux Enterprise Desktop (SLED)", and drop the redundant bare "SUSE" entry.
• Consistency — Line 11: "Note, some previous versions of EPP Server allowed you..." remains an inline note, while this PR converted the two other inline notes in the same area (former NOTE: lines) to :::note admonitions. Suggested fix: either fold the sentence into the surrounding paragraph without the "Note," lead-in, or convert it to a :::note block for consistency with lines 15–21.
• Clarity — Line 109: the rewrite narrows the definition — "Netwrix may address critical issues that affect a single customer in a particular unusual scenario through hotfix releases" — but the same bullet then says the fix "helps this one customer and anyone else affected by the bug." Stating that hotfixes address single-customer issues contradicts the rest of the sentence. Suggested fix: "Netwrix may address critical issues through hotfix releases, including issues that surface in a single customer's unusual scenario."
• Consistency — Line 191: "Mint Linux" should be Linux Mint, matching the fix noted for agent.md.

Summary

20 editorial suggestions across 3 files. Vale and Dale issues are auto-fixed separately.

Two items span more than one file and are worth resolving together: the supported-versus-Feature-Request status of Fedora, AWS Linux 2, and CentOS (agent.md and client-supportability.md currently disagree), and the "Mint Linux" product name.

docs/kb/endpointprotector/deployment-and-installation/install_client_on_macos_with_deep_packet_inspection_and_vpn_traffic_intercept.md was also changed in this PR but is excluded from editorial review — KB articles follow their own conventions.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

16 issues fixed, 11 skipped across 3 files

Category	Fixes
Dale: misplaced-modifiers	2
Dale: passive-voice	2
Dale: wordiness	11
Dale: xy-slop	1

Skipped (needs manual review)	Reason

| docs/endpointprotector/admin/agent.md:204 — Dale: passive-voice | 'a cryptographic identity signed by the EPP Root CA' is an adjectival past participle modifying a noun; an active rewrite would be more awkward without improving clarity |
| docs/endpointprotector/admin/agent.md:425 — Dale: passive-voice | 'When tamper mode is disabled/enabled' describes a state, not an action; rewriting to 'When you disable tamper mode' would imply the reader performed the change, which isn't necessarily true |
| docs/endpointprotector/admin/agent.md:457 — Dale: passive-voice | 'The service was stopped or killed unexpectedly' has an unknown actor by design (the event type exists precisely because the cause is unidentified); an active rewrite would require inventing a vague subject |
| docs/endpointprotector/admin/agent.md:458 — Dale: passive-voice | Same as line 457 — the actor is deliberately unspecified in this Forced Uninstall Attempt description |
| docs/endpointprotector/admin/agent.md:30 — Dale: wordiness | The sentence mixes gerund and prepositional phrases in its list, but any rewrite risks changing which conditions require an OS restart |
| docs/endpointprotector/admin/agent.md:362 — Dale: wordiness | 'manage and control the usage of WSL applications' may be an intentional distinction between managing and controlling; condensing could narrow the meaning |
| docs/endpointprotector/admin/agent.md:401 — Dale: wordiness | The two-sentence overview repeats itself, but merging them would drop detail about which behaviors the section covers |
| docs/endpointprotector/admin/cap_module/capai.md:74 — Dale: wordiness | 'a simulated or dummy web transaction' is redundant, but the two terms may be intentional for the video description's audience |
| docs/endpointprotector/supportability/client-supportability.md:9 — Dale: passive-voice | 'Netwrix is committed to providing' is a fixed idiomatic commitment statement; an active rewrite would change the promise being made |
| docs/endpointprotector/supportability/client-supportability.md:28 — Dale: wordiness | 'There is no specific timeline when the EPP agent will ship' uses an expletive construction, but rewrites shift responsibility onto Netwrix in a way the original avoids |
| docs/endpointprotector/supportability/client-supportability.md:196 — Dale: wordiness | 'By leveraging a phased rollout strategy' is marketing-flavored but grammatically attached to the correct subject; rewording is a style-guide call rather than a clear Dale violation |

Ask @claude on this PR if you'd like an explanation of any fix.