# Artifact Collection Parameters

This page is designed for managing Windows Event Log, Windows Sysmon, Windows File Analysis, Threat Detection, Reported E-Mail Searches, and Content Search Rules. 

* **Windows Event Log Rules**: This section displays Windows event log rules. The users can create, edit, and delete the rules according to their requirements.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FVIU36Osa8QAVtLQAsytD%2Fimage.png?alt=media&#x26;token=f0b587b3-a75b-41cb-8bcc-6a12760d7fb5" alt=""><figcaption></figcaption></figure>

* **Windows Sysmon Rules**: This section displays Windows Sysmon rules. The users can create, edit, and delete the rules according to their requirements.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FowQWuYxYp6T5h5PM5DMz%2Fimage.png?alt=media&#x26;token=56dff716-0e9e-4604-8d03-8b77990bc7c6" alt=""><figcaption></figcaption></figure>

* **Windows File Analysis**: This section displays Windows file analysis. The users can create, edit, and delete the analysis rule according to their requirements.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FfnV1QBd7BFWnrkW2CqaN%2Fimage.png?alt=media&#x26;token=a150e1a0-b178-40a4-9a48-9a597fb4d097" alt=""><figcaption></figcaption></figure>

* **Threat Detection Rules**: This section displays SIGMA rules. The users can create, edit, and delete the analysis rule according to their requirements. These rules are SIGMA rules for Thor analysis.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FXLtzKvhe9XYFVk5cGmKX%2Fimage.png?alt=media&#x26;token=e86304b9-aab0-444d-addf-857118dce8f2" alt=""><figcaption></figcaption></figure>

* **Reported E-Mail Searches (Deprecated)**: This section displays reported e-mail searches. If the users report an e-mail, the analysis state can be seen from this section.
* **Content Search Rules**: This section is designed for content searching with agents, Teams, or Outlook add-ins. The users can create, edit, and delete rules according to their requirements.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FceZqhyv5WIDWFaIy4Yvm%2Fimage.png?alt=media&#x26;token=addced17-433a-4b61-ad19-d039c5aa7ef2" alt=""><figcaption></figcaption></figure>

* **Windows Threat Monitor Rules**: This section allows users to manage the Windows threat monitor rules. The users can edit, clone, or create a new rule for specific requirements of their own.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FzJSsRCya1HfeRqKJ8Ezw%2Fimage.png?alt=media&#x26;token=529794df-15a0-4741-969b-4cee58c122fb" alt=""><figcaption></figcaption></figure>

* **OSQuery Rules:** This section allows users to manage the OSQuery rules for Linux and macOS. The users can edit, clone, or create a new rule for specific requirements of their own.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FDN4fIQFbPldsfE50hbqn%2Fimage.png?alt=media&#x26;token=304f6e0b-d7dc-4d8a-9161-710233cd6fd1" alt=""><figcaption></figcaption></figure>

* **Windows Object and Honeypot Monitor Rules**: This section allows users to manage the Windows object and honeypot monitor rules. The users can edit, clone, or create a new rule for specific requirements of their own.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FANmEYAhvxaJU8wEDB91Y%2Fimage.png?alt=media&#x26;token=0b37dfef-6571-4981-b05f-057b24bd0598" alt=""><figcaption></figcaption></figure>

* **NMAP Script Scan Results**: This section is allow users to edit NMAP Scripts for network scanning. The users can edit, clone, or create a new rule for specific requirements of their own.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FfHCVlBUfvwLHIg9UjMOS%2Fimage.png?alt=media&#x26;token=8fed6631-92d3-4a5f-b743-ca513a0daa5b" alt=""><figcaption></figcaption></figure>

* **Agentles Windows Collection Rules**: This section allows users to manage the agentless collection rules. The users can edit, clone, or create a new rule for specific requirements of their own.
* **Agentless Linux Collection Rules**: This section allows users to manage the agentless collection rules. The users can edit, clone, or create a new rule for specific requirements of their own.
* **Windows Security Software Settings**: This section allows users to manage security software detection parameters. The users can edit, clone, or create a new settings for specific requirements of their own.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2F8bx3IfLNkm8e9IVcuz6A%2Fimage.png?alt=media&#x26;token=4030b8d5-53d5-40b8-b8ed-7badf3a21fc7" alt=""><figcaption></figcaption></figure>

* **Linux/macOS Security Software Settings**: This section allows users to manage security software detection parameters. The users can edit, clone, or create a new settings for specific requirements of their own.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cloudcyte.com/admin-guide/rules-and_policies/artifact_collection_parameters.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.