Audit Modules

This section describes each audit module used by ADD Product Series appliances to collect and display data collected by the agents on the host endpoints. Select the audit module for more detailed information. Some input and output parameters may not be supported on some operating system platforms.

Audit Module	Supported Platforms
Audit Module	Windows	macOS	Linux
agentinfo	Yes	Yes	Yes
config	Yes	Yes	Yes
configuration	Yes	Yes	Yes
containment	Yes	Yes	No
cookiehistory	Yes	Yes	No
diagnostic	Yes	Yes	Yes
disk‑acquisition	Yes	No	No
disks	Yes	Yes	Yes
dissolve	Yes	No	No
driver‑memoryacquire	Yes	No	No
drivers‑modulelist	Yes	No	No
drivers‑signature	Yes	No	No
eventbuffer	Yes	Yes	Yes
eventlogs	Yes	No	No
file‑acquisition‑api	Yes	Yes	Yes
file‑acquisition‑raw	Yes	No	No
filedownloadhistory	Yes	Yes	No
files‑api	Yes	Yes	Yes
files‑raw	Yes	No	No
formhistory	Yes	Yes	No
groups	No	Yes	Yes
hivelist	Yes	No	No
intel‑key	Yes	Yes	No
iocload	Yes	Yes	Yes
iocmatch	Yes	Yes	Yes
kernel‑hookdetection	Yes	No	No
log‑audit	Yes	Yes	Yes
memory‑acquisition	Yes	No	No
multifile‑acquisition‑api	Yes	Yes	Yes
multifile‑acquisition‑raw	Yes	No	No
network‑arp	Yes	Yes	Yes
network‑dns	Yes	Yes	No
network‑route	Yes	Yes	Yes
persistence	Yes	Yes	No
plist‑acquisition	No	Yes	No
ports	Yes	Yes	Yes
prefetch	Yes	No	No
processes‑api	Yes	Yes	Yes
processes‑handle	Yes	No	No
processes‑memory	Yes	No	No
processes‑memoryacquire	Yes	No	No
quarantine-acquire-file	Yes	Yes	No
quarantine‑events	No	Yes	No
quarantine-list-items	Yes	Yes	No
quarantine-purge-file	Yes	Yes	No
quarantine-restore-file	Yes	Yes	No
registry‑api	Yes	No	No
registry‑raw	Yes	No	No
reprovision	Yes	Yes	Yes
restart	Yes	Yes	Yes
services	Yes	Yes	No
shell-history	No	No	Yes
stateagentinspector	Yes	Yes	No
sysinfo	Yes	Yes	Yes
syslog	No	Yes	Yes
systemrestore	Yes	No	No
tasks	Yes	Yes	Yes
upgrade	Yes	Yes	Yes
urlhistory	Yes	Yes	No
useraccounts	Yes	Yes	No
volumes	Yes	Yes	Yes