View Statistics for a Protected Process Using Cytool

At any time you can query Traps for injection statistics on a specific protected process that is running on the endpoint using Cytool. Use the cytool stat <pid> command to view the injection statistics for the process.
  1. Open a command prompt as an administrator and navigate to the Traps folder (see Access Cytool).
  2. Identify the process identifier (PID) of the running process for which you want statistics. To determine which processes are being actively protected, see the Protection tab on the Traps console.
    traps-protection.png
  3. To view statistics for a specific process, use the following command:
    C:\Program Files\Palo Alto Networks\Traps> cytool stat <pid>
    where <pid> is the specific process id.
    The following example displays output for using cytool to display statistics about the Chrome process with PID 4080.
    c:\Program Files\Palo Alto Networks\Traps> cytool stat 4080
    DllSec Invocations: 0
    DllSec Time: 00:00:00.0
    G01 Invocations: 0
    G01 Time: 00:00:00.0
    G01 Thunk 00 Resolution: 0
    G01 Thunk 01 Resolution: 0
    G01 Thunk 02 Resolution: 0
    G01 Thunk 03 Resolution: 0
    G01 Thunk 04 Resolution: 0
    G01 Thunk 05 Resolution: 0
    G01 Thunk 06 Resolution: 0
    G01 Thunk 07 Resolution: 0
    G01 Thunk 08 Resolution: 0
    G01 Thunk 09 Resolution: 0
    G01 Thunk 10 Resolution: 0
    G01 Thunk 11 Resolution: 0
    G01 Thunk 12 Resolution: 0
    G01 Thunk 13 Resolution: 0
    G01 Thunk 14 Resolution: 0
    G01 Thunk 15 Resolution: 0
    G01 Stack Walk Resolution: 0
    J01 Minimum Stack Depth: 166
    J01 Checks: 25
    J01 Stack Walk Checks: 0
    

Related Documentation