Packages that an Intune-deployed collector uploaded with the
upload token of your inbox key.
Set up this inbox
1
Keep the inbox key
Shown once, and the only way to open or clear this
inbox. It is sent in the request body, never in the URL, so it can't
leak into logs or browser history. Never put it in a script.
Self-hosted and want this server to accept
only your inboxes? Add this value to the
UPLOAD_NAMESPACES setting:
This is a legacy
token without the shk_ prefix: the same secret uploads
and reads the inbox, so anyone who can see the detection
script can read every package. Generate a new inbox key and redeploy.
2
Copy the detection script
The device upload token is already filled in. It can
upload and report collection status, nothing else.
We do our best to redact
tenant- and company data (tenant id/name, domain, UPN/e-mail, device
and user name) from all TEXT files — but this is best-effort, not
a guarantee. Binaries (event logs, cab) are not scrubbed; review
the package before sharing.
The script pins the SHA-256 of the collector this
server serves (90273F401AFD616CC5E9F19DE7AB668F5B50AF473F36DD6F43A5962728BA29CA) and refuses to run
anything else. After a Sherlog update that changes the collector,
copy the script again.
3
Deploy in Intune
Intune admin center → Devices →
Scripts and remediations → Create.
Paste the script as the Detection script. This one
script does the collection, so no remediation script is
needed (leave it empty).
Run script in 64-bit PowerShell = Yes;
Run using logged-on credentials = No
(runs as SYSTEM); signature check = No.
Assign to a device group (the detection script runs on schedule),
or pick a device → Run remediation.