# Evidence Collection Agent
URL: https://docs.autociso.io/console/operations/evidence-agent/
Description: The Evidence Agent automates the collection of compliance evidence such as screenshots and configuration data for frameworks like SOC 2 and ISO 27001.

*This is the help text the console shows in the help panel on this page.*

The Evidence Agent automates the collection of [compliance evidence](https://docs.autociso.io/console/iso/evidence/) such as screenshots and configuration data for frameworks like SOC 2 and ISO 27001. Instead of manually capturing evidence from each tool, you pick a **blueprint** and the agent gathers it on demand. It is available on [The Growth plan](https://docs.autociso.io/getting-started/plans-and-features/) or higher; [only owners and managers](https://docs.autociso.io/getting-started/roles-and-permissions/) can start, cancel or unblock jobs.

### The page
- **New Collection** starts a job.
- Counters show **Total Jobs**, **Completed** and **Running**.
- **Recent Jobs** lists each job with its blueprint, status, **Started** and **Completed** times and number of artifacts. Row buttons open the details, submit an MFA code, or cancel the job.
- **Available Blueprints** lists the templates. Click one to start it.

### Blueprints
Blueprints are ready-made collection templates. Today they are **GitHub Branch Protection**, **GitHub Org MFA Policy**, **GitHub Organization Members**, **AWS IAM Password Policy** and **Generic Page Screenshot**. Each shows the [compliance controls it supports](https://docs.autociso.io/console/iso/soa/), and an **Auth required** tag when it needs to sign in.

### Starting a collection
1. Click **New Collection** (or click a blueprint).
2. Choose the blueprint and review its steps.
3. *(Optional)* Enter a **Target URL** to override the default page.
4. If the blueprint needs a sign-in, enter the username/email and password. They are used only for this session and are not stored.
5. Click **Start Collection**.

### Job Lifecycle
1. **PENDING**: Job queued and waiting to run.
2. **RUNNING**: The agent is connecting to the external system and collecting artifacts.
3. **WAITING_MFA**: The agent needs a one-time code (see below).
4. **COMPLETED**: Artifacts collected. [Open the job to review them](https://docs.autociso.io/console/operations/evidence-job/).
5. **FAILED**: A step failed — open the job and read the error and activity log.
6. **CANCELLED**: You cancelled the job.

### MFA Prompts
If a system is protected by MFA, the job pauses in **WAITING_MFA**. Click the key button on the row (or **Enter MFA** on the job page), type the 6-digit code from your authenticator app and click **Submit**. Do it quickly to avoid a session timeout.