When the Process Tracker module is installed and enabled on the agent, the agent monitors the process execution events to determine if a unique process execution occurs. To identify a unique process execution, the agent module collects metadata associated with the event and forwards the information to the Process Tracker server module. In addition to reporting these events, the agent continues to report its runtime health via the Agent Info Audit.
Note
For the Process Tracker module to function on an agent, the real-time detection must be turned in the agent's policy. For more information, see Configuring the Process Tracker agent policy
For each event, the Process Tracker agent completes the following actions:
Publishes the process execution event on a message bus topic, including the metadata collected by the agent.
Stores the event within its local database so that it is accessible via the Endpoint Security Web UI and the REST API.
If the enrichment of events is enabled, enrichment is requested for the event. The Enricher Module executes its standard workflow to enrich the event with additional information from its configured data sources. When the enrichment request is completed the Process Tracker module publishes an update of the event on the message bus topic that includes the enrichment verdict. The Process Tracker module will also update the event within its local database.
If a malicious enrichment verdict is received, and alerting is enabled, the Process Tracker server module will publish a generic alert of type PRO to the Alerting Service of the Endpoint Security server. This alert will be associated to the host where the process executed. The alert information will be available within the Endpoint Security Web UI, accessible via REST API, published on a message bus topic, and provided within a CEF notification.