Data Collection Sets

Data Collection Sets are curated ETW capture profiles: named bundles of the low-level Windows trace providers a given investigation needs, so you do not have to know which providers to enable by hand. Each profile is built on the same tracing engine as the ETW trace tools — collection_start returns the same native trace handle those tools use — but it picks the providers, sets a hard duration cap, and keeps the recording around long enough to read.

There are two kinds of profile. Live profiles capture a problem you can reproduce on demand — you start the capture, trigger the behavior, and read the result. Boot profiles capture what happens before or during logon, the window a trace started after boot can never reach — you arm the profile, reboot the host, and harvest once it comes back online. All four tools are session-scoped and Windows-only, and require an up-to-date agent that advertises the matching capability.

INFO

These tools require a current agent version. An older agent does not advertise the tracing or boot-AutoLogger capability and rejects the call, so keep the fleet current via agent updates.

Live captures

A live capture runs autonomously in the kernel and stops itself at the profile's duration cap (300 seconds). After it stops — or after you stop it early — the recording is retained on the host for a one-hour window, then purged automatically, so there is time to read the results. A live capture consumes one of the host's four concurrent trace slots, shared with agent_trace_start.

collection_start

Starts a bounded, curated live capture from a named profile and returns the trace handle. Read the capture with agent_trace_read, list running and stopped captures with agent_trace_list, and stop it early with agent_trace_stop — all keyed by the returned trace_id.

The nine live profiles cover the investigations that come up most:

• security-ir — incident response: process and image starts, DNS lookups, PowerShell, WMI, and antimalware (AMSI) script scanning.
• ad-enum-detection — Active Directory reconnaissance: the LDAP and Kerberos (KDC) traffic enumeration tools generate.
• auth-troubleshooting — the logon path end to end across Kerberos, NTLM, Netlogon, and Schannel.
• smb-client-access — SMB share access: signing, dialect negotiation, and access-denied detail.
• tls-schannel — the TLS handshake and the certificate chain, revocation checks included.
• wlan-8021x — Wi-Fi and wired 802.1X association and EAP.
• intune-mdm — Intune/MDM enrollment, CSP policy sync, and WNS check-in.
• device-registration — Entra device registration and Workplace Join (the Settings "Fix" button, dsregcmd).
• cert-enrollment — client certificate enrollment: Intune SCEP/PKCS profiles and AD autoenrollment.

Parameter	Type	Required	Description
session_id	string	✓	Running session ID from session_start; the target agent must advertise the ETW capability.
profile	string	✓	One of the nine live profile names above. Each has a fixed provider set and a hard duration cap.
duration_seconds	integer	—	Requested capture duration. Clamped to the profile's cap (300s); 0 or omitted uses the cap.
verbose	boolean	—	Raise verbose-gated providers to a deeper level. Rejected for profiles that forbid it; keep the window short.

Example prompt.

"Run the incident-response capture on this host for two minutes while I reproduce the process launch."

Boot captures

Boot captures record the moments before and during logon — the failures a live trace can never reach because they happen before you can attach to the host. You arm a profile, reboot, and harvest once the host is back online. The flow is deliberate, and reboots are destructive: only reboot a host with explicit authorization, and keep the arm-to-harvest span under 30 minutes so the assessment session stays open.

The five boot profiles:

• boot-logon — general logon and boot behavior (Group Policy, User Profiles, Winlogon) with logon-SID attribution.
• cloud-kerberos-trust — Entra-joined Windows Hello for Business Cloud Kerberos Trust: the partial-to-full ticket exchange and on-prem single sign-on failures across a reboot, including the "no network at first logon, never recovers" case.
• ad-auth-boot — classic domain-joined auth at boot: machine secure-channel and "trust relationship failed," "no logon servers available."
• wlan-8021x-boot — pre-logon machine 802.1X and Wi-Fi: "the device won't get on the network at boot."
• slow-logon — "logon takes minutes" and Group Policy not applying (Group Policy, User Profiles, Winlogon, Shell).

collection_arm_boot

Arms a boot capture so it records across the next reboot. This writes the AutoLogger configuration; the capture is kernel-armed on the next boot and survives the agent restart. Re-arming the same profile overwrites the previous arm.

Parameter	Type	Required	Description
session_id	string	✓	Running session ID; the target agent must advertise the boot-AutoLogger capability.
profile	string	✓	One of the five boot profile names above.
verbose	boolean	—	Capture verbose-gated providers at a deeper level. Errors if the profile does not permit it.

Example prompt.

"Arm the Cloud Kerberos Trust boot capture on this host — I'm about to reboot it."

collection_harvest_boot

Decodes the boot capture after the host has rebooted and come back online, returning a per-provider summary plus events. If the capture does not exist yet — the host has not rebooted, or nothing was recorded — the tool returns a graceful "not captured yet" result rather than an error, so reboot and harvest again. It supports the same narrowing filters as agent_trace_read.

Parameter	Type	Required	Description
session_id	string	✓	Running session ID for the same agent the capture was armed on.
profile	string	✓	The boot profile that was armed.
provider_filter	string	—	Restrict to one provider — an alias or a {GUID}.
event_ids	array	—	Only events with these IDs (0–65535).
since / before	string	—	RFC3339 lower/upper bounds.
max_events	number	—	Maximum decoded events. Default 100, hard cap 1000.
min_severity	string	—	critical, error, warning, informational, or verbose — returns that level or more severe.
property_key / property_contains	string	—	Keep events whose decoded property_key value contains property_contains. Supply both.

Example prompt.

"The host is back online — harvest the boot capture and show me the Kerberos and network events from around logon."

collection_disarm_boot

Removes a boot capture armed by collection_arm_boot — deletes the AutoLogger configuration so it is not re-armed on the next boot. It is a one-shot cleanup and idempotent (an already-removed capture reports that it was already gone). By default (delete_etl=false) only the configuration is removed and the recorded .etl stays on disk, so collection_harvest_boot can be re-run with different filters; pass delete_etl=true to also irreversibly delete the recording once the investigation is done.

Parameter	Type	Required	Description
session_id	string	✓	Running session ID for the same agent the capture was armed on.
profile	string	✓	The boot profile that was armed.
delete_etl	boolean	—	Also delete the recorded boot .etl. Default false keeps it so a harvest can be re-run.

Example prompt.

"Disarm the boot capture on this host and delete the recording — we're done with it."

See Also

Data Collection Sets build on the tracing primitives documented in Agent Tools — use agent_trace_read, agent_trace_list, and agent_trace_stop to read and manage a capture once it is running. For the session that scopes every capture, see Sessions. For keeping agents current so these tools are available, see Agent Updates.