The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Hosts with alerts

  • Published on Sep 11, 2026
  • 4 minute(s) read
Prev Next

Alerts from Process Tracker are displayed on the Host page of the Endpoint Security Web UI with the following details:

  • Alert Type: PRO

  • Assessment: Malicious Process <md5 hash> Started

The following is an example of a Endpoint Security alert on the Hosts page. The Raw Alerts Details provide the alert information in JSON format.

image10.jpeg

The data model for this format is a set of interrelated objects, where each object carries attributes related to a specific aspect of the alert. See the following table for the data model object types.

Alert

High level attributes of the alert.

DigitalSignature

Signature attributes of the file related to the process execution.

Event

Attributes related to the execution detection.

File

File information related to the process execution.

Process

Information related to the process and the parent process.

Fields in the Process Tracker map into the Raw Alert Details model as follows.

Field

Data Model Destination

Agent ID

Not represented. It is implicated by the host being viewed.

Alerted At

Alert.start_time

Args

Process.arguments

Attributes

File.is_archive, File.is_compressed, File.is_encrypted, File.is_hidden, File.write

Creation Time

File.file_created

Enrichment Status

Not represented. Malicious is implied as the verdict.

Event At

Event.start_time

File Size (bytes)

File.size_in_bytes

Group

File.owner_group

Hostname

Event.hostname

Index

Not represented.

Is Prelinked

Not represented.

Is Signed

DigitalSignature.signature_exists

Last Accessed Time

File.file_last_accessed

Last Status Change Time

Not represented.

MD5

Alert.parameters.md5, File.hashes.value

Modified Time

File.file_last_modified

Owner

File.owner_user

Parent Path

Process.parent.( File.path, File.name, File.file_extension)

Parent PID

Process.parent.pid

PID

Process.pid

Process File Cert

DigitalSignature.certificate_issuer, DigitalSignature.certificate_subject

Process File Exists

Not represented.

Process Path

File.path, File.name, File.file_extension

Signature Verified

DigitalSignature.signature_verified

Start Time

Event.start_time

Type

Event.event_type

User

Event.account_name

The following is a sample alert copied from Raw Alert Details. The fields that have been populated by the specific Process Tracker alert are emphasized in bold.

