Feedback:

cs_get_process_detail

Note: Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.

Use the cs_get_process_detail operator to retrieve process details of specified process IDs.

Syntax

| cs_get_process_detail cs_id_list=<process_ids>

cs_id_list=<process_ids>

Specify a process ID or a list of process IDs separated by commas, without spaces, and enclosed in double quotes.

The format of a process ID is the following: pid:<aid>:<pid>

Maximum number of process IDs that can be specified for a search operation is 100.

If more than 100 process IDs need to be processed, run multiple searches.

Examples

Example 1: Retrieve process details of the specified process ID.

Copy 
| cs_get_process_detail cs_id_list="pid:1234dde1234b4d60ababb3b8b942c2a3:1234561234567"

 

Example 2: Retrieve process details of the specified process IDs.

Copy 
| cs_get_process_detail cs_id_list="pid:aaa:111,pid:bbb:222,pid:ccc:333"