diff --git a/auto.json b/auto.json
index 15a4df7..55e79dc 100644
--- a/auto.json
+++ b/auto.json
@@ -3281,5 +3281,13 @@
             "SentinelUI.exe"
         ],
         "url": "https://www.sentinelone.com/"
+    },
+    "OneSec": {
+        "processes": [
+            "tbAgent.exe",
+            "tbAgentSrv.exe",
+            "tbGuard.exe"
+        ],
+        "url": "https://threatbook.cn/onesec"
     }
 }