Module process

Expand description

These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message. The process.pid often stays in the metric itself and is copied to the global field for correlation.

Constants§

PROCESS_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_CODE_SIGNATURE_DIGEST_ALGORITHM: The hashing algorithm used to sign the process. This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.
PROCESS_CODE_SIGNATURE_EXISTS: Boolean to capture if a signature is present.
PROCESS_CODE_SIGNATURE_SIGNING_ID: The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.
PROCESS_CODE_SIGNATURE_STATUS: Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.
PROCESS_CODE_SIGNATURE_SUBJECT_NAME: Subject name of the code signer
PROCESS_CODE_SIGNATURE_TEAM_ID: The team identifier used to sign the process. This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.
PROCESS_CODE_SIGNATURE_TIMESTAMP: Date and time when the code signature was generated and signed.
PROCESS_CODE_SIGNATURE_TRUSTED: Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.
PROCESS_CODE_SIGNATURE_VALID: Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked.
PROCESS_COMMAND_LINE: Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information.
PROCESS_ELF_ARCHITECTURE: Machine architecture of the ELF file.
PROCESS_ELF_BYTE_ORDER: Byte sequence of ELF file.
PROCESS_ELF_CPU_TYPE: CPU type of the ELF file.
PROCESS_ELF_CREATION_DATE: Extracted when possible from the file’s metadata. Indicates when it was built or compiled. It can also be faked by malware creators.
PROCESS_ELF_EXPORTS: List of exported element names and types.
PROCESS_ELF_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_ELF_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_ELF_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_ELF_GO_IMPORT_HASH: A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_ELF_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_ELF_HEADER_ABI_VERSION: Version of the ELF Application Binary Interface (ABI).
PROCESS_ELF_HEADER_CLASS: Header class of the ELF file.
PROCESS_ELF_HEADER_DATA: Data table of the ELF header.
PROCESS_ELF_HEADER_ENTRYPOINT: Header entrypoint of the ELF file.
PROCESS_ELF_HEADER_OBJECT_VERSION: “0x1” for original ELF files.
PROCESS_ELF_HEADER_OS_ABI: Application Binary Interface (ABI) of the Linux OS.
PROCESS_ELF_HEADER_TYPE: Header type of the ELF file.
PROCESS_ELF_HEADER_VERSION: Version of the ELF header.
PROCESS_ELF_IMPORTS: List of imported element names and types.
PROCESS_ELF_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_ELF_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_ELF_IMPORT_HASH: A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is an ELF implementation of the Windows PE imphash.
PROCESS_ELF_SECTIONS: An array containing an object for each section of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.sections.*.
PROCESS_ELF_SECTIONS_CHI2: Chi-square probability distribution of the section.
PROCESS_ELF_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_ELF_SECTIONS_FLAGS: ELF Section List flags.
PROCESS_ELF_SECTIONS_NAME: ELF Section List name.
PROCESS_ELF_SECTIONS_PHYSICAL_OFFSET: ELF Section List offset.
PROCESS_ELF_SECTIONS_PHYSICAL_SIZE: ELF Section List physical size.
PROCESS_ELF_SECTIONS_TYPE: ELF Section List type.
PROCESS_ELF_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_ELF_SECTIONS_VIRTUAL_ADDRESS: ELF Section List virtual address.
PROCESS_ELF_SECTIONS_VIRTUAL_SIZE: ELF Section List virtual size.
PROCESS_ELF_SEGMENTS: An array containing an object for each segment of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.segments.*.
PROCESS_ELF_SEGMENTS_SECTIONS: ELF object segment sections.
PROCESS_ELF_SEGMENTS_TYPE: ELF object segment type.
PROCESS_ELF_SHARED_LIBRARIES: List of shared libraries used by this ELF object.
PROCESS_ELF_TELFHASH: telfhash symbol hash for ELF file.
PROCESS_END: The time the process ended.
PROCESS_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_ENTRY_LEADER_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_ENTRY_LEADER_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_ENTRY_LEADER_ATTESTED_GROUPS_NAME: Name of the group.
PROCESS_ENTRY_LEADER_ATTESTED_USER_ID: Unique identifier of the user.
PROCESS_ENTRY_LEADER_ATTESTED_USER_NAME: Short name or login of the user.
PROCESS_ENTRY_LEADER_COMMAND_LINE: Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information.
PROCESS_ENTRY_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_ENTRY_LEADER_ENTRY_META_SOURCE_IP: IP address of the source (IPv4 or IPv6).
