Host endpoints running Endpoint Security (HX)xAgent versions 34 and above include a new running process when real-time indicator detection is enabled:
/opt/fireeye/bin/rte-sensor
The rte-sensor process ensures the following:
All xagt events are automatically excluded from process collection.
The sensor captures up to 8 command-line parameters for real-time process events. If the event has more than 8, the sensor attempts to capture additional parameters using /proc.