Press CTRL+K to open search

ProcessHistory collector

  • Published on Aug 26, 2026
  • 4 minute(s) read
Prev Next

The ProcessHistory collector displays the status, create time, and terminated time of any running or terminated processes.

Note

The ProcessHistory collector does not retain the collected information between reboots and can store only up to 2000 terminated process events. When the number of running process events exceed the limit of 2000, the stored terminated process events are purged in order to store the current running process events.

Note

Make sure Enable Process History is selected on the System info policy page to gather process activity information using the ProcessorHistory collector on Real-time Search. If the Enable Process History option is disabled in policy, it affects only Real-time Search not the Historical Search and Device Search trace visibility.

Collector output

Field

Type

Description

name

String

The name of the running process.

id

Number

The process system identifier.

threadcount

Number

The number of active threads spawned by the process.

parentid

Number

The system identifier for the process that spawned the current process.

parentname

String

The name of the process that spawned the current process.

parentimagepath

String

The full path of the parent process.

file_reputation

String

The process reputation's name and level (range) defined by TIE or ATP.

  • Known Trusted — [99,100] — This is a trusted file

  • Most Likely Trusted — [71,85] — Almost certainly a trusted file

  • Might Be Trusted — [51,70] — Appears to be a benign file

  • Unknown — [31,50] — Cannot make a determination at this time

  • Might Be Malicious — [16,30] — Appears to be a suspicious file

  • Most Likely Malicious — [14,15] — Almost certainly a malicious file

  • Known Malicious — 1 — This is a malicious file

  • Not Set — 0 — No reputation has been specified

process_reputation

String

The reputation of a running process. See file_reputation for range of values.

started_at

Timestamp

Time when the process started.

finished_at

Timestamp

Time when the process terminated.

content_size

Number

If the process is a PowerShell, this is the size of the script being executed.

content

String

A piece of the script; if the script is larger than 8 k, it is truncated.

content_file

String

The full path of the script if it was in a file and the PowerShell was executed with -file parameter (if interactive, it might include the first file read by the interpreter).

execution_mode

String

The mode that the PowerShell was executed:

  • Interactive — No file was introduced and the user is interacting with the console

  • Unknown — It was not known how it was executed

  • File — With the -file parameter and a file on it (File based execution)

  • Commandline — When the command is placed in the command line with the interpreter (Fileless)

  • Mar_child — This is a PowerShell instance launched by Trellix EDR to execute a collector

size

Number

The amount of resident RAM used by the process.

md5

String

The MD5 hash code for the process.

sha1

String

The SHA-1 hash code for the process.

sha256

String

The SHA-256 hash code for the process.

cmdline

String

The command that started the process.

imagepath

String

Path to the process image name.

kerneltime

Number

The process's use of kernel mode CPU time, in seconds.

usertime

Number

The process's use of user mode CPU time, in seconds.

uptime

Number

The number of seconds passed since the process started.

user

String

The user name that started the process.

user_id

String

The ID for the user that started the process.

normalized_cmdline

String

The result of using a Windows API for getting command line arguments in a standard format. This API has a special interpretation of backslash character and double quotation marks.



Example: Show running and terminated processes with "powershell" in their name with their size, content, location, execution mode, and count.
ProcessHistory status, content_size, content, content_file, 
execution_mode where ProcessHistory name contains "powershell"


IoA - commonly observed syntax for powershell precursors
ProcessHistory parent_cmdline
    WHERE ProcessHistory parent_cmdline contains "-exec bypass -e"
        OR ProcessHistory parent_cmdline contains "-NoP -NonI -W Hidden -E"
        OR ProcessHistory parent_cmdline contains "-noni -nop -w hidden -e"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -e"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -encodedcommand"
        OR ProcessHistory parent_cmdline contains "-w hidden -en"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -exec bypass -enc"
        OR ProcessHistory parent_cmdline contains "-nop -exec bypass encodedcommand"
        OR ProcessHistory parent_cmdline contains "-nop -sta -w 1 -enc"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -exec bypass -enc"


Example: Show running and terminated processes with "powershell" in their name with their size, content, location, execution mode, and count.
ProcessHistory status, content_size, content, content_file, 
execution_mode where ProcessHistory name contains "powershell"


IoA - commonly observed syntax for powershell precursors
ProcessHistory parent_cmdline
    WHERE ProcessHistory parent_cmdline contains "-exec bypass -e"
        OR ProcessHistory parent_cmdline contains "-NoP -NonI -W Hidden -E"
        OR ProcessHistory parent_cmdline contains "-noni -nop -w hidden -e"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -e"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -encodedcommand"
        OR ProcessHistory parent_cmdline contains "-w hidden -en"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -exec bypass -enc"
        OR ProcessHistory parent_cmdline contains "-nop -exec bypass encodedcommand"
        OR ProcessHistory parent_cmdline contains "-nop -sta -w 1 -enc"
        OR ProcessHistory parent_cmdline contains "-nop -w hidden -exec bypass -enc"


Related articles
  • ProcessHistory collector
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Collecting device data for real-time search > Built-in collectors
  • Processes collector
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting > Collecting device data for real-time search > Built-in collectors
  • Processes collector
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Collecting device data for real-time search > Built-in collectors