PROCESS_ENTRY_LEADER_ENTRY_META_TYPE: The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console Note: This field is only set on process.session_leader.
PROCESS_ENTRY_LEADER_EXECUTABLE: Absolute path to the process executable.
PROCESS_ENTRY_LEADER_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_ENTRY_LEADER_GROUP_NAME: Name of the group.
PROCESS_ENTRY_LEADER_INTERACTIVE: Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.
PROCESS_ENTRY_LEADER_NAME: Process name. Sometimes called program name or similar.
PROCESS_ENTRY_LEADER_PARENT_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_ENTRY_LEADER_PARENT_PID: Process id.
PROCESS_ENTRY_LEADER_PARENT_SESSION_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_ENTRY_LEADER_PARENT_SESSION_LEADER_PID: Process id.
PROCESS_ENTRY_LEADER_PARENT_SESSION_LEADER_START: The time the process started.
PROCESS_ENTRY_LEADER_PARENT_SESSION_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_ENTRY_LEADER_PARENT_START: The time the process started.
PROCESS_ENTRY_LEADER_PARENT_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_ENTRY_LEADER_PID: Process id.
PROCESS_ENTRY_LEADER_REAL_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_ENTRY_LEADER_REAL_GROUP_NAME: Name of the group.
PROCESS_ENTRY_LEADER_REAL_USER_ID: Unique identifier of the user.
PROCESS_ENTRY_LEADER_REAL_USER_NAME: Short name or login of the user.
PROCESS_ENTRY_LEADER_SAME_AS_PROCESS: This boolean is used to identify if a leader process is the same as the top level process. For example, if process.group_leader.same_as_process = true, it means the process event in question is the leader of its process group. Details under process.* like pid would be the same under process.group_leader.* The same applies for both process.session_leader and process.entry_leader. This field exists to the benefit of EQL and other rule engines since it’s not possible to compare equality between two fields in a single document. e.g process.entity_id = process.group_leader.entity_id (top level process is the process group leader) OR process.entity_id = process.entry_leader.entity_id (top level process is the entry session leader) Instead these rules could be written like: process.group_leader.same_as_process: true OR process.entry_leader.same_as_process: true Note: This field is only set on process.entry_leader, process.session_leader and process.group_leader.
PROCESS_ENTRY_LEADER_SAVED_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_ENTRY_LEADER_SAVED_GROUP_NAME: Name of the group.
PROCESS_ENTRY_LEADER_SAVED_USER_ID: Unique identifier of the user.
PROCESS_ENTRY_LEADER_SAVED_USER_NAME: Short name or login of the user.
PROCESS_ENTRY_LEADER_START: The time the process started.
PROCESS_ENTRY_LEADER_SUPPLEMENTAL_GROUPS_ID: Unique identifier for the group on the system/platform.
PROCESS_ENTRY_LEADER_SUPPLEMENTAL_GROUPS_NAME: Name of the group.
PROCESS_ENTRY_LEADER_TTY: Information about the controlling TTY device. If set, the process belongs to an interactive session.
PROCESS_ENTRY_LEADER_TTY_CHAR_DEVICE_MAJOR: The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as “ttyS0” and “pts/0”. For more details, please refer to the Linux kernel documentation.
PROCESS_ENTRY_LEADER_TTY_CHAR_DEVICE_MINOR: The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.
PROCESS_ENTRY_LEADER_USER_ID: Unique identifier of the user.
PROCESS_ENTRY_LEADER_USER_NAME: Short name or login of the user.
PROCESS_ENTRY_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_ENTRY_LEADER_WORKING_DIRECTORY: The working directory of the process.
PROCESS_ENV_VARS: Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution. May be filtered to protect sensitive information.
PROCESS_EXECUTABLE: Absolute path to the process executable.
PROCESS_EXIT_CODE: The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start).
PROCESS_GROUP_LEADER_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_GROUP_LEADER_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_GROUP_LEADER_COMMAND_LINE: Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information.
PROCESS_GROUP_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_GROUP_LEADER_EXECUTABLE: Absolute path to the process executable.
PROCESS_GROUP_LEADER_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_GROUP_LEADER_GROUP_NAME: Name of the group.
PROCESS_GROUP_LEADER_INTERACTIVE: Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.
PROCESS_GROUP_LEADER_NAME: Process name. Sometimes called program name or similar.
PROCESS_GROUP_LEADER_PID: Process id.
PROCESS_GROUP_LEADER_REAL_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_GROUP_LEADER_REAL_GROUP_NAME: Name of the group.
