Detection sources, and what each one sees
Getting data in
Every source the catalogue knows, by surface — and what silence means.
A detection source is one thing that tells Nyxus something about the estate. A
collector on a Mac is a source. The browser extension is two, because accounts
and pastes answer different questions. Your Entra tenant is five.
There are eighteen in the catalogue, in six groups. Operations > Detection
sources shows which of them have reported inside your window and which have
not, grouped so you can read "endpoint: 3 of 3, cloud: 1 of 5" at a glance
rather than scanning a flat list of eighteen.
Nothing here is a health check of your estate. It is a statement about what
Nyxus can currently see.
Silent is not a diagnosis
A source marked silent has sent nothing inside the reporting window. That is
all it means. It could be a scanner with the wrong credentials, or it could be
a genuinely quiet corner of a small estate - a tenant with no service
principals, or a fleet where nobody has configured an MCP server.
The difference matters, because not observed is not the same as absent.
Every count in Nyxus is a count of what reported. A silent source does not
lower a number; it means the number never covered that ground in the first
place.
Two sources are worth reading together for this reason. If the extension's
accounts row is reporting and the paste guard row is quiet, the guard is
working and nobody has pasted anything risky. If the accounts row is quiet
too, the extension is not installed.
Endpoint
What runs on the machine itself, reported by a collector on it. See
Installing the collectors.
Source | What it needs |
|---|---|
macOS collector | The pre-configured script from the portal, run as a Jamf policy at root on recurring check-in. The receiver URL and an enrollment token are already inside it. |
Windows collector | The same script as an Intune platform script. |
Linux collector | The same script run as root on a schedule - an RMM job, cron, or a systemd timer. |
Browser
What people do in the browser, reported by the extension. See
The browser extension.
Source | What it needs |
|---|---|
Browser extension: accounts | Pack the extension once, then push the pre-configured policy for your platform. Receiver URL, enrollment token, your domains and the paste guard settings are baked in. |
Browser extension: paste guard | Nothing further. It is the same extension, so there is no second install; the mode and the classification markings are set in Administration. |
Cloud
What your tenant already recorded. All five come from one app registration in
Entra, with permissions added as you go.
Source | What it needs |
|---|---|
Entra sign-ins | An Entra app with |
Entra delegated access | The same app. Catches background and API use that interactive sign-in logs miss. |
Entra consent grants | The same app. Reports the OAuth grants people have given to third-party applications. |
Entra service principals | The same app. Reports non-human identities - service accounts and app registrations, which is where a hidden AI agent tends to live. |
Exchange signup evidence |
|
Fleet
What your MDM inventory lists as installed, whether or not it has ever run.
Source | What it needs |
|---|---|
Jamf applications | A Jamf Pro API client with read access to computer inventory. |
Jamf browser extensions | The same Jamf credentials. |
Intune applications |
|
Intune browser extensions | The same permissions. Nothing emits this row yet. |
On Kandji, Addigy or another MDM, anything that emits the finding shape fills
these rows. See Writing a scanner.
Network
Where traffic went, which is the only source that sees a tool nobody
installed.
Source | What it needs |
|---|---|
SentinelOne DNS | A SentinelOne API token with Deep Visibility read access, and the console URL. |
SentinelOne network | The same token. Catches AI traffic from local processes that never touch a browser. |
SentinelOne bridge targets | The same token. Shows where AI tools connected to - destinations, rather than installed software. |
Using a different DNS or network security product? Anything that emits the
finding shape fills these rows too.
MCP
Source | What it needs |
|---|---|
MCP integration scan | Nothing separate. It comes from the endpoint collectors reading AI tool config files. If a collector is reporting and this is quiet, nobody has configured an MCP server. |
What a source cannot tell you
Each group answers a different question, and none of them answers all of it.
Fleet inventory says installed, not used. An MDM knows a package is on
a laptop. It cannot know whether anybody has opened it since.Cloud sign-ins say a person authenticated, not what they did afterwards,
and not that they used a work account to do it.Network sources say something connected. They see the tool nobody
installed and nobody signed into, and they cannot tell you which person was
at the keyboard.A collector sees one machine, thoroughly, and nothing about the ones it
is not installed on.
That is what Coverage gaps in the console is for: the number of devices
something has seen, against the number a collector has actually run on.
Adding one of your own
The extension point is always the finding. Anything that can post the finding
schema to the receiver becomes a source, and the rest of the product treats it
like any other. Writing a scanner has the schema and
the steps.