> For the complete documentation index, see [llms.txt](https://docs.alpha-security.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alpha-security.app/getting-started/first-capture.md).

# First Capture

Once the server is running and you have an engagement created, set up the collector on your testing machine.

## Get the collector

Download the prebuilt binary from the [GitHub Releases](https://github.com/shoamshilo/alpha-security/releases) page, or build it yourself:

```bash
cd collector
go build -o al ./cmd/al
```

## Enroll the collector

The collector needs a token to authenticate with the server. Create a collector token in the web UI (go to your engagement, then **Settings > Collectors**) and enroll:

```bash
./al enroll --server http://your-alpha-server --token <paste-token-here>
```

The token is stored securely in your OS keyring (or a local config file as fallback).

## Capture a command

Prefix any command with `al run`:

```bash
./al run nmap -sV 10.0.0.1
```

The command runs exactly as you typed it. Alpha captures the output through a PTY and sends it to the server. The raw output is stored, and if Alpha has a parser for the tool, it extracts structured entities (hosts, services, findings) automatically.

## Capture an entire shell session

For hands-free capture across an entire session:

```bash
./al shell
```

This starts a new shell where every command you type is captured. Pentest tools get their full output captured and parsed. Other commands are recorded as metadata only.

## Verify it worked

Go back to the web UI, open your engagement, and you should see the run in the activity timeline. If Alpha parsed the output, you'll also see the entities it extracted (hosts, services, etc.) in the entity views and graph.

## Query from the terminal

The collector can also query the server:

```bash
./al query host              # list all hosts
./al query credential        # list credentials
./al loot                    # show loot (masked by default)
./al loot --reveal           # show secrets (audited)
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.alpha-security.app/getting-started/first-capture.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.