What it collects
From the Triage tab or a playbook's collect step, the agent gathers in one pass:
| Windows | Linux |
|---|---|
| Active network connections and listening ports | Active connections and listening sockets |
| Scheduled tasks | cron entries and systemd timers |
| Services and their state | Process tree |
| Run-key autoruns | Recent logins |
| Microsoft Defender state and recent detections | authorized_keys for every user |
| Logged-on users | Recently created files in temporary locations |
| Installed packages and loaded kernel modules |
The result is attached to the alert or case as a triage package and can be opened in the console or downloaded.
Security Tool Availability
Separately from triage, the agent continuously checks the required security tools listed in the fleet policy, for example that Sysmon is running and that the endpoint protection service is up. When a tool goes down it emits tool.down; when it returns, tool.restored. Both appear in the Logs and can drive a detection: a host whose protection stopped minutes before a suspicious process is a story worth telling.