Press CTRL+K to open search

Collect system specific information from Endpoints

  • Published on Aug 17, 2026
  • 2 minute(s) read
Prev Next

Create and apply a policy that actively gathers hardware, software, and configuration details from your managed systems.

  1. Create a Collect Data policy

    1. Log on to your Trellix ePO - On-prem console.

    2. Navigate to Systems → Policy Catalog.

    3. For the Product, select System Information Reporter → General.

    4. Click New Policy to open the new policy dialog box.

    5. Select an existing policy to duplicate, give the new policy a name, and click OK. The policy configuration wizard is displayed.

  2. Configure General system properties

    1. In the policy wizard, navigate to the General tab.

    2. Select the checkboxes for the system information you want to collect. The options are:

      • USB devices: Gathers details of USB device drivers on the node.

      • Installed Network cards: Collects Network Interface Card details.

      • MSI Version: Gathers the Microsoft Windows Installer version.

      • Installed Software: Collects a list of all installed software, including hidden software.

      • Internet Explorer version: Gathers the version and patch level of Internet Explorer.

      • Running processes at property collection: Gathers a list of processes running when the data is collected.

      • Environmental Variables (in SYSTEM context): Collects the values for TEMP, TMP, and SystemRoot.

      • Shares: Collects shared data from the endpoint.

      • Services installed: Gathers a list of all services and their status.

      • Path (in SYSTEM context): Collects the system's Path variable value.

      • NullSession shares and pipes: Gathers the list of defined NullSession Pipes and Shares.

      • Installed Hotfixes (relies on Registry only): Collects all installed Microsoft updates.

    3. Click Save.

  3. Configure custom data collection

    1. Navigate to the Custom tab.

    2. To collect a custom environment variable, enter its name in the "Get value of custom environment variable" field.

    3. To collect a registry value, enter the full key path into the "Query Registry Values" field and click Add to list.

    4. To enable detailed logging for troubleshooting, select the Enable logging checkbox. This creates a SIRService.log file on the endpoint.

      Note

      This log file contains sensitive registry information and should only be enabled for troubleshooting purposes.

  4. Configure file searches

    1. Navigate to the Find File tab.

    2. Select a folder from the drop-down list and type the file name you want to search for. You can use wildcards (For exmaple, *.exe). This search will find the file and determine its version and SHA-256 hash (if available).

    3. Click Add to list.

    4. Click Save.

:
Related articles