A method includes receiving data collected from a plurality of managed devices in a plurality of data collections. The data collections are performed using a plurality of collection protocols. A trigger that generated each of given ones of the data collections is determined. The method further includes identifying a collection protocol of the plurality of collection protocols used for each of the given ones of the data collections, and determining one or more attributes of a plurality of attributes of the plurality of managed devices that have been collected using given ones of the collection protocols. A mapping is generated between the triggers, the collection protocols and the attributes using one or more machine learning algorithms. The generated mapping is used to predict one or more collection protocols of the plurality of collection protocols to use to collect data from one or more of the managed devices.