The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Image load event

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

Event Buffer Attribute

Helix Field Destination

Notes

devicePath

event_value.devicePath

The raw device path of the image being loaded

drive

event_values.drive

The drive of the full path of the image being loaded

fileExtension

extension

The file extension of the image being loaded

filename

filename

The filename of the image being loaded

filePath

event_values.filePath

The relative portion of the full path of the image being loaded

fullPath

filepath

The full path of the image being loaded

pid

pid

The process ID loading the image

ppath

event_values.ppath

The path for the PE of the process loading the image

process

process

The name of the process loading the image

processPath

processpath

The path for the PE of the process loading the image

username

username

The owner of the process loading the image

:
Related articles
  • Image load event
    Endpoint Security Modules (HX) > IOC Streaming > Endpoint Security IOC Streaming Module User Guide Release 1.3.167 > Helix data and use cases > Data taxonomy
  • Image load event
    Endpoint Security Modules (HX) > IOC Streaming > Endpoint Security IOC Streaming Module User Guide Release 1.3.166 > Helix data and use cases > Data taxonomy
  • Image Load Event
    Endpoint Security Modules (HX) > IOC Streaming > Endpoint Security IOC Streaming Module User Guide Release 1.2.144 > Helix Data and Use Cases > Data Taxonomy