From c2613dc93bae34424d31141b58bb923bed03dd8c Mon Sep 17 00:00:00 2001 From: tekgrunt Date: Thu, 24 Sep 2026 08:50:16 -0700 Subject: [PATCH] docs(endpoint-commands): correct os_processes and netstat response events os_processes answers with a single OS_PROCESSES_REP whose PROCESSES list holds every running process, not one EXISTING_PROCESS event per process. netstat answers with a single NETSTAT_REP whose NETWORK_ACTIVITY list holds each connection, not NETWORK_CONNECTIONS. Both sample responses now show the fields the sensor actually sends (SOURCE/DESTINATION objects, PROCESS_ID, PROTOCOL and a numeric STATE for netstat; the PROCESSES list for os_processes). Verified 2026-09-24 against Endpoint Agent 5.3.9 by tasking both commands on a Linux and a Windows sensor: the replies were OS_PROCESSES_REP (98 and 84 processes) and NETSTAT_REP (12 and 56 connections), with no EXISTING_PROCESS events. This matches the EDR Events reference, which already lists both _REP events. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01X6h9smaXGQuviYJPcGFAkQ --- docs/8-reference/endpoint-commands.md | 41 ++++++++++++++++++--------- 1 file changed, 27 insertions(+), 14 deletions(-) diff --git a/docs/8-reference/endpoint-commands.md b/docs/8-reference/endpoint-commands.md index 48fb6d022..1aa63112f 100644 --- a/docs/8-reference/endpoint-commands.md +++ b/docs/8-reference/endpoint-commands.md @@ -871,7 +871,7 @@ Get current network connections on the endpoint (similar to netstat command). **Parameters:** None -**Response Event:** NETWORK_CONNECTIONS +**Response Event:** NETSTAT_REP (a single event; each connection is an entry in its `NETWORK_ACTIVITY` list) **Usage Example:** @@ -886,13 +886,17 @@ limacharlie sensor task netstat "event": { "NETWORK_ACTIVITY": [ { - "STATE": "ESTABLISHED", - "LOCAL_ADDRESS": "192.168.1.100", - "LOCAL_PORT": 50234, - "REMOTE_ADDRESS": "93.184.216.34", - "REMOTE_PORT": 443, - "PID": 1234, - "PROCESS": "chrome.exe" + "PROTOCOL": "tcp4", + "STATE": 5, + "SOURCE": { + "IP_ADDRESS": "192.168.1.100", + "PORT": 50234 + }, + "DESTINATION": { + "IP_ADDRESS": "93.184.216.34", + "PORT": 443 + }, + "PROCESS_ID": 1234 } ] } @@ -979,7 +983,7 @@ Get a list of all running processes with detailed information. **Parameters:** None -**Response Event:** EXISTING_PROCESS (multiple events, one per process) +**Response Event:** OS_PROCESSES_REP (a single event; every running process is an entry in its `PROCESSES` list) **Usage Example:** @@ -992,11 +996,20 @@ limacharlie sensor task os_processes ```json { "event": { - "PROCESS_ID": 1234, - "PARENT_PROCESS_ID": 5678, - "COMMAND_LINE": "C:\\Windows\\System32\\notepad.exe", - "FILE_PATH": "C:\\Windows\\System32\\notepad.exe", - "USER_NAME": "DOMAIN\\user" + "PROCESSES": [ + { + "PROCESS_ID": 1234, + "PARENT_PROCESS_ID": 5678, + "FILE_PATH": "C:\\Windows\\System32\\notepad.exe", + "COMMAND_LINE": "C:\\Windows\\System32\\notepad.exe", + "USER_NAME": "DOMAIN\\user", + "HASH": "", + "FILE_IS_SIGNED": 1, + "MEMORY_USAGE": 12263424, + "THREADS": 4, + "CREATION_TIME": 1789012750786 + } + ] } } ```