Create Collection Extensions

Create a collection extension to collect data that SysTrack does not collect by default. The collection extension runs an action on Windows systems. After you save it, you can run it from a sensor with a tool schedule, or manually from Resolve. For an introduction, see Collection Extensions Overview. For the PowerShell commands that a collection extension script uses, see Custom Data Collection with PowerShell.

Prerequisites

• Edit mode on the Collection Extensions tab. To turn it on, click the lock icon at the top right of the page.

• An action created as a collection extension. To create an action, see Create Actions. The collection extension runs only when its action is approved and enabled. See Approve and Enable Actions.

Create a Collection Extension

1. Go to Configure > Tools > Automations and Collection Extensions > Collection Extensions and click Create Collection Extension.

2. From the Supported OS list, select Windows. Collection extensions support only Windows. The list is empty by default, and the field is required.

3. Enter the Name of the collection extension. The name is required, can have 1 to 100 characters, and must be unique among automations and collection extensions. The name cannot contain these characters: ' " ` - ~ ! @ # $ % ^ & * ( ) + = { } [ ] / \ ? | : ; < > , .

4. (Optional) Enter a Description of up to 1,024 characters.

5. Click Select Action. The Select Action for Windows dialog opens with a list of the actions that are created as collection extensions.

   NOTE: If your actions do not have the OS metadata defined, and you want a list of the collection extension actions for all operating systems, select the Remove OS filter check box under the table of actions.

6. Select the action and click Select Action. An action is required.

7. Select the File to Execute. If the action has a usage example, File to Execute and Arguments are filled in from the first one.

8. If your action is configured with required or optional parameters, enter the Arguments, separated by spaces. Arguments cannot contain the characters |, ;, or &.

9. Under Run As, select System to run the file as SYSTEM, or User (Windows Only) to run it as the logged-in user. The default is System.

10. Under Runtime Limit, select None, or select Cancel automation if not finished after and enter a number of Minutes or Seconds. The default is None. When you select a limit, the value is preset to 1 Minutes, or to the timeout in the action usage example. The minimum is 1 second.

11. Click Save Collection Extension.

To start again, click Clear All. It clears the form after you confirm, and it deletes nothing.

Check the Collection Extension

After you save, the new collection extension shows in the Collection Extensions list. Click its name to check the settings in its detailed view.

If the editor shows "The selected action has not been approved." or "The selected action is disabled.", the collection extension does not run until the action is approved and enabled. See Approve and Enable Actions.

To run the collection extension when a sensor triggers, add a tool schedule to a role. See Tool Schedules.

Run a Collection Extension from Resolve

You can run a collection extension manually on one Windows system from Resolve. Resolve lists only the collection extensions whose action is approved.

1. In Resolve, select a Windows system, and then click Tools under Actions in the left menu.

   

2. Click the Run Collection Extensions tab and select the collection extension.

3. Click Run.

   

To see the runs of collection extensions on the system, click the Collection Extension History tab on the same page.

Troubleshooting

A Collection Extension Fails to Run

When a collection extension returns errors after a sensor triggers it, or after you run it from Resolve, check that its action is approved and enabled on the Action Governance tab. Then check the collection files and the log file on the endpoint. For the steps, see Collection Extension Troubleshooting.

To test a collection extension, set its tool schedule to run When sensor is triggered with the sensor Always On. When testing is done, change the tool schedule back to the sensor you need.

Collect Collection Extensions Fail After an Upgrade to 11.4

In SysTrack 11.4 before the hotfix, collection extensions of type Collect can fail with the errors Access to the path is denied and Failed to get handle for PowerShell.exe. The hotfix is in later 11.4 builds. See Collection Extensions Errors After Upgrade to 11.4.