Desktop App
What the Desktop App Is
The ET Ducky desktop app runs on Windows 10 and 11. It captures ETW events on the computer it runs on, answers questions about them in Ducky Chat, and, once you sign in, shows your organization's fleet. Download it from Downloads; it updates itself when a new release ships.
A Local and Fleet switch at the top of the window chooses what the sidebar shows.
| Mode | Pages |
|---|---|
| Local (this computer) | Dashboard (monitoring and Ducky Chat), Events, Process Documentation, System Analysis, Dynamic Diagnostics |
| Fleet (your organization, signed in) | Dashboard, Agents, Reports, Smart Reports, Alerts, Tickets, Patch Management, Scripts & Commands, Token Deployment, Team, Subscriptions |
| Both | Settings, Account |
Local mode works without an account. Fleet mode, the subscription and ticket attachments need you to sign in.
Signing In and Choosing an Organization
Sign in from Account or from Settings > Subscription Management > Sign In / Create Account. Account shows your email, the active organization with your role, and Switch Org.
Questions that go to ET Ducky's servers need an active organization. If you belong to more than one, the app asks you to choose; an organization picker also appears above the Dashboard, so you can choose without leaving Ducky Chat. Until one is chosen, a cloud question stops with a message saying what to do instead of failing.
Sign Out (Settings or Account) ends the session and removes any saved AI provider key from this computer (see Ducky Chat's AI). The next sign-in asks for your credentials again.
Ducky Chat's AI: Subscription or Your Own Key
Ducky Chat answers through one of two sources:
- ET Ducky subscription. Signed in with an active subscription. Each question draws from the organization's query pool (see AI Usage & Quotas). The question is answered on ET Ducky's servers.
- Your own API key (free tier). Set up under Settings > ET Ducky Cloud API > Set Up Free Tier (BYOK). The app calls the provider directly from this computer and your provider bills you per token. The free tier is for non-commercial use.
Setting up a key
| Provider | Fields |
|---|---|
| Anthropic Claude | Claude API Key (sk-ant-...), Model |
| OpenAI ChatGPT | OpenAI API Key (sk-...), Model |
| Azure OpenAI (Copilot) | Azure Endpoint, Azure API Key, Deployment Name |
- Model. Leave it blank for the provider's default, type a model id, or click Load models to list the models your key can use and pick one from Models available to this key (Claude and ChatGPT).
- Save & Use Free Tier saves the key. A key can be saved while signed out.
- A saved key is never shown again. The key field stays empty and its hint shows the last four characters; leaving the field blank keeps the saved key.
- The Saved API keys panel names each saved key by provider and last four characters. Remove saved API keys deletes them.
- Signing out, or clicking Disconnect under ET Ducky Cloud API, also deletes them.
Choosing which one answers
While a key is saved, Ducky Chat uses it by default. When you also have an active subscription, an Answer with selector appears in the Ducky Chat header: My API key or ET Ducky subscription. The app remembers the choice. The selector applies to every Ducky Chat question, including baseline requests and troubleshooting questions.
The free-tier key is separate from the workspace and organization keys set in the web dashboard (see BYOK).
The key is stored on this computer only, encrypted for your Windows account (see Data Kept on This Computer). It is not sent to ET Ducky.
Monitoring and Ducky Chat
The Dashboard has Start Monitoring and Stop Monitoring, chips to toggle the File System, Registry, Process and Network event types, and running totals. Ask a question in Ducky Chat and send it with Analyze or Ctrl+Enter.
- Context Mode. When on, the question goes with the captured events and a short description of this computer: Windows version and build, memory, system disk space, CPU load, the antivirus product (named only from a fixed list of vendors, otherwise "unknown"), domain or workgroup, and uptime. When off, neither the events nor the computer description are sent.
- Cited events. Answers refer to the events they rely on as numbered links (for example
#1234). A link opens the Events page showing only the cited events. If a cited event has since left the live buffer, the page says how many are missing. - Rule verdicts. Chips above an answer name the detection rules that matched. Clicking one opens the events that rule matched.
- Suggested providers. When an answer would be better with another ETW provider, the app offers an Enable button for it.
- Evidence. Each answer has an evidence menu with Export evidence and Attach to ticket (see Chat Evidence in the Desktop App).
- Ask about this. From an agent's Security tab in Fleet mode, a detection can be sent to Ducky Chat as the start of a question (see Detection Evidence in the Desktop App).
- Baselines from chat. "Record a baseline for outlook" or "compare outlook to its baseline" runs a 30-second capture (see Known-Good Baselines). Live monitoring pauses for the capture and resumes afterwards.
Two settings under Settings > Ducky Chat depth control how much each question uses: Events sent to local correlation (200 to 10,000) and Events shown to the AI as evidence (10 to 200). Higher values give a more thorough answer and use more tokens per question.
