---
title: "Collect system specific information from Endpoints"
slug: "collect-system-specific-information-from-endpoints-1"
updated: 2026-10-26T07:33:44Z
published: 2026-10-26T07:33:44Z
canonical: "docs.trellix.com/collect-system-specific-information-from-endpoints-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Collect system specific information from Endpoints

Create and apply a policy that actively gathers hardware, software, and configuration details from your managed systems.

1. Create a **Collect Data** policy

  1. Log on to your Trellix ePO - On-prem console.
  2. Navigate to Systems → Policy Catalog.
  3. For the **Product**, select System Information Reporter → General.
  4. Click **New Policy** to open the new policy dialog box.
  5. Select an existing policy to duplicate, give the new policy a name, and click **OK**. The policy configuration wizard is displayed.
2. Configure **General** system properties

  1. In the policy wizard, navigate to the **General** tab.
  2. Select the checkboxes for the system information you want to collect. The options are:

    - **USB devices**: Gathers details of USB device drivers on the node.
    - **Installed Network cards**: Collects Network Interface Card details.
    - **MSI Version**: Gathers the Microsoft Windows Installer version.
    - **Installed Software**: Collects a list of all installed software, including hidden software.
    - **Internet Explorer version**: Gathers the version and patch level of Internet Explorer.
    - **Running processes at property collection**: Gathers a list of processes running when the data is collected.
    - **Environmental Variables (in SYSTEM context)**: Collects the values for TEMP, TMP, and SystemRoot.
    - **Shares**: Collects shared data from the endpoint.
    - **Services installed**: Gathers a list of all services and their status.
    - **Path (in SYSTEM context)**: Collects the system's Path variable value.
    - **NullSession shares and pipes**: Gathers the list of defined NullSession Pipes and Shares.
    - **Installed Hotfixes (relies on Registry only)**: Collects all installed Microsoft updates.
  3. Click **Save**.
3. Configure custom data collection

  1. Navigate to the **Custom** tab.
  2. To collect a custom environment variable, enter its name in the "**Get value of custom environment variable**" field.
  3. To collect a registry value, enter the full key path into the "**Query Registry Values**" field and click **Add to list**.
  4. To enable detailed logging for troubleshooting, select the **Enable logging** checkbox. This creates a `SIRService.log` file on the endpoint.

### Note

This log file contains sensitive registry information and should only be enabled for troubleshooting purposes.
4. Configure file searches

  1. Navigate to the **Find File** tab.
  2. Select a folder from the drop-down list and type the file name you want to search for. You can use wildcards (For exmaple, *`.exe`). This search will find the file and determine its version and SHA-256 hash (if available).
  3. Click **Add to list**.
  4. Click **Save**.

: