Collects the contents of a Windows host endpoint's memory.
This audit was formerly known as the w32memory-acquisition audit.
This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported.
The memory-acquisition audit is not supported for host endpoints running Windows 10 or Windows Server 2016.
Supported Platforms
Windows only
Input Parameters
The following input parameters are available for this audit.
offset
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the offset, in bytes, from the beginning of physical memory at which the audit should begin collection. Your specification will be rounded to the lower page boundary. |
size
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | ByteSize | Valid values are specified in bytes. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the size of the memory, in bytes, that the audit should collect. Your specification will be rounded to the next page boundary. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |