Processes collector

The Processes collector gathers data on processes running on managed devices.

Collector output

Field	Type	Description
name	String	The name of the running process.
id	Number	The process' system identifier.
threadcount	Number	The number of active threads spawned by the process.
parentid	Number	The system identifier for the process that spawned the current process.
parentname	String	The name of the process that spawned the current process.
parentimagepath	String	The full path of the parent process.
parent_cmdline	String	The command that started the parent process.
file_reputation (reputation renamed file_reputation)	String	The process reputation's name and level (range) defined by TIE or ATP. Known Trusted — [99,100] — This is a trusted file Most Likely Trusted — [71,85] — Almost certainly a trusted file Might Be Trusted — [51,70] — Appears to be a benign file Unknown — [31,50] — Cannot make a determination at this time Might Be Malicious — [16,30] — Appears to be a suspicious file Most Likely Malicious — [14,15] — Almost certainly a malicious file Known Malicious — 1 — This is a malicious file Not Set — 0 — No reputation has been specified
process_reputation	String	The reputation of a running process. See file_reputation for range of values.
started_at	Timestamp	Time when the process started.
finished_at	Timestamp	Time when the process terminated.
content_size	Number	If the process is a PowerShell, this is the size of the script being executed.
content	String	A piece of the script; if the script is larger than 8 k, it is truncated.
content_file	String	The full path of the script if it was in a file and the PowerShell was executed with `-file` parameter (if interactive, it may include the first file read by the interpreter).
execution_mode	String	The mode that the PowerShell was executed: Interactive — No file was introduced and the user is interacting with the console Unknown — It was not known how it was executed File — With the `-file` parameter and a file on it (File based execution) Commandline — When the command is placed in the command line with the interpreter (Fileless) Mar_child — This is a PowerShell instance launched by Trellix EDR to execute a collector
size	Number	The amount of resident RAM used by the process.
md5	String	The MD5 hash code for the process.
sha1	String	The SHA-1 hash code for the process.
sha256	String	The SHA-256 hash code for the process.
cmdline	String	The command that started the process.
imagepath	String	Path to the process image name.
kerneltime	Number	The process's use of kernel mode CPU time, in seconds.
usertime	Number	The process's use of user mode CPU time, in seconds.
uptime	Number	The number of seconds passed since the process started.
user	String	The user name that started the process.
user_id	String	The ID for the user that started the process.
normalized_cmdline	String	The result of using a Windows API for getting command line arguments in a standard format. This API has a special interpretation of backslash character and double quotation marks. Ex: `-C"a"r` is a valid argument and is equal to `-Car/` More information: https://devblogs.microsoft.com/oldnewthing/20100917-00/?p=12833 For Linux and macOS, it is the same as cmdline.

Supported versions

Windows	Linux	macOS
3.0 and later	3.0 and later	3.0 and later

Example: Show processes' names and RAM size for processes that use more than 10 MB of resident RAM.

Processes name, size where Processes size greater than 10240

Show processes' process reputation on a host with IP address of 10.9.9.9

Processes id, name, process_reputation where HostInfo ip_address equals 10.9.9.9

Which system user identity executed a program: by process - single

Processes user, user_id, name
    WHERE Processes name equals "svchost.exe"

Which system user identity executed a program: by process - many

Processes user, user_id, name
    WHERE Processes name equals "svchost.exe"
        OR Processes name equals "cmd.exe"
        OR Processes name equals "schtasks.exe"

Which system user identity executed a program: by user identity - single

Processes user, user_id, name
    WHERE Processes name equals "svchost.exe"
        AND Proceses user equals "alice"

Which system user identity executed a program: by user identity - many

Processes user, user_id, name
    WHERE Processes name equals "svchost.exe"
        AND Proceses user equals "alice"
            OR Processes user equals "bob"
            OR Processes user equals "jane"

Who is the parent of a child process - single

Processes parentname, name, execution_mode
    WHERE Processes name equals "svchost.exe"

Who is the parent of a child process - many

Processes parentname, name, execution_mode
    WHERE Processes name equals "svchost.exe"
        OR Processes name equals "cmd.exe"
        OR Processes name equals "mshta.exe"

Specify - parent process

Processes parentname, name, id, execution_mode
    WHERE Processes parentname not equals "services.exe"
        AND Processes name equals "svchost.exe"

What is the process ID of the parent

Processes parentname, parentid, name, id, execution_mode
    WHERE Processes name equals "svchost.exe"

What is the process ID of the child

Processes parentname, name, id, execution_mode
    WHERE Processes name equals "svchost.exe"

What is the source file location of the parent

Processes parentimagepath, name
    WHERE Processes name equals "svchost.exe"

What is the source file location of the child

Processes imagepath, name
    WHERE Processes name equals "svchost.exe"

What is the process ID of the child

Processes parentname, name, id, execution_mode
    WHERE Processes name equals "svchost.exe"

What is the command line of the parent

Processes parentname, parent_cmdline, name, id
    WHERE Processes name equals "svchost.exe"
        AND parent_cmdline not equals ""

What is the command line of the child

Processes parentname, cmdline, name, id
    WHERE Processes name equals "svchost.exe"
        AND Processes cmdline not equals ""

What is the Trellix file reputation of the child

Processes name, process_reputation
    WHERE Processes name equals "svchost.exe"

Specify date of execution after

Processes name, started_at
    WHERE Processes name equals "svchost.exe"
        AND Processes started_at after "2020-01-01"

Specify date of execution before

Processes name, started_at
    WHERE Processes name equals "svchost.exe"
        AND Processes started_at before "2020-04-17"

Specify date of execution range

Processes name, started_at
    WHERE Processes name equals "svchost.exe"
        AND Processes started_at after "2020-04-15"
        AND Processes started_at before "2020-04-17"