JavaScript filters
JavaScript filters
Section titled “JavaScript filters”User filters can be defined using JavaScript. This allows to create complex filters that are not possible using the quick-search syntax.
For each filter a context is passed containing the following objects and properties:
process: The process object to be tested against the filter._username: The username of the current user.
Process object
Section titled “Process object”The process object contains the following properties:
| Property | Description | Type | License required |
|---|---|---|---|
pid | PID of the process | String | No |
name | Name of the process | String | No |
command | Command used to start the process | String | No |
cpuPerc | CPU usage of the process in percent | String | No |
version | Version of the process | String | No |
priority | Priority of the process | String | No |
nice | Nice value of the process | String | No |
user | User owning the process | String | No |
residentMemory | Resident memory in bytes | Integer | No |
virtualMemory | Virtual memory in bytes | Integer | No |
threads | Number of threads | Integer | No |
startTime | Start time of the process | Date | No |
isApplication | Whether the process is windowed (activationPolicy = .regular) | Boolean | No |
bundleIdentifier | Bundle ID (e.g. com.itone.ProcessSpy) | String | Yes |
signingOrganization | Extracted from process signature Subject O element | String | Yes |
startupEntryType | One of the following: launchDaemon, launchAgent, loginItemBookmark or empty | String | Yes |
Example filters
Section titled “Example filters”Show processes using more than 300 MB of resident memory:
process.residentMemory > 314572800Show processes from Microsoft:
process.bundleIdentifier.includes('com.microsoft')Show unsigned processes:
!process.signingOrganization ||process.signingOrganization.length === 0Show processes started less than 60 seconds ago:
new Date() - new Date(process.startTime) < 60 * 1000Show processes with a startup entry:
process.startupEntryType && process.startupEntryType.length > 0