Events
The Events page lists the captured events with a quick search over path, operation and process, event type filters (FS, Reg, Proc, Net), an advanced filter, and a Live / Paused switch. The header shows how many events were captured and how many are kept in memory. A cited-event link from Ducky Chat opens this page filtered to those events; Clear returns to the full list.
System Analysis
Run Analysis scores this computer's health from disk, memory, process, performance and startup checks, lists issues and recommendations, and shows per-process activity since monitoring started. Quick diagnostics check disk space, scan a drive for large files, analyze memory and list startup programs.
Known-good baselines
A baseline records the registry, file, network and process activity of an application while it works, so a failing run can be compared against it later.
- Stop live monitoring. The desktop app runs one kernel capture at a time; the panel offers Stop monitoring.
- Enter the Process (for example
outlook.exe, oroutlook.exe|olk.exefor more than one), What you will do, and Seconds (5 to 300). - Click Record baseline and perform the action while it records.
Saved baselines lists each baseline with its host, time and entry count, and offers Compare, Export JSON and Delete. Compare captures a new run and lists the differences grouped by severity, each with its kind, target, operation, the baseline result and this run's result. Send to chat attaches the comparison to your next Ducky Chat question.
File I/O latency
Run times file operations for 60 seconds and ranks the slowest folders, processes and file extensions. Live monitoring pauses during the run and resumes after it.
- Recommended for review. An antivirus exclusion is suggested only for a folder or process under a known security vendor's install location whose owning process is validly signed, and only from a full 60-second run.
- Observed, not recommended. Every other slow folder or process, listed with the process, its image path and its signer, so you can judge it yourself.
- The app never writes or runs an exclusion command. Send to chat attaches the results to your next Ducky Chat question.
Process Documentation and Dynamic Diagnostics
Process Documentation records a Windows procedure while you perform it (with optional screenshots) and has the AI write a KB article from the captured event timeline. To make articles follow your own format, paste a sample article under Settings > Process Documentation Template; it is stored on this computer only.
Dynamic Diagnostics takes a description of a problem, lets the AI choose which ETW providers to capture on this computer over up to 10 rounds, shows the evidence as it arrives, and proposes a PowerShell script that you review, can edit, and run yourself.
Fleet Mode
Fleet mode shows the active organization, with the same names and order as the web dashboard's sidebar. An agent's page has the tabs Overview, Inventory, Patches, Security, Configuration, Tags and Timeline:
- Security shows each detection's evidence, tags and surrounding events (see Detection Evidence in the Desktop App).
- Timeline draws the host's health, detections, inflections, patch jobs, configuration changes, alerts, tickets and troubleshooting runs on one time axis (see Per-Host Timeline in the Desktop App).
Live sessions, multi-agent sessions and remote desktop open from Fleet mode as they do in the dashboard (see Live Sessions and Remote Desktop).
Settings Reference
| Section | What it controls |
|---|---|
| ETW Monitoring Configuration | Which kernel, user-mode and hardware providers the local capture enables, with Enable All, Disable All and Reset to Defaults, and an estimated event rate |
| Ducky Chat depth | Events sent to local correlation; events shown to the AI as evidence |
| Filtering Options | Ignore ET Ducky process events (recommended on) |
| ET Ducky Cloud API | Free tier (BYOK) setup, Saved API keys, Disconnect |
| Subscription Management | Sign in, plan and quota, Manage Subscription or View Plans and Upgrade, Sign Out |
| Appearance | Dark mode |
| Application Settings | Save chat history on exit; Keep chat evidence on this computer (default on); Keep memory evidence (default off); Clear evidence |
| Process Documentation Template | Style template (Markdown) for generated KB articles |
Data Kept on This Computer
| Location | Holds |
|---|---|
%LOCALAPPDATA%\ETWMonitor\appsettings.json | Settings, including the process documentation template. No API keys. |
%LOCALAPPDATA%\ETWMonitor\byok.dat | Saved AI provider keys, encrypted with Windows DPAPI for your Windows account. Deleted by sign-out, Disconnect and Remove saved API keys. |
%LOCALAPPDATA%\ETWMonitor\chat_history.json | Ducky Chat history, kept between sessions only when Save chat history on exit is on. |
%LOCALAPPDATA%\ETWMonitor\evidence\ | Chat evidence records (see Chat Evidence). |
%APPDATA%\ETDucky\baselines.v2.json | Known-good baselines. |
The security whitepaper describes how the app protects these files.
Recent Changes
| Version | Changes |
|---|---|
| 2.8.5 | Detection evidence and Ask about this on an agent's Security tab; chat evidence export and Attach to ticket; the per-host Timeline tab; baseline requests in chat follow the Answer with choice |
| 2.8.4 | Saved API keys encrypted and removed at sign-out; Load models and model choice; the Answer with selector; the organization picker on the Dashboard; the next sign-in after a sign-out asks for credentials |
| 2.8.1 | Cited events in Ducky Chat; the computer description with Context Mode; known-good baselines; File I/O latency with exclusion review |