Device Search and Historical Search column name

PID

Unique Process ID assigned by the operating system to the running process. Helps track individual process instances.

Equals

Does not Equal

Less than

Less than or equal to

Greater than

Greater than or equal to

Between

Parent PID (PPID)

Process ID of the parent process that launched the current process. Used for process lineage analysis and detecting suspicious parent-child relationships.

Process Integrity

Security or trust level applied to the process by the operating system (for example, low/medium/high integrity level on Windows). Helps identify privilege levels or elevated processes.

Size (Bytes)

Provides the file size in bytes, enabling comparison against expected file sizes or detection of anomalies.

Source Port

Shows the originating port number used by the connection.

Destination Port

Displays the port number used on the remote host.

Event ID

A unique numerical identifier assigned to specific types of logged events by the operating system (such as Windows Event IDs like 4624 for successful logons or 4688 for process creation).

Subject Logon ID

Displays the identifier of the account initiating the logon event.

Trace Time

Timestamp indicating when the process activity occurred on the endpoint. Helps analysts establish an execution timeline.

Equals

After

Before

Does not equal

Between

Author

Identifies the security component or telemetry source that collected the event. Useful for understanding event origin.

Contains

Does not contain

Equals

Does not equal

Begins with

Ends with

Process Name

Name of the executable that ran on the system. Used to identify the program or binary associated with the activity.

Embedded FileName

Name of the file or binary embedded within the process image (if present). Helps detect packed or embedded executables.

File Name

Shows the name of the file involved in the event. Helps analysts identify which file triggered or participated in an activity.

MD5 / SHA256

Cryptographic hash values associated with the process binary. Used for file reputation lookup and integrity validation.

Command Line

Full command-line string used to execute the process. Key for detecting script abuse, LOLBins, and hidden arguments.

Interpreter

Indicates the scripting engine or interpreter used to execute a script-based file or command. Useful for identifying PowerShell, Python, or other interpreter-based execution.

Path

Indicates the full file system path of the involved file, process, or registry key. Useful for identifying execution from unusual or insecure locations.

Service Name

Shows the name of the Windows service referenced in the event. Enables tracking of service creation or modification.

Domain Name

Shows the resolved domain name involved in the DNS or network activity.

Registry Type

Shows the value type stored in the registry, such as REG_SZ, REG_DWORD, or REG_BINARY.

Logon Type

Indicates the type of logon event, such as interactive, network, or remote logon.

Workstation Name

Displays the workstation name associated with a logon event.

Source IP

Displays the originating IP address for a network connection.

Destination IP

Displays the target IP address that the endpoint communicated with.

Action

Shows the specific action triggered on the endpoint, such as block, terminate, or quarantine.

Direction

Specifies the direction of a network connection, such as inbound or outbound.

Protocol

Indicates the network protocol used for communication, such as TCP or UDP.

URL

Shows the full web address accessed by the endpoint. Useful for identifying suspicious web traffic.

Key Value Name

Shows the name of the registry value associated with the event.

Key Value Type

Specifies the format or type of the registry value (for example, string, DWORD).

Key Value

Displays the data stored in the accessed or modified registry entry.

Key Old Value

Shows the previous value of a registry entry before it was modified. Helpful for understanding configuration changes

Task Name

Displays the name of a scheduled task that executed or was modified.

Target Account Name

Displays the username of the account targeted during an authentication event.

Reason

Indicates why a particular action occurred, such as policy rule match or detection trigger.

Target Domain

Indicates the domain associated with the target account.

API Name

Shows the API function used during the event. Useful for low-level behavioral analysis.

Modules

Represents the executable files, dynamic-link libraries (DLLs), or drivers loaded into the memory space of a running process.

Target PID

Displays the process ID targeted by an API call or injection technique.

Encoded Data

Shows the Base64 or other encoded content found in a command or payload. Helps detect obfuscated activity.

Injection Type

Indicates the method used to inject code into a target process, such as thread injection or APC injection.

Related APIs

Lists additional API calls associated with the event. Helps establish behavioral context.

Related Process

Shows the process linked to the activity or API call. Useful for correlation across events.

User

Displays the username associated with the event or action.

NS

Indicates the DNS record type returned in DNS queries, such as A, AAAA, CNAME, or NS.

Operation

Displays the operation performed, such as read, write, create, delete, or modify.

Result

Indicates the output or return status of an executed API call.

Success

Shows whether the action or logon attempt succeeded or failed.

Equals

Does not equal

Data

Displays input or output data associated with the event, depending on the telemetry source.

Contains

Does not contain

Parent Name

Name of the parent process executable that initiated the current process. Useful for identifying abnormal or unexpected process spawning.

Not Applicable

Process Name

Name of the executable that ran on the system. Used to identify the program or binary associated with the activity.

Content Analysis

Displays results from file or process inspection, including classification details or detection attributes derived from engine analysis. Helps identify suspicious or malicious content.

Activity

Describes the high-level behavior or category of the event captured by the EDR sensor (For example, FileCreate, NetworkConnect, ProcessRollup, RegistryWrite).

File Extension

Displays the file’s extension to help categorize its type, such as .exe, .dll, .ps1, or .docx.

Start Type

Indicates how a service is configured to start, such as Automatic, Manual, or Disabled. Useful for identifying persistence mechanisms.

DNSs

Shows the resolved domain names involved in the DNS or network activity.

Verb

Indicates the specific action word, command, or method executed during an operation. This is most commonly seen in web traffic analysis (For example, HTTP methods like GET, POST, PUT) or specific command-line/PowerShell executions.

Registry Key Name

The full path or specific name of the Windows Registry key being accessed, created, modified, or deleted. Monitoring this is essential for identifying unauthorized system configuration changes, malware installations, and persistence mechanisms.

Task Command

Shows the command executed by a scheduled task. Useful for identifying persistence through task scheduler.

Loaded Modules

Lists DLLs or modules loaded by a process. Helps identify injection or hijacking techniques.

Subject Security ID

Shows the security identifier (SID) of the account associated with the logon.

Action Executed

Shows the specific action triggered on the endpoint, such as block, terminate, or quarantine.

Endpoint Product

Shows the Trellix product that generated the event, such as EDRF or ENS.

Arguements

The specific parameters, flags, or switches passed to an executable, command, script, or API at runtime. While the "Command Line" column shows the full string, this column isolates the specific instructions given to the process, which is essential for decoding obfuscated commands or identifying malicious intent in legitimate tools (LOLBins).