PROCESS_GROUP_LEADER_REAL_USER_ID: Unique identifier of the user.
PROCESS_GROUP_LEADER_REAL_USER_NAME: Short name or login of the user.
PROCESS_GROUP_LEADER_SAME_AS_PROCESS: This boolean is used to identify if a leader process is the same as the top level process. For example, if process.group_leader.same_as_process = true, it means the process event in question is the leader of its process group. Details under process.* like pid would be the same under process.group_leader.* The same applies for both process.session_leader and process.entry_leader. This field exists to the benefit of EQL and other rule engines since it’s not possible to compare equality between two fields in a single document. e.g process.entity_id = process.group_leader.entity_id (top level process is the process group leader) OR process.entity_id = process.entry_leader.entity_id (top level process is the entry session leader) Instead these rules could be written like: process.group_leader.same_as_process: true OR process.entry_leader.same_as_process: true Note: This field is only set on process.entry_leader, process.session_leader and process.group_leader.
PROCESS_GROUP_LEADER_SAVED_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_GROUP_LEADER_SAVED_GROUP_NAME: Name of the group.
PROCESS_GROUP_LEADER_SAVED_USER_ID: Unique identifier of the user.
PROCESS_GROUP_LEADER_SAVED_USER_NAME: Short name or login of the user.
PROCESS_GROUP_LEADER_START: The time the process started.
PROCESS_GROUP_LEADER_SUPPLEMENTAL_GROUPS_ID: Unique identifier for the group on the system/platform.
PROCESS_GROUP_LEADER_SUPPLEMENTAL_GROUPS_NAME: Name of the group.
PROCESS_GROUP_LEADER_TTY: Information about the controlling TTY device. If set, the process belongs to an interactive session.
PROCESS_GROUP_LEADER_TTY_CHAR_DEVICE_MAJOR: The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as “ttyS0” and “pts/0”. For more details, please refer to the Linux kernel documentation.
PROCESS_GROUP_LEADER_TTY_CHAR_DEVICE_MINOR: The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.
PROCESS_GROUP_LEADER_USER_ID: Unique identifier of the user.
PROCESS_GROUP_LEADER_USER_NAME: Short name or login of the user.
PROCESS_GROUP_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_GROUP_LEADER_WORKING_DIRECTORY: The working directory of the process.
PROCESS_HASH_MD5: MD5 hash.
PROCESS_HASH_SHA1: SHA1 hash.
PROCESS_HASH_SHA256: SHA256 hash.
PROCESS_HASH_SHA384: SHA384 hash.
PROCESS_HASH_SHA512: SHA512 hash.
PROCESS_HASH_SSDEEP: SSDEEP hash.
PROCESS_HASH_TLSH: TLSH hash.
PROCESS_INTERACTIVE: Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.
PROCESS_IO: A chunk of input or output (IO) from a single process. This field only appears on the top level process object, which is the process that wrote the output or read the input.
PROCESS_IO_BYTES_SKIPPED: An array of byte offsets and lengths denoting where IO data has been skipped.
PROCESS_IO_BYTES_SKIPPED_LENGTH: The length of bytes skipped.
PROCESS_IO_BYTES_SKIPPED_OFFSET: The byte offset into this event’s io.text (or io.bytes in the future) where length bytes were skipped.
PROCESS_IO_MAX_BYTES_PER_PROCESS_EXCEEDED: If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
PROCESS_IO_TEXT: A chunk of output or input sanitized to UTF-8. Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.
PROCESS_IO_TOTAL_BYTES_CAPTURED: The total number of bytes captured in this event.
PROCESS_IO_TOTAL_BYTES_SKIPPED: The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero
PROCESS_IO_TYPE: The type of object on which the IO action (read or write) was taken. Currently only ‘tty’ is supported. Other types may be added in the future for ‘file’ and ‘socket’ support.
PROCESS_MACHO_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_MACHO_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_MACHO_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_MACHO_GO_IMPORT_HASH: A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_MACHO_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_MACHO_IMPORTS: List of imported element names and types.
PROCESS_MACHO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_MACHO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_MACHO_IMPORT_HASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash.
PROCESS_MACHO_SECTIONS: An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.
PROCESS_MACHO_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_MACHO_SECTIONS_NAME: Mach-O Section List name.
PROCESS_MACHO_SECTIONS_PHYSICAL_SIZE: Mach-O Section List physical size.
PROCESS_MACHO_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_MACHO_SECTIONS_VIRTUAL_SIZE: Mach-O Section List virtual size. This is always the same as physical_size.
