Host endpoints running Endpoint Security (HX) xAgent versions 34 and above include a new running process when real-time indicator detection is enabled:
/opt/fireeye/bin/rte-sensor
The rte-sensor process ensures the following:
All
xagtevents are automatically excluded from process collection.The sensor captures up to 8 command-line parameters for real-time process events. If the event has more than 8, the sensor attempts to capture additional parameters using
/proc.