> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/endpoint-privilege-manager/collections.md).
# Collections
When agents are deployed to endpoints, the agent begins to run discovery. During the discovery process, Keeper automatically builds out resource collections. Collections are categorized into the following types:
* **Agentic AI**
* **Applications**
* **Command Line Arguments**
* **Machines**
* **Operating Systems**
* **Users**
Collections provide flexible scoping across users, machines, applications, directories, AI agents, and command line patterns. Enhanced filtering and path resolution capabilities enable administrators to define collections that align closely with organizational structure and operational requirements, supporting both broad policy application and highly targeted enforcement.
## Creating a Collection
Click on **New Collection** to create a collection and assign attributes. For example, a custom collection "Developers" can be created which includes all software engineers. Or a custom collection of type "Machines" might be called "Web Servers" where only web servers are added to the collection. Or as another example, a custom collection of type "Applications" might be called "Developer Tools" where applications such as GitHub.exe or Visual Studio Code is included.
Newly provisioned environments may include baseline wildcard-based application entries to accelerate initial configuration. These entries provide immediate collection coverage for common user and system paths, allowing administrators to refine policy targeting without manually defining every directory structure during onboarding.
{% hint style="info" %}
Collections can not contain different resource types. For example a User Collection can not contain a Machine resource.
{% endhint %}
## Collection Types
### Accounts
The Keeper agent discovers all of the local users and groups across the fleet of endpoints. They are aggregated and built into "User" collections. Inside of the User Collection are read-only sub-collections including discovered groups and "All Accounts."
### Agentic AI Collections
An Agentic AI collection groups known and flagged AI agent applications for policy targeting and fleet-wide AI tooling inventory. Agentic AI collections are the scoping mechanism for the agentic policy types (Agentic AI, Agentic Access, and Agentic Privilege Elevation), allowing administrators to apply policy to AI agents the same way policy is applied to users and machines.
Applications discovered under **All Applications** can be flagged as Agentic AI. Once flagged, an application appears under **All Agentic AI**, where it becomes available for inclusion in Agentic AI collections and agentic policy targeting.
Agentic AI collections support use cases such as:
* Scoping AI-specific policies to known or flagged agents.
* Inventorying AI tooling across the fleet.
* Enabling per-agent risk threshold enforcement.
To build a collection, add or remove applications from the Agentic AI collection, flag applications as Agentic AI from the Applications view, and scope the collection to a policy.
### Applications
An application collection represents all of the available executables across the fleet of endpoints. Applications can be grouped into custom collections.
#### Custom Application Resources
A custom application resource can be defined by the Admin, such as a specific executable. Click on "Add Item to Collection" and select "Manually define resource" to submit the information.
#### Wildcard & Path Variables
Collections support the use of wildcard path variables to simplify policy scoping across user and system environments. Path variables allow administrators to define application collections that dynamically resolve to user-specific or system-specific directories, reducing the need to create separate entries for each endpoint.
Supported path variables include:
* `{desktop}` – Resolves to the current user's desktop directory
* `{usr}` – Resolves to user home directories
* `{system32}` – Resolves to the Windows System32 directory
These variables allow application collections to scale efficiently across diverse endpoint configurations while maintaining consistent enforcement behavior.
```
// Wildcard Examples
C:\Users\john\Desktop\*
{usr}\*\Downloads\*
{system32}\*.exe
{usr}\*\AppData\Local\Programs\MyApp\MyApp.exe
```
### Machines
A machine collection represents the endpoint operating system.
Machines are automatically aggregated and grouped based on the agent discovery process.
{% hint style="info" %}
Machine Collections are also automatically added as an available sub-collection inside of Machines.
{% endhint %}
### Operating Systems
The operating system resources are automatically discovered by the Keeper agent, and made available as a collection for applying policies.
***
## Applying Policies
After collections have been established by the discovery process, policies can be applied to user, machine, application, Agentic AI, and Command Line Arguments collections to control privilege on all of the endpoints. This includes the agentic policy types, which scope to Agentic AI collections to govern AI agent activity. Visit the [Policy Types](/keeperpam/endpoint-privilege-manager/policies/policy-types.md) page to learn more.
### Automation with Commander
Keeper Commander supports collection automation through our command-line interface, Service Mode [REST API](/keeperpam/commander-cli/admin-rest-api.md) and Python SDK. [Learn more](/keeperpam/commander-cli/command-reference/endpoint-privilege-manager-commands.md) about Endpoint Privilege Manager commands.
### Collection Commands
The `pedm collection` command provides management over collections.
```
My Vault> pedm collection -h
pedm command [--options]
Command Description
---------- ----------------------------------
list List PEDM collections
view Show PEDM collection details
add Creates PEDM collection
update Update PEDM collections
delete Delete PEDM collections
connect Link agent, policy, resource to PEDM collections
disconnect Unlink agent, policy, resource from PEDM collections
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/collections.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.