Just starting my digging into this so thought I would see it there is something here first.
My institution is using Cisco AMP for Endpoints and I need to build something to do the following:
1) Check to see if the AMP for Endpoints Client System Process is running
2) if process is not running, launch the application to start the system process
Figuring a script similar to this might be a good starting point -
process=“AMP for Endpoints Client”
processrunning=$( ps axc | grep "${process}$” )
if [ "$processrunning" != "" ]; then
/bin/echo "$process IS running, we do nothing now"
else
/bin/echo "$process IS NOT running - run custom trigger here to launch"
fi