List Processes using Splunk SIEM

The Kill Process Alert Action remotely lists the processes that are running on the specified device.

Example: If an Analytics alert did not terminate the process, identify whether the suspicious process is still running on the device.

Note: See also Live Response API.

Credential type: Custom

Note: The credential type changed with Splunk SIEM 2.0.0. A new API key is required. See Before you Upgrade to Splunk SIEM 2.0.0.

Configuration:

Device ID Field

The field name in the search results that contains the device ID upon which to list processes.