Appearance
Collectors
Where to find it: Controls & Assurance, then Evidence Fabric (/evidence/fabric), then Collectors.
A Collector (COL-YYYY-NNNN) defines what evidence to gather from a connected source, about which subjects, and how often. Each execution is a Collector Run (CRN-YYYY-NNNN).
Collector and run
| Collector | Collector Run | |
|---|---|---|
| What it is | A definition | An execution |
| Reference | COL-YYYY-NNNN | CRN-YYYY-NNNN |
| Changes over time | Edited deliberately | Immutable once complete |
| Produces | Nothing on its own | Evidence assertions |
The distinction matters for audit. When an assessor asks "how do you know MFA was enforced on 14 March?", the answer is a specific run with a timestamp, an outcome and the assertions it produced — not "we have a collector for that".
Collector statuses
| Status | Meaning |
|---|---|
draft | Being configured; does not run |
active | Runs on its schedule |
paused | Retained but not running |
retired | No longer used; history preserved |
Run statuses
| Status | Meaning |
|---|---|
queued | Waiting to execute |
running | In progress |
succeeded | Completed and produced assertions |
partial_success | Completed with some subjects unresolved |
failed | Did not complete |
partial_success is the status to watch
A partially successful run produces assertions for the subjects it reached and nothing for the rest. The unreached subjects simply have no fresh assertion, so coverage falls — quietly, without anything failing. Review partial runs rather than treating them as successes.
Defining a collector
A collector definition specifies:
| Element | Purpose |
|---|---|
| Connection | The configured source it reads from |
| Subject resolution | How collected records map to scope subjects |
| Observation mapping | What constitutes pass, fail, partial or inconclusive |
| Freshness window | How long an assertion from this collector stays current |
| Frequency | How often it runs |
| Status | Draft, active, paused or retired |
Subject resolution is the hard part
An assertion is about a subject. For coverage to work, the identifier the source system uses must resolve to a scope member.
If the identity platform reports account UPNs and your scope holds asset records keyed by hostname, nothing matches, and coverage reads zero while the collector reports success.
Getting subject identity aligned between your source systems and your Scope Registry is the main implementation effort in setting up automated evidence, and it is worth doing carefully once.
Scheduling
Collectors run on a defined frequency. They can also be triggered manually and replayed.
Manual run executes immediately, outside the schedule. Useful for validating a new definition and for gathering evidence ahead of an assessment.
Replay re-executes a previous run. Useful when a run failed for a transient reason.
Both require collector.run.
Collector schedules are technical, not governance events
Collector runs, sweeps and freshness evaluations are machine schedules. They deliberately do not appear on the GRC Calendar, which is reserved for meaningful governance obligations — review dates, attestation deadlines, expiry dates. A calendar full of hourly collector runs is a calendar nobody reads.
Setting up a collector
- Confirm the Connection is
activeand tested. - Confirm the target Scope exists with its members.
- Create the collector in
draft. - Define subject resolution and observation mapping.
- Set the freshness window to match the real cadence of the underlying evidence. A control that operates quarterly should not have a 24-hour freshness window.
- Run it manually and inspect the assertions produced — check the subjects resolved and the states are what you expect.
- Set the status to
active.
Requires collector.manage; running requires collector.run.
Reading run history
Run history is the evidence trail for your automated evidence. For each run you can see when it ran, its status, how many subjects were resolved and how many assertions were produced.
A collector whose run history shows a long tail of partial_success is telling you something about either the source system or your subject resolution.
Permissions
| Action | Permission |
|---|---|
| View collector definitions and run history | collector.read |
| Create and configure collectors | collector.manage |
| Trigger manual execution or replay | collector.run |
All require the continuous_assurance entitlement.
Example
Collector COL-2026-0003 — MFA enforcement, privileged accounts
| Element | Value |
|---|---|
| Connection | CON-2026-0001 Identity platform |
| Subject resolution | Directory account object ID, matched to scope members in SCP-2026-0012 |
| Observation mapping | pass where MFA is enforced and registered; fail where enforcement is off or no factor is registered; inconclusive where the account is disabled |
| Freshness window | 48 hours |
| Frequency | Daily |
| Status | active |
Recent runs:
| Run | Status | Subjects | Assertions | Note |
|---|---|---|---|---|
CRN-2026-1841 | succeeded | 214 | 214 | 211 pass, 3 fail |
CRN-2026-1842 | succeeded | 214 | 214 | 211 pass, 3 fail |
CRN-2026-1843 | partial_success | 198 | 198 | 16 accounts unresolved after a directory reorganisation |
CRN-2026-1844 | succeeded | 216 | 216 | Subject resolution updated; two new accounts included |
Run 1843 is the interesting one. Coverage fell from 100% to 92.5% for a day. Nothing failed — 16 accounts simply stopped resolving. The fix was to subject resolution, not to the control.
Troubleshooting
"The collector succeeds but produces no assertions." Subject resolution is not matching. Compare the identifiers the source returns against your scope members.
"Coverage fell but nothing failed." Either assertions went stale, or a run was partial_success, or scope members were added. Check run history first.
"Assertions go stale between runs." The freshness window is shorter than the run frequency. A collector running weekly needs a freshness window longer than a week.
"A run failed." Check the connection status first. Most run failures are connection or credential problems rather than collector configuration.
"Collectors are unavailable." Requires the continuous_assurance entitlement and collector.read.