product · collector
Wytness Collector
No-SDK capture. A container you run that turns the Microsoft Foundry and Copilot Studio telemetry you already have into signed, PII-tokenised audit events.
Some agents will never call an SDK — a Copilot Studio bot a business team built, a Foundry deployment owned by another department. Their activity already lands in Application Insights and Log Analytics. The Collector polls those stores, converts each row into a Wytness event, signs and tokenises it inside your own boundary, and ships it to the same Ledger, Registry, and Shield views as everything else.
how it works
Poll. Map. Sign. Ship.
One container, running wherever you run containers. Your keys and source credentials never leave it.
poll
Reads new Microsoft Foundry tracing and Copilot Studio telemetry rows from Log Analytics on a cadence, resuming from a persisted cursor.
map
Converts each row into a Wytness event with a deterministic ID, so re-reads and replays never duplicate.
sign + tokenise
Signs with your Ed25519 key and tokenises PII inside the container — the same customer-held-key crypto the SDK uses. Wytness never sees your keys or source credentials.
ship
POSTs signed envelopes to your ingest endpoint. Delivery outages dead-letter to the volume and replay automatically; duplicates collapse server-side.
the honest part
A different guarantee, labelled as one
SDK events attest an action at the moment it happened. Collected events prove the log content is untouched since pickup — a real guarantee, deliberately labelled below the SDK's and never conflated with it. The dashboard and every Evidence Pack show which tier each event carries.
| SDK | Collector | |
|---|---|---|
| Code on your agent's runtime | ~3 lines | 0 — a container beside it |
| Ed25519 signing with your key | ✓ at the action | ✓ at pickup |
| PII tokenised inside your boundary | ✓ | ✓ |
| Proves the action at the moment it happened | ✓ | — |
| Proves the log untouched since pickup | ✓ | ✓ |
| AGT hash chain ingested | ✓ | — |
| Assurance tier shown to auditors | signed at action | collected |
your boundary
Credentials stay yours
The Collector authenticates to your Log Analytics workspaces with credentials you configure in the container or mount from your vault — Wytness never stores them. Signing and PII tokenisation happen before anything leaves your network, with the same customer-held keys the SDK uses.
Use a dedicated API key and a dedicated signing keypair for each collector so its activity is attributable and revocable on its own. Instances register themselves, send heartbeats, and surface per-source errors and silence warnings on the Collectors page in your dashboard.
inside your boundary
log analytics creds → your container only ed25519 signing key → your container only pii tokenisation keys → your container only signed envelopes → the only thing shipped
run it
One container. One volume.
The volume persists the poll cursor and the dead-letter file, so restarts never re-ship or lose events.
docker run -d --name wytness-collector \ --restart unless-stopped \ --memory=512m --cpus=1 \ -v wytness-collector-state:/var/lib/wytness-collector \ -e WYTNESS_API_KEY=... -e WYTNESS_ENDPOINT=... -e WYTNESS_SIGNING_KEY=... \ -e WYTNESS_PII_PUBKEY=... -e WYTNESS_PII_SECRET=... \ -e COLLECTOR_SOURCES='[...]' \ ghcr.io/wytness-ai/wytness-collector:0.1.0Source configuration, resilience behaviour, and every environment variable are in the Collector reference.
availability
Business and up
| Starter | Growth | Business | Enterprise | |
|---|---|---|---|---|
| Wytness Collector | — | — | ✓ | ✓ |
Capture the agents you didn't build.
Foundry and Copilot Studio activity in the same audit trail as everything else.
the code path: Built on AGT · the surfaces it feeds: Ledger · Registry · Shield