ETW Event Monitoring

• File system operations and permission tracking
• Registry access and modification monitoring
• Process lifecycle and crash detection
• Network connections and DNS queries
• Custom filtering and event correlation
• Configurable collection modes for performance tuning

Collection Modes

Health Only Mode

• Baseline monitoring with minimal overhead
• 30-second health check intervals
• CPU and memory metrics only
• Low resource usage

On-Demand Collection

• Reproduce-to-diagnose scenarios
• User-controlled start/stop
• Configurable ETW provider selection
• Moderate overhead when active

Full Monitoring

• Continuous audit trails
• All configured providers active
• Production monitoring capability
• Performance-tuned for minimal impact

Health Monitoring

• Real-time CPU and memory metrics
• 30-second health check intervals
• Historical health data retention
• Color-coded status indicators
• Agent online/offline tracking
• Low overhead monitoring mode

Desktop Deployment

• Simple installer download
• Windows 10/11 support
• User-mode application
• No administrator privileges required
• Automatic updates

Agent Deployment

Standard Installation

• Organization-specific installer
• Built-in authentication tokens
• Windows Service deployment
• Automatic registration with cloud
• Agent appears in dashboard within 30 seconds

Silent Installation

• Command-line installation support
• Mass deployment ready
• No user interaction required
• Suitable for enterprise deployment tools

System Requirements

Agent Systems

• Windows 10/11 or Windows Server 2016+
• Administrator/SYSTEM privileges
• 50-200 MB RAM depending on collection mode
• 100 MB disk space for agent
• HTTPS outbound access to etducky.com

Dashboard Access

• Modern web browser
• Internet connection
• JavaScript enabled

Web Dashboard

• Monitor all agents from anywhere
• Real-time status and health metrics
• Remote agent configuration
• Usage analytics and quota tracking
• Billing management and invoices
• Team member management

Organization Management

• Multi-organization support for MSPs and enterprises
• Query quota pooling across team members
• Team collaboration and shared resources
• Centralized billing and usage tracking
• Organization-wide analytics
• Switch between organizations instantly

Remote Configuration

• Cloud-managed agent updates
• Remote collection mode switching
• ETW provider configuration from dashboard
• Live query session management
• Agent lifecycle management

Usage Tracking

• Real-time query quota monitoring
• Organization-wide usage analytics
• Agent count and billing projections
• Historical usage data
• Per-member quota visibility

Scale

• Support for large-scale agent deployments
• Volume pricing discounts
• Dedicated infrastructure for Enterprise tier
• Performance optimized for thousands of agents

Security

• Secure authentication with Clerk
• Organization-specific agent tokens
• HTTPS encryption for all communication
• Events correlated locally before transmission
• Minimal data transmission footprint

Support

• Priority support channels for paid tiers
• Dedicated support for Enterprise customers
• SLA guarantees for Enterprise tier
• Email and dashboard-based support

Deployment Tools

• Silent installation support
• Command-line deployment options
• Organization-specific installer generation
• Automated agent registration

Agent Types

Managed Agents ($8/month each)

• Purpose: Servers, production systems, critical workstations
• Features:
  • Full ETW event collection
  • Real-time health metrics
  • On-demand and continuous monitoring modes
  • Interactive query sessions
  • AI-powered diagnostics
• Deployment: Windows Service, auto-start
• Billing: $8/month per agent

Desktop Agents (Free)

• Purpose: Personal workstations, dev machines
• Features:
  • Health metrics only
  • Basic status monitoring
  • No ETW collection
• Deployment: User-mode application
• Billing: Free (unlimited)

Collection Modes

Health Only (Default)

• What: CPU, Memory, Disk, Network metrics every 30 seconds
• Overhead: Minimal (~1% CPU, 50 MB RAM)
• Use Case: Baseline monitoring, always-on
• Events: None collected

On-Demand Collection

• What: Health metrics + ETW events when triggered
• Overhead: Low when idle, moderate when collecting
• Use Case: Reproduce-to-diagnose issues
• Events: File, Registry, Process, Network (configurable)
• Duration: User-controlled start/stop

Full Monitoring

• What: Continuous ETW event collection
• Overhead: Moderate to high (5-15% CPU, 100-200 MB RAM)
• Use Case: Production monitoring, audit trails
• Events: All configured providers, continuous
• Duration: Runs until stopped

What Gets Monitored

Agent Installation

Managed Agent Deployment

1. Generate Installer
   • Dashboard → Agents → "Add Agent"
   • Download organization-specific installer
   • Installer includes authentication token
2. Run Installer
   • Right-click → "Run as Administrator"
   • Follow installation wizard
   • Service installs and starts automatically
3. Verify
   • Agent appears in dashboard within 30 seconds
   • Status shows "Online" with green indicator
   • Health metrics populate

