Graph db: how to trigger on event? - neo4j

Question

We are looking to store Windows process tree information in a graph database.
We have an endpoint detection tool that collects process creation and deletion information. For example, the process id, the command that started the process, the parent process and so on.
The data will be loaded into the graph database in real-time.
Is there a way in Neo4j to trigger an event anytime we see "iexplore.exe" as the parent of processes such as "powershell.exe" or "cmd.exe"? In some cases, there may be several other processes between iexplore and powershell/cmd.
For example: the attacker exploits a vulnerability in IE, drops of a file on disk, executes it, and then uses powershell.exe.
Does graph databases provide us the ability to build in rules to capture more complex events like that?

Answer 1

You can use apoc triggers for set trigger and apoc.es.postRaw for external API call. For example:
CALL apoc.trigger.add(
'iexplorer',
'MATCH (P:Process {name:"iexplore.exe"})-[:parent_of*]->(C:Process)
WHERE C.name IN ["powershell.exe", "cmd.exe"]
WITH collect(distinct id(P)) as ids
CALL apoc.es.postRaw("http://localhost", "neo4jevent", ids) yield value
RETURN value',
'{phase:'after'}'
)