Collects a list of running processes as reported by the operating system of host endpoints.
This audit was formerly known as the w32processes-API audit.
Supported Platforms
Windows, macOS, and Linux
Input Parameters
The following input parameters are available for this audit only in Windows environments.
pid
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | PID | Valid values are a process ID. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the process ID that the audit should list. This parameter cannot be specified in conjunction with the |
process name
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | String | Valid values are a string of text. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the first 15 characters of the process names that the audit should list. |
handles
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should parse the process handles. |
sections
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should parse the process memory sections. |
detect injected dlls
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should detect injected DLLs. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |