docs(endpoint-commands): correct os_processes and netstat response events

[tekgrunt]

What's wrong today

The Endpoint Commands reference gives the wrong response event for two commands:

• os_processes says EXISTING_PROCESS (multiple events, one per process). The sensor actually answers with a single OS_PROCESSES_REP whose PROCESSES list holds every running process.
• netstat says NETWORK_CONNECTIONS. The sensor actually answers with a single NETSTAT_REP whose NETWORK_ACTIVITY list holds each connection.

The netstat sample response also used field names the sensor doesn't send (LOCAL_ADDRESS, LOCAL_PORT, REMOTE_ADDRESS, REMOTE_PORT, PID, PROCESS, and a string STATE).

The change

• Both Response Event lines now name the _REP event and say what the list holds.
• Both sample responses now show the real shapes: os_processes returns a PROCESSES list; netstat returns SOURCE/DESTINATION objects, PROCESS_ID, PROTOCOL and a numeric STATE.

This matches the EDR Events reference, which already lists OS_PROCESSES_REP and NETSTAT_REP.

How it was verified

On 2026-09-24, both commands were tasked on Endpoint Agent 5.3.9 sensors:

Sensor	os_processes reply	netstat reply
Linux (Ubuntu 22.04)	OS_PROCESSES_REP, 98 processes	NETSTAT_REP, 12 connections
Windows	OS_PROCESSES_REP, 84 processes	NETSTAT_REP, 56 connections

No EXISTING_PROCESS events came back for either command. The periodic NETWORK_CONNECTIONS events seen on the Linux host carry no investigation ID, so they are the sensor's regular telemetry, not the netstat reply.

Not verified: macOS (no Mac sensor available).

mkdocs build --strict passes and pytest tests/ passes (215 tests).

🤖 Generated with Claude Code

https://claude.ai/code/session_01X6h9smaXGQuviYJPcGFAkQ

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/documentation 278f605…c2613dc — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.