How to detect whether a process is running for more than X seconds/minutes

In this example, we will configure EventSentry to send an email alert if Notepad++.exe runs for longer than two minutes. If the process terminates before the two-minute mark, the process termination filter will clear the timer and prevent the alert.

Prerequisites
Ensure the following Advanced Audit Policies are enabled (set to Success) on the target hosts via GPO to generate the required events:

• Detailed Tracking > Audit Process Creation (Generates Event ID 4688). Uses Insertion String %6 for the New Process Name.
• Detailed Tracking > Audit Process Termination (Generates Event ID 4689). Uses Insertion String %7 for the Process Name.

A. Create and assign the package

1. 1. Create an event log package labeled "Long Running Process".
2. Assign the package to the target host or make it global.

B. Create a Process Creation include filter targeting the executable file

1. Create an include filter in that package labeled “Process Creation”:
   
2. To monitor a specific process, click the plus (+) button under the “Content Filter” section.
3. Select ‘Insertion string six (%6 - New Process Name) matches’ and then add the process path, for example: C:\Program Files\Notepad++\notepad++.exe
   

C. Create a Process Termination include filter for the same executable file

1. Create an include filter in that package labeled “Process Termination”.
2. The same content filter path should be added to this filter, but this time you will select insertion string seven (%7 - Process Name): C:\Program Files\Notepad++\notepad++.exe
   
   

D. Enable and configure the process timeout

1. In the “Process Creation” filter, click the “Timers” tab, then check “Enable Timer”.
2. In the “Timeout” field, select the maximum duration you want that process to run before generating an alert. In this example, we will use two minutes.
3. Below that, click the plus (+) button and add the “Process Termination” filter as the filter to clear the timer.
   
4. In the “Insertion Strings” section, click the plus (+) button and add 6-7 (which maps to the ‘Process ID’).
   

E. Save the changes
Remember to save to apply the changes (Home > Save).

Here is a walkthrough video of these steps for further reference. Please note that strings 5 and 6 shown in the video must be replaced with strings 6 and 7 for this specific alert to work properly.