The process execution events are available on the PROCESS_TRACKER topic. Messages are recorded here when an agent posts a unique process event. If enrichment of events is enabled, a secondary update message is posted when the enrichment status for the event is received from the Enricher Module.
HTTP Verb | Path | URI |
|---|---|---|
GET | /hx/api/services | /topic/PROCESS_TRACKER |
Request headers
X-OFFSET | The offset ID of the first message to retrieve. This can be omitted for the first request. A response header will provide an updated value for your next request. If you provide a value that is below the earliest message available, then the earliest available message is provided in the response. |
X-MAX-MESSAGES | Optional, to limit the number of messages returned. Default is 500. |
X-POLL-TIMEOUT | Maximum number of seconds to wait for X-MAX_MESSAGES to become available. |
Response codes (subset)
200 | Success |
204 | No content |
Response headers (subset)
X-OFFSET | The new position in the topic. This should be saved and provided as the X-OFFSET in the next GET request. |
Warning | Provides details regarding issues with X-OFFSET. |
Response
The response is newline terminated text based that is a combination of boundary tags, message header information and JSON message payload.
--Boundary_409686_968730724_1587661791987
TS: 1587146250151
BTS: 1587146250151
MID: 186ca9acbbd6842c
SID: PROCESS-TRACKER
CID: tVC951q7Ri4dQglrR5NrtQ
AID: PROCESS-TRACKER
TPC: PROCESS_TRACKER
Content-Disposition: form-data; name="PROCESS_TRACKER"; filename="PROCESS-TRACKER"
Content-Type: application/binary
{"type":"event","data":{"uuid":"7e4a1da6-7e49-4829-9f5d-
566e1c7d16c6","id":2,"md5":"acbdfdbdfb5f1995d26e34ca351a6657","agent_id":"BH3E2ZjPcd3bUeKIrjYe5n","eve
nt_at":"2020-04-
17T17:56:58.242Z","process_file_exists":true,"process_path":"C:\\Windows\\System32\\sppsvc.exe","pid":
17612,"parent_path":"C:\\Windows\\System32\\services.exe","parent_pid":700,"file_size":4589056,"file_c
reated_at":"2020-03-17T17:25:36.446Z","file_last_accessed_at":"2020-03-
17T17:25:36.717Z","file_last_modified_at":"2020-03-
17T17:25:36.717Z","args":null,"type":"end","started_at":"2020-04-17T17:56:58.242Z","user":"NT
AUTHORITY\\NETWORK SERVICE","owner":"NT
SERVICE\\TrustedInstaller","is_signed":true,"file_attributes":"Archive","process_file_cert":{"Issuer":
"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA
2011","Subject":"C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft
Windows","Algorithm":"sha256","SerialNumber":"330000023241fb59996dcc4dff000000000232","ExpirationTime"
:"2020-05-
02T21:24:36.000Z"},"signature_verified":true,"group":null,"last_status_change_time":null,"is_prelinked
":null,"updated_at":"2020-04-17T17:57:30.135Z","created_at":"2020-04-
17T17:57:30.118Z","alerted_at":null,"enrichment_status":"REQUESTED","enrichment_requested_at":"2020-
04-17T17:57:30.134Z"}}
--Boundary_409686_968730724_1587661791987--