Workload Process Snapshot
This endpoint returns process snapshot on this workload. A process snapshot contains all the processes that are captured by the workload at a given time. Currently one copy of the latest process snapshot is retained. This endpoint needs to be used together with the workload process snapshot summary endpoint.
POST /openapi/v1/workload/{uuid}/process/tree/details
|
Path Parameter |
Description |
|---|---|
|
uuid |
Agent UUID |
|
Payload Field |
Type |
Description |
|---|---|---|
|
handle |
string |
Handle to the process snapshot to be retrieved |
Response
The response is a list of processes belonging to the snapshot in JSON.
|
Attribute |
Type |
Description |
|---|---|---|
|
command_string |
string |
Tokenized command string |
|
command_string_raw |
string |
Raw command string |
|
binary_hash |
string |
Sha256 of the process binary in hex |
|
ctime |
long |
ctime of the process binary in us |
|
mtime |
long |
mtime of the process binary in us |
|
exec_path |
string |
Process executable path |
|
process_id |
integer |
Process ID |
|
parent_process_id |
integer |
Parent process ID |
|
process_key |
integer |
Unique key to the process |
|
parent_process_key |
integer |
Unique key to the parent process |
|
pkg_info_name |
string |
Name of the package associated with the process |
|
pkg_info_version |
string |
Version of the package associated with the process |
|
proc_state |
string |
Process state |
|
uptime |
long |
Uptime of the process in us |
|
username |
string |
Username of the process |
|
cve_ids |
array |
Array of CVEID object |
Sample Python code
agent_uuid = 'aa28b304f5c79b2f22d87a5af936f4a8fa555894'
payload = {
}
resp = restclient.post('/openapi/v1/workload/%s/process/tree/ids' %
agent_uuid, json_body=json.dumps(payload))
handle = json.loads(resp.text)['process_summary'][0]['summary'][0]['handle']
payload = {
"handle": handle,
}
resp = restclient.post('/openapi/v1/workload/%s/process/tree/details' %
agent_uuid, json_body=json.dumps(payload))