..
    generated, remove this comment to keep this file

``cit.telemetry``
=================

.. code-block:: console

    $ target-query <path/to/target> -f cit.telemetry


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``os.windows.regf.cit.CITPlugin``
    * - Output
      - ``records``

**Module documentation**

Plugin that parses CIT data from the registry.

Reference:
- https://dfir.ru/2018/12/02/the-cit-database-and-the-syscache-hive/

**Function documentation**

Parse CIT process telemetry answers from the registry.

In some versions of Windows, processes would get "telemetry answers" set on their process struct, based on
if certain events happened.

Generally only available before Windows 10.