_EVENT_AGENT_EVENT Struct Reference

Event structure for agent injection and termination. More...

#include <intro_types.h>

Data Fields
AGENT_EVENT_TYPE	Event
	The type of the agent. More...
DWORD	AgentTag
	Unique agent tag. See INTRO_DEP_AG_TAGS. More...
DWORD	ErrorCode
	The error code of the event. Success is 0. More...
INTRO_PROCESS	CurrentProcess
	The agent process. More...
union {
AGENT_REM_EVENT   RemediationEvent
	Remediation tool event. More...
AGENT_LGT_EVENT   LogGatherEvent
	Log gather tool event. More...
};
	State/agent specific information. More...

Detailed Description

Event structure for agent injection and termination.

Definition at line 2345 of file intro_types.h.

Field Documentation

@338

union { ... }

State/agent specific information.

Fields must be used depending on the AgentTag and are invalid if Event is not agentMessage.

AgentTag

DWORD _EVENT_AGENT_EVENT::AgentTag

Unique agent tag. See INTRO_DEP_AG_TAGS.

Definition at line 2348 of file intro_types.h.

Referenced by IntAgentHandleLogGatherVmcall(), IntAgentHandleRemediationVmcall(), IntLixAgentHandleUserVmcall(), IntLixAgentSendEvent(), IntLixTaskSendAgentEvent(), and IntWinProcSendAgentEvent().

CurrentProcess

INTRO_PROCESS _EVENT_AGENT_EVENT::CurrentProcess

The agent process.

Pid, Cr3 and ImageName are not valid for agentInjected and agentTerminated events, as there is no active agent process in those phases.

Definition at line 2355 of file intro_types.h.

Referenced by IntAgentHandleLogGatherVmcall(), IntAgentHandleRemediationVmcall(), IntLixTaskSendAgentEvent(), and IntWinProcSendAgentEvent().

ErrorCode

DWORD _EVENT_AGENT_EVENT::ErrorCode

The error code of the event. Success is 0.

Definition at line 2349 of file intro_types.h.

Referenced by IntAgentHandleLogGatherVmcall(), IntAgentHandleRemediationVmcall(), IntLixAgentHandleUserVmcall(), IntLixAgentSendEvent(), IntLixTaskSendAgentEvent(), and IntWinProcSendAgentEvent().

Event

AGENT_EVENT_TYPE _EVENT_AGENT_EVENT::Event

The type of the agent.

Definition at line 2347 of file intro_types.h.

Referenced by IntAgentHandleLogGatherVmcall(), IntAgentHandleRemediationVmcall(), IntLixAgentHandleUserVmcall(), IntLixAgentSendEvent(), IntLixTaskSendAgentEvent(), IntWinAgentHandleDriverVmcall(), and IntWinProcSendAgentEvent().

LogGatherEvent

AGENT_LGT_EVENT _EVENT_AGENT_EVENT::LogGatherEvent

Log gather tool event.

Valid only if AgentTag is INTRO_AGENT_TAG_LOG_GATHER_TOOL.

Definition at line 2369 of file intro_types.h.

Referenced by IntAgentHandleLogGatherVmcall().

RemediationEvent

AGENT_REM_EVENT _EVENT_AGENT_EVENT::RemediationEvent

Remediation tool event.

Valid only if AgentTag is INTRO_AGENT_TAG_REMEDIATION_TOOL or INTRO_AGENT_TAG_REMEDIATION_TOOL_LINUX.

Definition at line 2365 of file intro_types.h.

Referenced by IntAgentHandleRemediationVmcall().

---

The documentation for this struct was generated from the following file:

• include/public/intro_types.h