Kansa collect

.\kansa.ps1 -TargetList hosts.txt -Analysis

Collect data from Windows hosts in the domain with Kansa, launching collection modules from a target list.

Run it when you need distributed collection without agents: Kansa uses PowerShell remoting (WinRM) to launch modules (processes, connections, Run keys, services, filtered EVTX) on hosts from the list (-TargetList) and consolidates results into CSV. The -Analysis mode adds analysis of collected data (processes per host, common Run keys). In IR, Kansa is the lightweight alternative to Velociraptor when agents cannot be deployed: collection across the domain with WinRM and consolidation of results. The same tool serves for point-in-time collection and response.

Do not use it if WinRM is not enabled or is restricted: collection will fail host by host. Collection via PowerShell remoting is noisy (4624/4648 of management connections) — in monitored environments, mass collection can trigger lateral movement alerts; coordinate with the SOC. And watch out for volume: modules that collect full EVTX generate traffic and load — choose modules per question. The -Analysis mode aggregates; deep analysis is the team's job. For agent-based collection (more robust), use Velociraptor; Kansa is the agentless route.