For the curious mind
On the surface process identification might seem like a simple problem as all of the operating systems the Reveal Agent supports provide a numerical identifier for a particular process. However, this identifier is usually recycled in some fashion once a process exits. The Reveal Agent must be careful to avoid killing the current process occupying this process identifier when a policy or operator intends to kill one of the previous tenants of this identifier.
To address this concern, the Reveal Agent maintains an extensive set of information about all of the processes currently running on the system which are under observation. When a new process is detected, the Reveal Agent assigns it a globally unique identifier which is then used to identify this process when sending subsequent events about its activity. This identifier is also used by policies and the operator console to identify the process to kill when the action is activated. In this way, as the landscape on the system changes around the Reveal Agent the right process will always be killed, and innocent activity is allowed to continue.
The Reveal Agent also uses this list of processes as a key way to reduce the CPU and memory impact of inspecting the system. In order to provide the rich set of detail on running processes–e.g. the Reveal Agent provides process binary signing information, application metadata, binary executable file hashes and more–the Reveal Agent must query many sources. Not all of these sources are computationally inexpensive, and the Reveal Agent must take care to observe the system without preventing an employee from accomplishing their work. To this end, the Reveal Agent stores information for a particular process instance once it is queried from the system. This information is stored and maintained on disk until the next system restart so that the Reveal Agent can provide consistent information in the case of upgrade or failure. Information on executable files is queried once, stored on disk permanently and modified based on changes to the file system. In this way information need only be queried once ever for a particular file.