PROCESS_MACHO_SYMHASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash
PROCESS_NAME: Process name. Sometimes called program name or similar.
PROCESS_PARENT_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_PARENT_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_PARENT_CODE_SIGNATURE_DIGEST_ALGORITHM: The hashing algorithm used to sign the process. This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.
PROCESS_PARENT_CODE_SIGNATURE_EXISTS: Boolean to capture if a signature is present.
PROCESS_PARENT_CODE_SIGNATURE_SIGNING_ID: The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.
PROCESS_PARENT_CODE_SIGNATURE_STATUS: Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.
PROCESS_PARENT_CODE_SIGNATURE_SUBJECT_NAME: Subject name of the code signer
PROCESS_PARENT_CODE_SIGNATURE_TEAM_ID: The team identifier used to sign the process. This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.
PROCESS_PARENT_CODE_SIGNATURE_TIMESTAMP: Date and time when the code signature was generated and signed.
PROCESS_PARENT_CODE_SIGNATURE_TRUSTED: Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.
PROCESS_PARENT_CODE_SIGNATURE_VALID: Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked.
PROCESS_PARENT_COMMAND_LINE: Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information.
PROCESS_PARENT_ELF_ARCHITECTURE: Machine architecture of the ELF file.
PROCESS_PARENT_ELF_BYTE_ORDER: Byte sequence of ELF file.
PROCESS_PARENT_ELF_CPU_TYPE: CPU type of the ELF file.
PROCESS_PARENT_ELF_CREATION_DATE: Extracted when possible from the file’s metadata. Indicates when it was built or compiled. It can also be faked by malware creators.
PROCESS_PARENT_ELF_EXPORTS: List of exported element names and types.
PROCESS_PARENT_ELF_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_PARENT_ELF_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_ELF_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_ELF_GO_IMPORT_HASH: A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_PARENT_ELF_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_PARENT_ELF_HEADER_ABI_VERSION: Version of the ELF Application Binary Interface (ABI).
PROCESS_PARENT_ELF_HEADER_CLASS: Header class of the ELF file.
PROCESS_PARENT_ELF_HEADER_DATA: Data table of the ELF header.
PROCESS_PARENT_ELF_HEADER_ENTRYPOINT: Header entrypoint of the ELF file.
PROCESS_PARENT_ELF_HEADER_OBJECT_VERSION: “0x1” for original ELF files.
PROCESS_PARENT_ELF_HEADER_OS_ABI: Application Binary Interface (ABI) of the Linux OS.
PROCESS_PARENT_ELF_HEADER_TYPE: Header type of the ELF file.
PROCESS_PARENT_ELF_HEADER_VERSION: Version of the ELF header.
PROCESS_PARENT_ELF_IMPORTS: List of imported element names and types.
PROCESS_PARENT_ELF_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_ELF_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_ELF_IMPORT_HASH: A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is an ELF implementation of the Windows PE imphash.
PROCESS_PARENT_ELF_SECTIONS: An array containing an object for each section of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.sections.*.
PROCESS_PARENT_ELF_SECTIONS_CHI2: Chi-square probability distribution of the section.
PROCESS_PARENT_ELF_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_PARENT_ELF_SECTIONS_FLAGS: ELF Section List flags.
PROCESS_PARENT_ELF_SECTIONS_NAME: ELF Section List name.
PROCESS_PARENT_ELF_SECTIONS_PHYSICAL_OFFSET: ELF Section List offset.
PROCESS_PARENT_ELF_SECTIONS_PHYSICAL_SIZE: ELF Section List physical size.
PROCESS_PARENT_ELF_SECTIONS_TYPE: ELF Section List type.
PROCESS_PARENT_ELF_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_PARENT_ELF_SECTIONS_VIRTUAL_ADDRESS: ELF Section List virtual address.
PROCESS_PARENT_ELF_SECTIONS_VIRTUAL_SIZE: ELF Section List virtual size.
PROCESS_PARENT_ELF_SEGMENTS: An array containing an object for each segment of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.segments.*.
PROCESS_PARENT_ELF_SEGMENTS_SECTIONS: ELF object segment sections.
PROCESS_PARENT_ELF_SEGMENTS_TYPE: ELF object segment type.
PROCESS_PARENT_ELF_SHARED_LIBRARIES: List of shared libraries used by this ELF object.
PROCESS_PARENT_ELF_TELFHASH: telfhash symbol hash for ELF file.
PROCESS_PARENT_END: The time the process ended.