[
    {
	"id": "alert--fbf44f1e-c103-4f70-ae31-413b8b99b08c", 
	"type": "alert",
	"name": "Malicious Process 2c0ee23828595336e3c6d9a9df554498 Started", 
	"alert_type": "PROCESS_TRACKER",
	"action_nature": "tasking-immediate",
	"description": "Malicious Process 2c0ee23828595336e3c6d9a9df554498 Started", 
	"start_time": "2020-04-24T18:45:34.817Z",
	"alert_context": [
		"event--0d47fb2d-cc76-59b6-b36e-3e5e5adcc989", 
		"finding--fd94385c-68d3-4db8-af91-c00ed8db47d6"
	],
	"parameters": {
		"md5": "2c0ee23828595336e3c6d9a9df554498"
	},
	"object_status": "active", 
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
        "id": "eventlog--3fa673c5-9112-414b-9c4c-b07354e9e181", 
        "type": "eventlog",
        "extensions": {
            "cef-log-ext": { 
                "meta_information": {
                    "categoryTechnique": "Malware", 
                    "categoryDeviceType": "Process Tracker",
                    "categoryTupleDescription": "Process Tracker found a compromise indication", 
                    "categoryOutcome": "Success",
                    "categoryBehavior": "Found", 
                    "categorySignificance": "Compromise"
                }
            }
        }
    },
    {
        "id": "file--79920691-91a0-5345-b53a-39afe34db2da", 
	"type": "file",
	"name": "hipAutomationWhiteListTest10164.exe", 
	"file_extension": ".exe",
	"file_path": "C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\StartMenu\\Programs\\Startup\\hipAutomationWhiteListTest10164.exe",
	"size_in_bytes": 186861,
	"file_created": "2020-04-24T18:45:21.234Z",
	"file_last_modified": "2020-04-24T18:45:21.250Z", 
	"file_last_accessed": "2020-04-24T18:45:21.250Z", 
	"is_archive": true,
	"is_compressed": false, 
	"is_encrypted": false, 
	"is_hidden": false, 
	"write": true,
	"hashes": [
		{
			"hash_algorithm": "md5",
			"value": "2c0ee23828595336e3c6d9a9df554498"
		}
	],
	"object_status": "active", 
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z",
	"modified": "2020-04-24T18:46:08.189Z",
	"owner_user": "BUILTIN\\Administrators", 
	"owner_group": null, 
	"digital_signatures": [
		"digital-signature-info-type--bca29082-6209-4543-87d0-35517feaf8fe"
	]
    },
    {
	"id": "file--2cca9aa5-a3a9-5969-b2c8-1b5a7e6f5a1e",
	"type": "file",
	"name": "cmd.exe", 
        "file_extension": ".exe",
	"file_path": "C:\\Windows\\System32\\cmd.exe", 
	"object_status": "active",
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
	"id": "process--0431d562-b9cd-4f24-9623-39a6139dfb98", 
	"type": "process",
	"pid": 3620,
	"binary": "file--79920691-91a0-5345-b53a-39afe34db2da", 
	"parent": "process--c45cdb05-bb5a-49d7-b0a7-2f8caf5cfe97", 
	"object_status": "active",
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z",
	"modified": "2020-04-24T18:46:08.189Z",
	"arguments": "\"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\StartMenu\\Programs\\Startup\\hipAutomationWhiteListTest10164.exe\" /auto C:\\"
    },
    {
	"id": "process--c45cdb05-bb5a-49d7-b0a7-2f8caf5cfe97", 
	"type": "process",
	"pid": 4384,
	"binary": "file--2cca9aa5-a3a9-5969-b2c8-1b5a7e6f5a1e", 
	"object_status": "active",
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
	"id": "finding--fd94385c-68d3-4db8-af91-c00ed8db47d6", 
	"type": "finding",
	"risk_nature": "malicious", 
	"object_status": "active", 
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
	"id": "software--79920691-91a0-5345-b53a-39afe34db2da", 
	"type": "software",
	"name": "Enricher", 
	"object_status": "active", 
	"object_source": "Endpoint",
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
	"id": "action--114e445e-6f84-59c2-a50a-0b7c5e7d8e0d", 
	"type": "action",
	"name": "process-start", 
	"action_nature": "observed", 
	"start_time": "2020-04-24T18:45:33.446Z",
	"objects": [
	    "process--0431d562-b9cd-4f24-9623-39a6139dfb98"
        ],
	"object_status": "active", 
	"object_source": "Endpoint", 
	"created": "2020-04-24T18:46:08.189Z", 
	"modified": "2020-04-24T18:46:08.189Z"
    },
    {
	"id": "event--0d47fb2d-cc76-59b6-b36e-3e5e5adcc989", 
	"type": "event",
	"event_type": "start",
	"name": "process-event observed and analyzed", 
	"start_time": "2020-04-24T18:45:33.446Z",
	"objects": [
            "file--79920691-91a0-5345-b53a-39afe34db2da",
            "process--0431d562-b9cd-4f24-9623-39a6139dfb98",
            "finding--fd94385c-68d3-4db8-af91-c00ed8db47d6",
            "software--79920691-91a0-5345-b53a-39afe34db2da"
                ],
        "object_status": "active",
        "object_source": "Endpoint",
        "created": "2020-04-24T18:45:33.446Z",
        "modified": "2020-04-24T18:45:33.446Z",
        "account_name": "WINE51B13E84DB6\\Administrator"
    },
    {
        "id": "analysis--79920691-91a0-5345-b53a-39afe34db2da",
        "type": "analysis",
        "name": "enrich-context",
        "action_nature": "tasking-immediate",
        "is_automated": true,
        "performer": "software--79920691-91a0-5345-b53a-39afe34db2da",
        "parameters": {
            "hash": "2c0ee23828595336e3c6d9a9df554498"
        },
        "results": [
            "finding--fd94385c-68d3-4db8-af91-c00ed8db47d6"
        ]
    },
    {
        "id": "relationship--b1165b5d-55e0-4615-afc0-153deb7a3f58",
        "type": "relationship",
        "source": "event--0d47fb2d-cc76-59b6-b36e-3e5e5adcc989",
        "target": "analysis--79920691-91a0-5345-b53a-39afe34db2da",
        "relationship_type": "triggered"
    },
    {
        "id": "digital-signature-info-type--bca29082-6209-4543-87d0-35517feaf8fe",
        "type": "digital-signature-info-type",
        "signature_verified": false,
        "signature_exists": false
    }
]
:
Related articles
  • Get Alerts
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Trellix EDR APIs > API sample for threats and alerts
  • Get Alerts
    Endpoint Detection and Response with Forensics (EDRF) > EDRF APIs > API sample for threats and alerts
  • Host alert details
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Overview > The Endpoint Security (HX) Web UI > About the Endpoint Security (HX) Web UI > Hosts menu