Silent Installation (Enterprise)

ETDuckyAgent-Setup.exe /SILENT /SUPPRESSMSGBOXES

Deploy via GPO, SCCM, or other enterprise deployment tools

Main Navigation

• Home: Overview, quick stats, recent activity
• Agents: View all deployed agents, health metrics, management
• Billing: Subscription status, usage, payment methods
• Team: Manage organization members, roles, permissions
• Account: Profile settings, API keys, preferences

Agents Page

Central hub for monitoring and managing all deployed agents.

Agent List Columns

• Name: Server hostname + collection mode
• Type: Managed vs Desktop
• Status: Online (green) / Offline (red)
• CPU: Current CPU usage % (color-coded)
• Memory: Current memory usage % (color-coded)
• Last Seen: Last heartbeat timestamp
• Actions: View details, Delete

Color Coding

• Green: < 80% (healthy)
• Yellow: 80-90% (warning)
• Red: > 90% (critical)

Statistics Cards

• Managed Agents: Count of billable agents
• Desktop Agents: Count of free agents
• Active: Agents online now
• Monthly Fees: Current agent costs

Organization Selector

If you're a member of multiple organizations:

• Dropdown appears at top of Agents page
• Switch between organizations instantly
• Each org has separate agents, billing, and team

Agent Details Modal

Click "View" on any agent to open detailed management interface.

Information Displayed

• Server Name: Hostname
• Agent Type: Managed / Desktop
• Status: Online / Offline + last seen
• Agent Version: Software version
• Environment: Production / Staging / Dev
• Current Health: Real-time CPU and Memory

Collection Control

Manage what and when the agent collects data.

Start Full Monitoring

• Action: Begins continuous ETW collection
• When to Use: Production monitoring, always-on audit
• Duration: Runs until you click "Stop"
• Performance: Moderate overhead

Start On-Demand

• Action: Enables collection, waits for trigger
• When to Use: Reproduce-to-diagnose scenarios
• Duration: Triggered by specific events
• Performance: Low until triggered

Stop Collection

• Action: Stops all ETW collection
• Effect: Returns to Health Only mode
• Data: Collected events retained

Interactive Query Sessions

Real-time event investigation and troubleshooting.

Starting a Session

1. Click "Begin Query Session" in agent modal
2. Session activates on agent
3. Live events stream to dashboard
4. Use AI to query and analyze events

Active Session Features

• Session ID: Unique identifier for tracking
• Events Collected: Running count
• Status Indicator: Green = active
• End Session: Stop and review collected data

Use Cases

• Interactive troubleshooting with AI guidance
• Real-time monitoring during deployments
• Investigating intermittent issues
• Performance bottleneck analysis

Deleting Agents

Warning: This permanently removes the agent from your organization.

What Gets Deleted

• Agent registration record
• All health metrics history
• All collected events
• Billing stops immediately

What Happens on the Server

• Agent service continues running
• Cannot connect to cloud (authentication revoked)
• Must reinstall agent to reconnect

Steps

1. Agents page → Click "Delete" (trash icon)
2. Confirm deletion in popup
3. Agent removed from list
4. Billing updated within 1 hour

Real-Time Metrics

All agents report health metrics every 30 seconds, regardless of collection mode.

CPU Usage

• Metric: Overall system CPU utilization %
• Calculation: Average across all cores
• Threshold: >80% = warning, >90% = critical

Memory Usage

• Metric: Physical RAM utilization %
• Calculation: (Used MB / Total MB) * 100
• Threshold: >80% = warning, >90% = critical

Additional Metrics (Future)

• Disk I/O (reads/writes per second)
• Network throughput (bytes sent/received)
• Disk space utilization
• Process count

Health History

View historical health data to identify trends and patterns.

Accessing History

• Agent modal → Health section
• API endpoint: GET /api/agents/{agentId}/health?hours=24

Data Retention

• 7 days: Full granularity (30-second intervals)
• 30 days: 5-minute aggregates
• 90 days: 1-hour aggregates

Alerts & Notifications (Coming Soon)

• CPU/Memory threshold alerts
• Agent offline notifications
• Event pattern detection
• Email and webhook integrations

How AI Diagnostics Work

1. Event Correlation: AI analyzes collected ETW events to identify patterns
2. Context Analysis: Considers system state, timing, and relationships
3. Root Cause: Pinpoints exact cause of issues
4. Recommendations: Provides actionable remediation steps

Query Types

Troubleshooting Queries

Examples:

• "Why did IIS crash at 3:15 PM?"
• "What caused the SQL Server connection failures?"
• "Why can't users access the file share?"

