The Process Tracker module recognizes unique process execution events on a Windows, macOS, or Linux host, and streams the associated execution metadata to your Endpoint Security Server. These events are published on a public message bus topic that is accessible by Helix or your Security Information and Event Management solution (SIEM). The events are also stored locally within a database and are accessible via API. You can view the events using the Endpoint Security Web UI on the Process Tracker home page.
If the Enricher Module is installed and enabled, you can use the standard enricher workflow to process the Process Tracker events and obtain a verdict. For a malicious verdict, you can configure the Process Tracker to trigger an alert. The Process Tracker alert can then be configured to trigger an automatic triage.
If the Enricher Module is not installed and enabled, the Process Tracker can still post messages on the bus and store them in its database. The Process Tracker does not require the Enricher Module to be installed and enabled to stream the event data.