ET Ducky

ET Ducky offers real-time monitoring of Windows Event Tracing (ETW) with a focus on quick, actionable diagnostics. Key features include: • Real-time ETW event monitoring • On-agent data correlation and PII filtering • Clear root cause analysis and recommended fixes • Centralized dashboard for fleet-wide visibility • Multiple collection modes for resource control This platform is engineered for incident response speed, ensuring that raw ETW event data remains on the endpoint. A local correlation engine processes data, filters out sensitive information, and generates a structured diagnostic summary on-agent. Only these sanitized, actionable findings are then transmitted, significantly enhancing data privacy and reducing network overhead. ET Ducky provides low noise and high signal diagnostics through flexible collection modes—Health, On-Demand, and Full—allowing precise control over resource consumption. Users can collect only essential data when needed, with the option for auto-stopping windows. The platform facilitates a single pane of glass view for an entire Windows infrastructure, offering health metrics, customizable alerts, live query sessions, and remote access capabilities. It is ideal for Windows administrators, MSPs, enterprise operations, and security teams who need comprehensive system understanding without complex log analysis or extensive query language knowledge. Perfect for rapid problem resolution and maintaining system health across deployments.