Collectors
    Read-only

    Collection

    Collection readiness
    Collectors (14)
    • Application Crash Events
      Built-in
      Checking readiness

      Polls native Windows Event Log, macOS diagnostic reports, or Linux journal evidence for application crashes. The source function returns normalized events; this collector separately selects crash providers and wraps each stable event as temporal evidence.

      Assignment

      0 endpoints · 1 group

      Eligibility

      0 can run

      Agent v0.1.88+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 5m · On Change

      Its assigned groups do not currently contain any endpoints.
      Technical detailsCollector key: builtin_application_crash_events · Data key: application_crash_eventRequired functions: createarray (v0.0.1), createobj (v0.0.1), entity (v0.1.50), systemevents (v0.1.87)
    • Endpoint hardware profile
      Custom
      Checking readiness

      An illustrative custom collector that turns reusable CPU inventory functions into temporal endpoint evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: demo_evidence_pack · Data key: custom_hardware_profileRequired functions: cpu (v0.0.1), createarray (v0.0.1), createobj (v0.0.1)
    • Gather host information
      Built-in
      Checking readiness

      Collects stable host details and authoritative operating-system identity evidence for endpoints.

      Assignment

      0 endpoints · 1 group

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Cron: 0 0 * * * * · On Change

      Its assigned groups do not currently contain any endpoints.
      Technical detailsCollector key: hostinfo · Data key: hostinfoRequired functions: createobj (v0.0.1), hostinfo (v0.0.1)
    • Installed Software
      Built-in
      Checking readiness

      Collects installed software from Windows, Linux and macOS with source diagnostics and scoped coverage. macOS uses bundle names before executable fallback. Linux supports native packages, Snap and Flatpak and requires agent v0.1.113. Windows requires v0.1.112.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Minimum varies by OS
      Latest execution

      Loading runtime status

      Schedule

      Every 1d · On Change · On Receive · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: installed_software · Data key: software_installRequired functions: addkeyvalue (v0.0.1), appxpackageinfo (v0.1.99), appxpackagemanifest (v0.1.103), appxpackagepaths (v0.1.106), appxpackages (v0.1.99), appxpackageusers (v0.1.99), arraycast (v0.1.31), arraystripnulls (v0.1.30), arrayunique (v0.1.106), codesign_info (v0.1.47), createarray (v0.0.1), createobj (v0.0.1), dir_exists (v0.1.6), dir_list (v0.1.6), endswith (v0.1.38), entity (v0.1.50), file_exists (v0.1.6), file_version_info (v0.1.106), get (v0.1.36), getvalueforkey (v0.1.19), hostinfo (v0.0.1), installedsoftware (v0.1.61), isnull (v0.1.20), itematindex (v0.1.42), len (v0.1.27), mergeobjects (v0.0.1), objectrenamekey (v0.1.34), objectstripnulls (v0.1.30), path_info (v0.1.106), plist_read (v0.1.45), readregsubkeys (v0.0.1), readregvalue (v0.0.1), regex_extract (v0.1.49), regex_match (v0.1.49), regkeyexists (v0.1.37), removekeys (v0.0.1), set (v0.1.36), startswith (v0.1.38), tolower (v0.1.40), trim (v0.1.39)
    • Login Sessions
      Built-in
      Checking readiness

      Collects active console, interactive, and remote login sessions for access investigation and session-change evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Agent v0.1.51+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 15m · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_user_sessions · Data key: user_sessionRequired functions: createarray (v0.0.1), createobj (v0.0.1), user_sessions (v0.1.51)
    • Network Interface Inventory
      Built-in
      Checking readiness

      Collects network interface names, addresses, hardware addresses, MTU, and flags for asset inventory and network-change evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_network_interfaces · Data key: network_interfacesRequired functions: createarray (v0.0.1), createobj (v0.0.1), net (v0.0.1)
    • OS Update Snapshot
      Built-in
      Checking readiness

      Collects cache-only operating-system update scan status and applicable update evidence; scan failures remain explicit instead of appearing fully patched.

