What is collected
Twenty-one signals in six groups, what is reported for each, and the things that are deliberately never read.
On this page
Collection is bounded and metadata-first. The agent never elevates and never executes what it finds,
so where it cannot measure something the signal is unknown rather than a guess.
The twenty-one signals
| Group | Signals | What is reported |
|---|---|---|
| Tools and agents | ai_tooling, ai_autonomy | Which AI tools are installed, their vendor and kind, how they were detected, and whether each is configured to act without asking. Tools are never executed |
| Apps and web | ai_web_usage, browser_policy | Which AI services are reached, per browser profile, and whether your managed block policy is actually in force. Browser settings are never modified |
| MCP and access | mcp_servers | Server name, client, scope, transport, bare host, and whether the declaration carries a credential-shaped variable. No connection is ever made to any of them |
| Projects and data | ai_projects, ai_credentials | Which repositories this is happening in, and whether a provider-shaped key is exposed. Credential values are discarded before evidence is built; tool-managed stores are never opened |
| Usage and accounts | ai_usage, ai_accounts | Day, tool, model, token counts, and a one-way session key. No cost is calculated on the device, and tool calls and tool results are never read |
| Endpoint posture | device_facts, disk_encryption, screen_lock, firewall, os_patch_level, installed_software and the rest | Whether the machine doing all of the above is on a sound footing. Applications are never opened, and the raw hardware machine id never leaves the device |
The things that are deliberately never read
This is the shorter and more useful list:
- No full URLs, no query strings, no page titles. Browser evidence is AI domains, per profile — not browsing history.
- No prompts and no responses, by default. See privacy for what turning that on costs.
- No tool calls and no tool results, ever — not as an opt-in.
- No credential values. Provider-shaped variable names are evidence; the values are discarded before evidence is built.
- No argument values from an MCP declaration, and no absolute project paths.
- No rule bodies, hook commands, session ids or transcript content from an agent's configuration.
- Nothing is executed. Discovering that a tool is installed does not involve running it.
From your Microsoft tenant, if you connect one
Read-only, from an app registration you create, with each capability behind its own consent: Intune's device records so a managed machine that never enrolled can be counted, a bounded mirror of directory people, and the applications your directory has already granted OAuth access to. Serial numbers are stored as an organisation-scoped keyed hash, never in the clear.
From Microsoft 365 Copilot, on its own connection: the usage report, and each licensed person's interactions counted per day and app with the DLP detectors that matched. The text of a prompt is scanned as it is read and never stored.
Nothing is read from the machines themselves through that connection. Details are in Microsoft.
What the correlation model does with all of it
A snapshot is a complete statement about one device at one instant, and it replaces rather than accumulates — so a tool that was uninstalled disappears from current state rather than lingering as a finding nobody can close. History is kept as transitions, not as a copy of every snapshot.
The signal-by-signal table, with what is scanned and what is reported on each line, is in the full documentation — the page a security review usually starts on.