Press CTRL+K to open search

KillProcessTree reaction

  • Published on Aug 27, 2026
  • 1 minute(s) read
Prev Next

Use this reaction to kill a process and its subprocesses.

Arguments

Name

Type

Description

pid

Number

The process ID, set by the operating system.



Supported versions

Windows

Linux

macOS

3.0 and later

n/a

3.0 and later



Related articles
  • KillProcessTree reaction
    Endpoint Detection and Response with Forensics (EDRF) > Respond to threats with EDRF > Respond to threats > Reacting to incidents > Built-in reactions
  • KillProcessByPID reaction
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Reacting to incidents > Built-in reactions
  • KillProcessByPath reaction
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Reacting to incidents > Built-in reactions