Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: How to Use the Process Search Term 'process_id'

EDR: How to Use the Process Search Term 'process_id'

Environment

EDR Server:  7.x

Objective

How to use the Process Search Term 'process_id'.

Resolution

The process_id field requires the process GUID, not the process PID. 
1. Obtain the process GUID which can be found on the Process Analysis page or in a raw process document.
a) Process Analysis page:
This is a article attached imageThis is a article attached image

b) Raw process document:
This is a article attached imageThis is a article attached image

2. Use the process GUID in the process_id search term.
process_id:00000002-0000-1c2d-01d8-8037b8dee543
Example:
This is a article attached imageThis is a article attached image

Additional Notes

  • The process_id value is an internal Carbon Black EDR process guid for the process. A long value.


Related Content


Tags (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎06-22-2022
Views:
200