SG SealGrid Athena Docs

Collections

Collections group agents so you can reuse the same set of machines as a deployment or targeting audience. A collection is either static (a hand-picked member list) or dynamic (membership is derived automatically from agent metadata using filter rules). Collections are managed via api/Collections.

Walkthrough — grouping machines with Collections: what the Collections page shows, static versus dynamic membership, and creating a metadata-based (dynamic) collection.
The Collections page in Athena
The Collections page — static and compliance collections grouping managed agents, with type, member count, and last-updated.

Static vs. dynamic#

Every collection declares a type:

TypeMembershipMaintenance
StaticAn explicit list of agent IDs you assign.You add and remove members by hand.
DynamicEvery agent that matches the collection's filter rules.Membership is recomputed automatically — no manual edits.
A metadata-based collection is a dynamic collection

To "create a collection from metadata," create a Dynamic collection and describe the agents you want with one or more filters. Each filter tests an agent field (its metadata) against a value. Athena evaluates the filters against the fleet and keeps membership in sync as agents change.

Creating a collection#

Send a POST to api/Collections (an Operator or Admin token is required). The request body has these fields:

FieldUsed byDescription
namebothRequired. Display name for the collection.
descriptionbothOptional free-text description.
typebothStatic or Dynamic.
memberIdsstaticList of agent GUIDs to include.
filtersdynamicList of filter rules that define membership.

Static collection#

POST /api/collections
{
  "name": "Production Servers",
  "description": "All production servers",
  "type": "Static",
  "memberIds": ["550e8400-e29b-41d4-a716-446655440000"]
}

Dynamic (metadata-based) collection#

For a metadata-based collection, set type to Dynamic and supply filters. Each filter names a fieldPath (the agent field to read), an operator, and a value to compare against:

POST /api/collections
{
  "name": "Windows Servers",
  "description": "All Windows Server machines",
  "type": "Dynamic",
  "filters": [
    {
      "fieldPath": "OperatingSystem.ProductName",
      "operator": "Contains",
      "value": "Windows Server"
    }
  ]
}

On success the API returns 201 Created with the new collection (including its generated id and current memberCount).

Filter rules#

A dynamic collection holds a list of filters. Each filter is one fieldPath · operator · value comparison, plus a group that controls how the filters combine:

FieldDescription
fieldPathThe agent field to read (see available fields). Supports dotted paths into nested objects, scan results, and custom metadata.
operatorHow to compare the field value against value (see operators below).
valueThe value to compare against. Compared case-insensitively; numbers and dates are parsed when both sides are numeric/date-like.
groupAll = every filter must match (AND); Any = at least one filter must match (OR). The group of the first filter decides the logic for the whole collection.

Operators#

The supported operator values are:

OperatorMatches when the field value…Field types
Equalsequals the valueString, Number, DateTime, Boolean
NotEqualsdoes not equal the valueString, Number, DateTime, Boolean
Containscontains the value as a substringString
NotContainsdoes not contain the valueString
StartsWithstarts with the valueString
EndsWithends with the valueString
GreaterThanis greater than the valueNumber, DateTime
LessThanis less than the valueNumber, DateTime
GreaterThanOrEqualis greater than or equal to the valueNumber, DateTime
LessThanOrEqualis less than or equal to the valueNumber, DateTime

Available fields#

Call GET api/Collections/fields to retrieve the full, live list of filterable fields. The response includes Athena's predefined fields plus any fields discovered from your PowerShell scan results. A selection of the predefined fields:

CategoryField pathTypeExample
AgentMachineNameStringSERVER01, WEB-SERVER-01
AgentOperatingSystemStringWindows 11, Windows Server 2019
AgentIpAddressString192.168.1.100
AgentStatusStringOnline, Offline
AgentAgentVersionString1.1.0
System TypeIsServerBooleanTrue / False
System TypeIsLaptopBooleanTrue / False
System TypeIsVirtualMachineBooleanTrue / False
System TypeIsDomainJoinedBooleanTrue / False
System TypeChassisTypeStringDesktop, Laptop, Server
System InformationDomainNameStringCONTOSO, WORKGROUP
System InformationOSVersionStringMicrosoft Windows 11 Pro
HardwareManufacturerStringDell Inc., HP, Lenovo
HardwareTotalMemoryMBNumber16384, 32768
SecurityTPMPresentBooleanTrue / False
SecurityBitLockerStatusStringEnabled, Disabled
SoftwareInstalledSoftware.NameStringGoogle Chrome, 7-Zip
ServicesServices.ServiceNameStringwuauserv, Spooler
Agent StatusIsStaleBooleanTrue / False
AdvancedMetadataStringSearches across all metadata fields
Custom metadata & scan fields

If a fieldPath is not one of the built-in agent properties, Athena falls back to the agent's metadata dictionary, so custom values reported by your PowerShell collectors are filterable too. Fields from scan results use the Scan.<scanDefinitionId>.<field> path form and appear in GET api/Collections/fields once a scan has returned data.

Membership & refresh#

List the agents currently in a collection with GET api/Collections/{id}/members. For a dynamic collection this returns the agents matching the current filters; for a static collection it returns the assigned members.

EndpointPurpose
GET api/Collections/{id}/membersList the member agents
POST api/Collections/{id}/membersAdd agents (static collections only)
DELETE api/Collections/{id}/membersRemove agents (static collections only)
POST api/Collections/{id}/refreshRe-evaluate filters now (dynamic collections only)

You cannot add or remove members on a dynamic collection by hand — update its filters instead (via PUT api/Collections/{id}). Likewise, refresh only applies to dynamic collections; static collections are managed manually.

Dynamic membership updates in real time

Dynamic collections are recomputed automatically as agents report in: when an agent sends a heartbeat, Athena re-evaluates the dynamic collections affected by that agent and updates membership immediately. Use POST api/Collections/{id}/refresh when you want to force a full re-evaluation on demand (for example, right after changing the filters).

PowerShell#

The Athena PowerShell module wraps the same API in New-AthenaCollection (Operator or Admin role required):

# Static collection with initial members
$agentIds = (Get-AthenaAgent | Where-Object { $_.Tags -contains "prod" }).Id
New-AthenaCollection -Name "Production" -Type Static -MemberIds $agentIds

# Dynamic (metadata-based) collection of Windows Servers
$filter = [PSCustomObject]@{
    FieldPath = "OperatingSystem.ProductName"
    Operator  = "Contains"
    Value     = "Windows Server"
    Group     = "All"
}
New-AthenaCollection -Name "Windows Servers" -Type Dynamic -Filters @($filter)

Using a collection as a target#

Once a collection exists, use it as a reusable audience when rolling out software. See Software Deployment → Targeting for how deployments aim at agents by ID, tag, or collection.