Where this collector family fits
Endpoint and device collectors add host activity, detections, security alerts, and managed-device inventory to Nova. They help teams connect a security signal to the affected device, its current context, and the wider investigation.
- Endpoint alert triage
- Host activity investigation
- Managed-device inventory
- Cross-source incident context
Supported collectors in this family
Nova currently implements 9 collectors in this family. Each entry names the source and the customer outcome it supports.
- CrowdStrike Assets
- Keeps CrowdStrike Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- CrowdStrike Event Stream
- Brings CrowdStrike Event Stream security signals into Nova for triage, investigation, prioritization, and response review.
- CrowdStrike FDR Event Search
- Brings CrowdStrike FDR Event Search security signals into Nova for triage, investigation, prioritization, and response review.
- Jamf Device Inventory
- Keeps Jamf Device Inventory current in Nova for inventory, ownership, exposure, and security-posture review.
- Microsoft Intune Devices
- Keeps Microsoft Intune Devices current in Nova for inventory, ownership, exposure, and security-posture review.
- SentinelOne Detections
- Brings SentinelOne Detections security signals into Nova for triage, investigation, prioritization, and response review.
- Sophos Central Alerts
- Brings Sophos Central Alerts security signals into Nova for triage, investigation, prioritization, and response review.
- Trend Micro Vision One Alerts
- Brings Trend Micro Vision One Alerts security signals into Nova for triage, investigation, prioritization, and response review.
- VMware Carbon Black Alerts
- Brings VMware Carbon Black Alerts security signals into Nova for triage, investigation, prioritization, and response review.
How the evidence supports customer work
Nova keeps collected data linked to its source as it is used for asset inventory, cloud security, detection, investigation or Threat Hunting. Collecting data does not by itself prove a threat or authorize a response action.
Source coverage is not assumed to be complete. Nova keeps collection health, freshness, gaps, and partial results visible so teams can judge whether the evidence is suitable for the decision at hand.
Questions to answer during evaluation
- Which named sources are required for the use case, and which are optional context?
- What history, accounts, subscriptions, organizations, projects, or devices are available to the source product?
- What delay, volume, and missing-data conditions are acceptable for the intended decision?
- Which customer team owns source access, data interpretation, and ongoing health review?