Performance Queries

Examples:

• "What's causing high CPU on WEBSRV-01?"
• "Show me disk I/O bottlenecks"
• "Which processes are using the most memory?"

Security/Audit Queries

Examples:

• "Show all failed file access attempts"
• "What processes connected to external IPs?"
• "List all registry modifications in the last hour"

Best Practices

✅ Do:

• Start collection BEFORE reproducing issues
• Be specific: "SQL deadlock at 10:30 AM" not "database slow"
• Include timeframes: "between 2-3 PM today"
• Mention error messages or codes if known

❌ Don't:

• Ask vague questions: "something is wrong"
• Query without collection enabled
• Expect diagnosis without reproducing issue

Subscription Tiers

Agent Billing

Per-Agent Cost: $8/month per managed agent

How It Works

• Billed based on monthly agent count
• Prorated for partial months
• Automatic billing on subscription renewal
• Desktop agents are FREE (unlimited)

Example Billing

• Subscription: Business tier = $99/month
• Agents: 10 managed agents × $8 = $80/month
• Total: $179/month

Billing Page

Dashboard → Billing shows:

• Current Tier: Subscription level
• Agent Counts: Managed vs Desktop
• Monthly Costs: Subscription + agents
• Next Billing Date: Renewal date
• Payment Method: Card on file
• Invoices: Download past invoices

Free Trial

• Duration: 14 days
• Includes: All Professional tier features
• Agents: Up to 3 managed agents free
• No Credit Card: Required only after trial
• Converts To: Professional tier unless upgraded

Common Scenarios

Application Crash Investigation

1. Navigate to agent in dashboard
2. Click "View" → "Start Full Monitoring"
3. Reproduce the crash
4. Click "Begin Query Session"
5. Ask AI: "Why did [app] crash just now?"
6. Review analysis and follow remediation steps
7. Stop monitoring when done

Performance Bottleneck

1. Check agent health metrics (CPU/Memory)
2. If elevated, start Full Monitoring
3. Let run for 5 minutes during high load
4. Query AI: "What's causing high CPU on this server?"
5. Analyze top resource-consuming processes
6. Investigate specific process if identified

Connectivity Issue

1. Enable Network provider in collection config
2. Start On-Demand collection
3. Reproduce connection attempt
4. Query: "Why can't [app] connect to [server]?"
5. Review TCP connection failures
6. Check DNS resolution, firewall rules

File Access Problem

1. Enable File System provider
2. Start monitoring before attempting file access
3. Try to access file
4. Query: "Why can't [user/app] access [file path]?"
5. Review ACCESS_DENIED events
6. Fix permissions based on AI recommendations

The ET Ducky Method

1. Identify: What system and what problem?
2. Prepare: Enable relevant providers in agent
3. Capture: Start collection BEFORE reproducing
4. Reproduce: Perform action that causes issue
5. Query: Ask AI specific, targeted questions
6. Analyze: Review correlation and root cause
7. Remediate: Follow AI recommendations
8. Verify: Test fix, monitor for recurrence
9. Document: Save findings for future reference

Agent Deployment Strategy

Production Servers

• Deploy as managed agents
• Keep in Health Only mode by default
• Enable Full Monitoring only during incidents
• Use On-Demand for scheduled maintenance windows

Development/Test Systems

• Can use managed or desktop agents
• Full Monitoring acceptable during dev hours
• Turn off during idle periods

User Workstations

• Desktop agents (free) for general monitoring
• Managed agents only for VIP/critical users
• On-Demand only when troubleshooting

Performance Considerations

CPU Impact

• Health Only: <1% CPU
• On-Demand (idle): 1-2% CPU
• On-Demand (active): 5-10% CPU
• Full Monitoring: 8-15% CPU

Memory Impact

• Health Only: ~50 MB
• On-Demand: 50-100 MB
• Full Monitoring: 100-200 MB

Network Impact

• Health metrics: <1 KB every 30 seconds
• Events: Variable (100 KB - 10 MB/hour depending on activity)

Security Best Practices

• Deploy agents with least-privilege service accounts where possible
• Rotate organization authentication tokens periodically
• Use separate organizations for prod/non-prod
• Review team member access regularly
• Delete agents when systems are decommissioned
• Monitor agent offline events for unauthorized removals

Cost Optimization

• Use Desktop agents for non-critical systems
• Delete inactive/offline agents promptly
• Keep agents in Health Only mode when not troubleshooting
• Right-size subscription tier to actual usage
• Monitor monthly agent count in Billing page

Getting Help

Support Channels

• Email: [email protected]
• Documentation: This page
• Status Page: status.etducky.com

When Contacting Support

Include:

• Organization ID
• Agent ID (if agent-specific)
• Screenshot of issue
• Steps to reproduce
• Agent version and Windows version

Roadmap & Upcoming Features

• Advanced alerting and notifications
• Historical event search and analysis
• Custom dashboards and visualizations
• API access for integrations
• Webhook support for external systems
• Mobile app for iOS and Android

What Are Agent Seats?

