Saner CVEM: Viewing Currently Running Processes on Endpoints

Overview

Monitoring running processes on endpoints is a critical task for administrators to maintain system performance, troubleshoot issues, and ensure compliance. Saner CVEM provides a Process Management feature that allows you to query and view currently running processes across multiple platforms, including Windows, Unix, and Mac. This guide explains the steps to use this feature, schedule queries, and interpret the results.

By using this feature, you can centrally monitor processes, identify unusual activity, and take proactive action on endpoints without having to access each device manually.

Viewing Processes on Windows Endpoints

Step 1: Log in to Saner CVEM

• Open your web browser and navigate to the Saner CVEM console.

• Enter your administrator credentials to log in.

Step 2: Access Endpoint Management

• From the main dashboard, click on Endpoint Management to view and manage all connected endpoints.
  
  
  
  

Step 3: Open Checks

• On the top-right corner of the console, click Checks.

• This section provides access to all the pre-configured checks available for endpoint management.
  
  
  
  

Step 4: Filter by Platform

• Use the Family filter to select Windows.

• From the filtered options, choose Process Management. This will show all process-related checks for Windows endpoints.

Step 5: View Current Processes

• Click on Green Highlighted Current Process to display the list of processes currently running on the selected Windows endpoints.
  
  

• The console highlights key information such as process name, PID (Process ID), and execution time.

Step 6: Schedule Query Execution

• Click Trigger to schedule a query for the selected agent(s).

• Fill in the Query Trigger Settings:

  • Query Run Count (seconds): Duration for the query to execute.

  • Query Frequency (minutes): How often the query should run.

  • Query Trigger Time Frame: Set the schedule in the Schedule Options pane.

• Click Update to save the scheduled query.
  
  

Step 7: Select Scope

• Click Scope to define which endpoints will execute the query.

• You can target individual endpoints, groups, or all devices depending on your requirements.
  
  
  
  

Step 8: View Query Results

• Once the query is executed successfully by the agent, results will display in the console:

  • Process Name – Name of the running process.

  • Execution Time – Duration the process has been running.

  • Process ID (PID) – Unique identifier of the process.

  • Applicable Hostnames – List of endpoints where the process is running.
    

Viewing Processes on Unix and Mac Endpoints

The steps to view running processes on Unix and Mac platforms are very similar:

1. Follow Steps 1–3 above to log in and navigate to Endpoint Management > Checks.

2. Use the Family filter to select Unix or Mac.

3. Choose Process Management to display all relevant process-related checks.

4. Click Current Process to view running processes.

5. Schedule queries and select the scope exactly as described in the Windows section.

6. Results will display with the same detailed information (process name, execution time, PID, hostnames).
   

Additional Tips

• Scope Selection: Carefully select the scope to target only relevant endpoints, especially in large environments. This helps reduce network and agent load.

• Scheduled Queries: Use scheduled queries for continuous monitoring without manual intervention. You can adjust frequency based on criticality.

• Process Analysis: The detailed results help identify abnormal or unauthorized processes, enabling proactive security measures.

• Cross-Platform Monitoring: This feature provides a centralized view for Windows, Unix, and Mac, making it easier for administrators managing mixed environments.

Conclusion

The Process Management feature in Saner CVEM provides administrators with a powerful, centralized tool to monitor running processes across all endpoints. By scheduling queries and viewing detailed process information, administrators can proactively manage system performance, detect potential issues, and ensure endpoint security and compliance. This cross-platform capability simplifies monitoring in diverse IT environments and supports efficient, real-time decision-making.