An agent with Process Tracker enabled will report the following additional information within the AgentInfo audit. The prefix for the keys on the following fields is AgentInfo/ProcessTracker.
Field<type> | Description |
|---|---|
version<text> | Version of the Process Tracker agent module installed on the endpoint. |
operational<bool> | The module is operational and monitoring for process execution events. |
processEventCount<unsigned 64> | Number of process execution events encountered since installation. |
uniqueProcessCount<unsigned 64> | Number of unique process execution events encountered since installation. |
augmentationErrors<unsigned 64> | Number of process execution events that the module failed to collect the event metadata. |
lastEventTimestamp<text> | Time of last process execution event that was encountered, ISO 8601. |
lastMessageTimestamp<text> | Time of last process execution event streamed to the Endpoint Security Server, ISO 8601. |
lastDBResetTimestamp<text> | Time of last database reset, ISO 8601. |
store<enum-text> | Database storage mode: database : disk, persistent memory-only: in memory, degraded, lost upon restart |
queueDepth<unsigned 64> | Number of process execution events awaiting augmentation before being streamed to the Endpoint Security server. |
maxQueueDepth<unsigned 64> | High water mark of the queueDepth since restart. |
minQueueTimeMs<float> | Minimum time queued for processing since restart. |
maxQueueTimeMs<float> | Maximum time queued for processing since restart. |
avgQueueTimeMs<float> | Average time queued for processing since restart. |
queueTimeStdDevMs<float> | Standard deviation for time queued for processing since restart. |
maxRunTimeMs<float> | Maximum time elapsed while processing an event since restart. |
minRunTimeMs<float> | Minimum time elapsed while processing an event since restart. |
avgRunTimeMs<float> | Average time elapsed while processing an event since restart. |
runTimeStdDevMs<float> | Standard deviation for elapsed time while processing an event since restart. |
excludedProcessPaths<unsigned 64> | Number of times that a process event was excluded via process exclusion since install. For more information, see Configuring the Process Tracker agent policy. |
excludedFilePatterns<unsigned 64> | Number of times that a process event was excluded via file or path exclusion since install. For more information, see Configuring the Process Tracker agent policy. |
excludedAgentProcs<unsigned 64> | Number of times that Endpoint Security agent excluded itself since install. |