Agent seats allow you to deploy ET Ducky monitoring agents across your Windows infrastructure. Each system running an agent requires one seat. Agent seats are priced separately from query subscriptions.

How Agents Use Queries

• Agents capture and correlate ETW events on remote systems
• Live query sessions use your organization's query subscription
• Agent seats provide the infrastructure, queries provide the diagnostics
• Multiple agents share the same query pool

Agent Features

• Deploy on unlimited Windows systems
• Real-time ETW event collection and monitoring
• Cloud-managed configuration and updates
• Health metrics tracking for all deployed systems
• Live query sessions for interactive troubleshooting

Volume Pricing

Agent seats use tiered volume pricing. The more seats you purchase, the lower your per-seat cost.

Billing Options

• Monthly Billing: Standard per-seat pricing
• Annual Billing: Save 15% with annual commitment
• Proration: Changes to seat count are prorated automatically
• Separate Billing: Agent seats billed separately from query subscriptions

Example Costs

Purchase Agent Seats

Interactive pricing calculator with real-time volume discounts

Query Subscriptions

What counts as a query?

Each request to process correlated ETW events through the ET Ducky API server counts as one query. This includes diagnostic requests from the Desktop app, live session queries from agents, and event correlation analysis.

Can I use queries with both the Desktop app and agents?

Yes. Your query subscription provides a shared pool that works with both the Desktop application and any deployed agents. All queries count against the same monthly quota regardless of source.

Can I use my own Anthropic API key?

Yes. The Free tier lets you bring your own Anthropic API key with no query limits. Paid tiers include cloud-hosted processing so you don't need your own key.

What happens if I exceed my quota?

Once your monthly quota is reached, cloud-based processing will be paused until the next billing cycle. You can upgrade at any time, or switch to BYOK mode.

Do queries reset monthly?

Yes. Your query quota resets at the start of each billing cycle. Unused queries do not roll over.

How does organization quota pooling work?

When multiple users join an organization, their individual query quotas combine into a shared pool. For example, if 3 users each have Professional plans (1,000 queries each), the organization gets a pool of 3,000 queries that any member can use from Desktop or agents.

Is the Desktop application free?

Yes. The Desktop application is a free download. You only pay for the query subscription tier that provides access to process events through the ET Ducky API.

Agent Seats

What are agent seats?

Agent seats allow you to deploy ET Ducky monitoring agents across multiple Windows systems. Each system running an agent requires one seat. Agent seats are priced separately from query subscriptions.

Do I need both a query subscription and agent seats?

It depends on your use case. If you only use the Desktop app on your local machine, you just need a query subscription. If you want to monitor remote servers with agents, you need both: a query subscription for processing and agent seats for deployment.

Do agents consume queries?

Yes. When you run live query sessions on agents, they use queries from your organization's shared pool. The agent seat provides the monitoring infrastructure, but diagnostic analysis uses your query quota.

Can I change my seat count?

Yes. You can add or remove seats at any time through the dashboard. Changes are prorated automatically and reflected in your next billing cycle.

What happens if I remove an agent seat?

When you reduce your seat count, the change takes effect immediately and your billing is adjusted. The agent will stop functioning and must be uninstalled from the system or reinstalled with a new seat allocation.

Are there any setup fees?

No. There are no setup fees, activation fees, or hidden costs. You only pay for your query subscription and the number of agent seats you use each month.

Billing

How am I billed?

Query subscriptions are billed monthly or annually. Agent seats are billed monthly based on your seat count, with optional 15% savings on annual commitments. All billing is handled through Stripe.

Can I switch plans?

Yes. You can upgrade or downgrade your query subscription at any time. Changes take effect immediately, and we'll prorate the billing difference.

What payment methods do you accept?

We accept all major credit cards through Stripe. Enterprise customers can request invoice billing.

Can I get a refund?

We offer prorated refunds for annual subscriptions if you cancel within the first 30 days. Monthly subscriptions can be canceled at any time and will not renew, but are not refundable.