Create a custom collector

You can specify what data to collect from endpoints with custom collectors.

Select Menu → Catalog.
Click the Collectors tab, then click + Add to open the New Collector page.
Enter a name and description for the collector.
For Windows, Linux, macOS tabs, insert the collector's content.
1. Use the Type drop-down list to select the appropriate content type.
  Note
  Make sure Python is installed on the endpoint for custom collector type Python to work. All other collector types need to have an interpreter available on the endpoint system PATH.
2. In the Content code editor, enter the commands or code that Trellix EDR executes on managed endpoints.
Note
Add content to Windows, Linux, and macOS tabs to run the collector on Windows, Linux, and macOS managed endpoints.
Click + Add to add an output field.
Enter a name for the field.
From the Type drop-down list, select a type for the field's data.
Important
For Time stamp type, use the following date format in the Content code editor: YYYY-MM-DD HH:MM:SS
Select Show by default to make the output field a default field in the Search results table.
Set the Collector Timeout to increase or decrease the default 60-second timeout limit. Increase the timeout limit for collectors that need more time to run.

Click Save to finish.

Tip
If Save is disabled, check for problems in the form fields.

Details

Section	Option	Definition
Actions	Choose Columns	Selects and configures the columns to display in the collector's tab.
	Delete	Removes the collector from the Catalog. Caution This action cannot be undone.
	Edit	Use this option to edit the custom collector.
Collector Summary	Name	Use this box to set the collector name. Note You cannot change a collector's name if it is used by a saved search expression.
Collector Summary	Description	Use this box to set the collector description. Give meaningful names and descriptions to collectors, based on the domain of the collected data, to easily find them in the Catalog.
Collector Content	Windows tab	Use this tab to define the collector's content for endpoints running Windows.
	Linux tab	Use this tab to define the collector's content for endpoints running Linux.
	macOS tab	Use this tab to define the collector's content for endpoints running macOS.
	Type	Selects a supported content type. Note For Python type, make sure Python is installed on the endpoint for custom collector type to work. All other collector types need to have an interpreter available on the endpoint system PATH.
	Convert collector output to UTF-8 encoding	Select this to encode all collector output in UTF-8.
	Content	Use this code box to set the collector's content.
Collector Output	Add Output	Adds an output field for the collector.
	Name	Sets a name to the output field. This is the name of the column in the Search Results table.
	Type	Sets a type to the values in the output field for validation. Note For Time stamp type, use the following date format in the Content code editor: `YYYY-MM-DD HH:MM:SS`
	Show by default	If selected, the output field appears in the search results table when no output fields are specified in the search expression.
	+	Adds an output field.
	-	Deletes an output field.
Collector Timeout	Timeout [sec]	Increases or decreases the timeout limit. Default is 60 seconds.