Custom collectors use the output of content execution to gather specific data from managed endpoints.
The collector parses content output as records of comma-separated values data. Then, it matches the fields in the records to the output fields defined for the collector, in order of appearance.
The supported custom collector's output format date is "YYYY-MM-DD hh:mm:ss" and is displayed in UTC time zone.
If a collector's content executes the following lines:
echo "value1","value2" echo "value3","value4"
Trellix EDR maps "value1" and "value3" to the first output field, and "value2" and "value4" to the second output field, like this:
Output field 1 | Output field 2 |
|---|---|
value1 | value2 |
value3 | value4 |