      Assignment

      0 endpoints · 1 group

      Eligibility

      0 can run

      Agent v0.1.79+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Its assigned groups do not currently contain any endpoints.
      Technical detailsCollector key: builtin_os_update_snapshot · Data key: os_update_snapshotRequired functions: createarray (v0.0.1), createobj (v0.0.1), osupdatesnapshot (v0.1.79)
    • Processor Inventory
      Built-in
      Checking readiness

      Collects processor model, vendor, core topology, clock speed, cache, and microcode for hardware inventory and change evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_processor_inventory · Data key: processor_inventoryRequired functions: cpu (v0.0.1), createarray (v0.0.1), createobj (v0.0.1)
    • Running Processes
      Built-in
      Checking readiness

      Collects running process identity, executable path, owner, command line, parent process, and start time for investigation. This collector can produce higher data volume on busy endpoints.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 30m · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_running_processes · Data key: running_processRequired functions: createarray (v0.0.1), createobj (v0.0.1), processes (v0.0.1)
    • Startup and Virtualization
      Built-in
      Checking readiness

      Collects the endpoint's most recent startup time and whether it is a physical machine, virtual machine, or virtualization host for restart and hosting-context evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1h · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_startup_context · Data key: startup_contextRequired functions: createarray (v0.0.1), createobj (v0.0.1), hostinfo (v0.0.1)
    • Storage Topology
      Built-in
      Checking readiness

      Collects mounted storage devices, filesystems, mount points, and mount options for inventory and configuration-change evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_storage_topology · Data key: storage_topologyRequired functions: createarray (v0.0.1), createobj (v0.0.1), disk (v0.0.1)
    • User Account Inventory
      Built-in
      Checking readiness

      Collects endpoint user accounts and their stable identity, account type, disabled state, and source for access reviews and account-change evidence.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Agent v0.1.51+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: builtin_user_accounts · Data key: user_accountRequired functions: createarray (v0.0.1), createobj (v0.0.1), users (v0.1.51)
    • Windows AppX Software Inventory (Test)
      Custom
      Checking readiness

      Standalone native AppX/MSIX inventory composed from reusable package, manifest and user-registration sources. The editable rule deduplicates visible labels, separates command-line declarations, and reconciles desktop identities only through unique publisher/path/user registry evidence. Native package versions, validated per-user external registrations and executable version resources remain supporting metadata. No product mappings. Requires agent v0.1.108 or newer. Assign only to test endpoints.

      Assignment

      0 endpoints · 0 groups

      Eligibility

      0 can run

      Agent v0.1.108+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1d · On Change

      Assign this collector to an endpoint group before it can run.
      Technical detailsCollector key: windows_appx_software_test · Data key: software_installRequired functions: appxpackageinfo (v0.1.99), appxpackagemanifest (v0.1.103), appxpackagepaths (v0.1.106), appxpackages (v0.1.99), appxpackageusers (v0.1.99), arraystripnulls (v0.1.30), arrayunique (v0.1.106), createarray (v0.0.1), createobj (v0.0.1), entity (v0.1.50), file_version_info (v0.1.106), get (v0.1.36), getvalueforkey (v0.1.19), hostinfo (v0.0.1), isnull (v0.1.20), itematindex (v0.1.42), len (v0.1.27), mergeobjects (v0.0.1), objectstripnulls (v0.1.30), path_info (v0.1.106), readregsubkeys (v0.0.1), readregvalue (v0.0.1), regex_extract (v0.1.49), regex_match (v0.1.49), set (v0.1.36), startswith (v0.1.38), tolower (v0.1.40), trim (v0.1.39)
    • Windows Update History
      Built-in
      Checking readiness

      Local Windows Update installation and uninstallation outcomes, including failures. Last 90 days, up to 200 entries; does not infer current installed state.

      Assignment

      0 endpoints · 1 group

      Eligibility

      0 can run

      Agent v0.1.94+
      Latest execution

      Loading runtime status

      Schedule

      On Receive · On Change · Every 1h · On Change

      Its assigned groups do not currently contain any endpoints.
      Technical detailsCollector key: builtin_os_update_history · Data key: os_update_historyRequired functions: createarray (v0.0.1), createobj (v0.0.1), osupdatehistory (v0.1.94)