What it collects
From the Triage tab of the response console, the agent gathers in one pass:
| Windows | Linux |
|---|---|
| Active network connections and listening ports | Active connections and listening sockets |
| Scheduled tasks | cron entries and systemd timers |
| Services and their state | Process tree |
| Run-key autoruns | Recent logins |
| Microsoft Defender state and recent detections | authorized_keys for every user |
| Logged-on users | Recently created files in temporary locations |
| Installed packages and loaded kernel modules |
The result opens in the console. Download it as a snapshot, or attach it to a case.
Security Tool Availability
Separately from triage, the agent continuously checks the required security tools listed in the fleet policy, for example that Sysmon is running and that the endpoint protection service is up. When a tool goes down it emits tool.down; when it returns, tool.restored. Both appear in the Logs and can drive a detection: a host whose protection stopped minutes before a suspicious process is a story worth telling.