Collections
Managing groups of protected resources for Endpoint Privilege Manager
When agents are deployed to endpoints, the agent begins to run discovery. During the discovery process, Keeper automatically builds out resource collections. Collections are categorized into the following types:
Agentic AI
Applications
Command Line Arguments
Machines
Operating Systems
Users
Collections provide flexible scoping across users, machines, applications, directories, AI agents, and command line patterns. Enhanced filtering and path resolution capabilities enable administrators to define collections that align closely with organizational structure and operational requirements, supporting both broad policy application and highly targeted enforcement.
Creating a Collection
Click on New Collection to create a collection and assign attributes. For example, a custom collection "Developers" can be created which includes all software engineers. Or a custom collection of type "Machines" might be called "Web Servers" where only web servers are added to the collection. Or as another example, a custom collection of type "Applications" might be called "Developer Tools" where applications such as GitHub.exe or Visual Studio Code is included.
Newly provisioned environments may include baseline wildcard-based application entries to accelerate initial configuration. These entries provide immediate collection coverage for common user and system paths, allowing administrators to refine policy targeting without manually defining every directory structure during onboarding.
Collections can not contain different resource types. For example a User Collection can not contain a Machine resource.
Collection Types
Accounts
The Keeper agent discovers all of the local users and groups across the fleet of endpoints. They are aggregated and built into "User" collections. Inside of the User Collection are read-only sub-collections including discovered groups and "All Accounts."
Agentic AI Collections
An Agentic AI collection groups known and flagged AI agent applications for policy targeting and fleet-wide AI tooling inventory. Agentic AI collections are the scoping mechanism for the agentic policy types (Agentic AI, Agentic Access, and Agentic Privilege Elevation), allowing administrators to apply policy to AI agents the same way policy is applied to users and machines.
Applications discovered under All Applications can be flagged as Agentic AI. Once flagged, an application appears under All Agentic AI, where it becomes available for inclusion in Agentic AI collections and agentic policy targeting.
Agentic AI collections support use cases such as:
Scoping AI-specific policies to known or flagged agents.
Inventorying AI tooling across the fleet.
Enabling per-agent risk threshold enforcement.
To build a collection, add or remove applications from the Agentic AI collection, flag applications as Agentic AI from the Applications view, and scope the collection to a policy.
Applications
An application collection represents all of the available executables across the fleet of endpoints. Applications can be grouped into custom collections.
Custom Application Resources
A custom application resource can be defined by the Admin, such as a specific executable. Click on "Add Item to Collection" and select "Manually define resource" to submit the information.
Wildcard & Path Variables
Collections support the use of wildcard path variables to simplify policy scoping across user and system environments. Path variables allow administrators to define application collections that dynamically resolve to user-specific or system-specific directories, reducing the need to create separate entries for each endpoint.
Supported path variables include:
{desktop}– Resolves to the current user's desktop directory{usr}– Resolves to user home directories{system32}– Resolves to the Windows System32 directory
These variables allow application collections to scale efficiently across diverse endpoint configurations while maintaining consistent enforcement behavior.
Machines
A machine collection represents the endpoint operating system.
Machines are automatically aggregated and grouped based on the agent discovery process.
Machine Collections are also automatically added as an available sub-collection inside of Machines.
Operating Systems
The operating system resources are automatically discovered by the Keeper agent, and made available as a collection for applying policies.
Applying Policies
After collections have been established by the discovery process, policies can be applied to user, machine, application, Agentic AI, and Command Line Arguments collections to control privilege on all of the endpoints. This includes the agentic policy types, which scope to Agentic AI collections to govern AI agent activity. Visit the Policy Types page to learn more.
Automation with Commander
Keeper Commander supports collection automation through our command-line interface, Service Mode REST API and Python SDK. Learn more about Endpoint Privilege Manager commands.
Collection Commands
The pedm collection command provides management over collections.
Last updated
Was this helpful?