Search Processes

Search for processes in your environment. Get details such as the process ID, username that started the process, path to the file, parent process ID, etc., by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Entities/Processes/search

FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days. To use the current time as the end time, exclude the endTime field.

You can optionally filter the returned processes by the process id, username that started the process, path to the file, parent process ID, and more. For more information, see PROCESS_SUMMARY_V View.

Here are some example body payloads:

• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}}
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" } ] }
• { "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}, "filters": [ { "field": "mid", "expression": "eq", "value": "12345" }, { "field": "ppid", "expression": "eq", "value": "0044" } ],
  "returns": [ "pid", "ppid", "cmdlineHash", "mid", "uid", "username" ] }