PROCESS_PARENT_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_PARENT_EXECUTABLE: Absolute path to the process executable.
PROCESS_PARENT_EXIT_CODE: The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start).
PROCESS_PARENT_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_PARENT_GROUP_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_PARENT_GROUP_LEADER_PID: Process id.
PROCESS_PARENT_GROUP_LEADER_START: The time the process started.
PROCESS_PARENT_GROUP_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_PARENT_GROUP_NAME: Name of the group.
PROCESS_PARENT_HASH_MD5: MD5 hash.
PROCESS_PARENT_HASH_SHA1: SHA1 hash.
PROCESS_PARENT_HASH_SHA256: SHA256 hash.
PROCESS_PARENT_HASH_SHA384: SHA384 hash.
PROCESS_PARENT_HASH_SHA512: SHA512 hash.
PROCESS_PARENT_HASH_SSDEEP: SSDEEP hash.
PROCESS_PARENT_HASH_TLSH: TLSH hash.
PROCESS_PARENT_INTERACTIVE: Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.
PROCESS_PARENT_MACHO_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_PARENT_MACHO_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_MACHO_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_MACHO_GO_IMPORT_HASH: A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_PARENT_MACHO_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_PARENT_MACHO_IMPORTS: List of imported element names and types.
PROCESS_PARENT_MACHO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_MACHO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_MACHO_IMPORT_HASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash.
PROCESS_PARENT_MACHO_SECTIONS: An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.
PROCESS_PARENT_MACHO_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_PARENT_MACHO_SECTIONS_NAME: Mach-O Section List name.
PROCESS_PARENT_MACHO_SECTIONS_PHYSICAL_SIZE: Mach-O Section List physical size.
PROCESS_PARENT_MACHO_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_PARENT_MACHO_SECTIONS_VIRTUAL_SIZE: Mach-O Section List virtual size. This is always the same as physical_size.
PROCESS_PARENT_MACHO_SYMHASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash
PROCESS_PARENT_NAME: Process name. Sometimes called program name or similar.
PROCESS_PARENT_PE_ARCHITECTURE: CPU architecture target for the file.
PROCESS_PARENT_PE_COMPANY: Internal company name of the file, provided at compile-time.
PROCESS_PARENT_PE_DESCRIPTION: Internal description of the file, provided at compile-time.
PROCESS_PARENT_PE_FILE_VERSION: Internal version of the file, provided at compile-time.
PROCESS_PARENT_PE_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_PARENT_PE_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_PE_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_PARENT_PE_GO_IMPORT_HASH: A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_PARENT_PE_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_PARENT_PE_IMPHASH: A hash of the imports in a PE file. An imphash – or import hash – can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.
PROCESS_PARENT_PE_IMPORTS: List of imported element names and types.
PROCESS_PARENT_PE_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_PE_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_PARENT_PE_IMPORT_HASH: A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for imphash.
PROCESS_PARENT_PE_ORIGINAL_FILE_NAME: Internal name of the file, provided at compile-time.
PROCESS_PARENT_PE_PEHASH: A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.
PROCESS_PARENT_PE_PRODUCT: Internal product name of the file, provided at compile-time.
PROCESS_PARENT_PE_SECTIONS: An array containing an object for each section of the PE file. The keys that should be present in these objects are defined by sub-fields underneath pe.sections.*.
PROCESS_PARENT_PE_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_PARENT_PE_SECTIONS_NAME: PE Section List name.
PROCESS_PARENT_PE_SECTIONS_PHYSICAL_SIZE: PE Section List physical size.
PROCESS_PARENT_PE_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_PARENT_PE_SECTIONS_VIRTUAL_SIZE: PE Section List virtual size. This is always the same as physical_size.
PROCESS_PARENT_PGID: Deprecated for removal in next major version release. This field is superseded by process.group_leader.pid. Identifier of the group of processes the process belongs to.
PROCESS_PARENT_PID: Process id.
PROCESS_PARENT_REAL_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_PARENT_REAL_GROUP_NAME: Name of the group.
PROCESS_PARENT_REAL_USER_ID: Unique identifier of the user.
PROCESS_PARENT_REAL_USER_NAME: Short name or login of the user.
PROCESS_PARENT_SAVED_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_PARENT_SAVED_GROUP_NAME: Name of the group.
PROCESS_PARENT_SAVED_USER_ID: Unique identifier of the user.
PROCESS_PARENT_SAVED_USER_NAME: Short name or login of the user.
PROCESS_PARENT_START: The time the process started.
PROCESS_PARENT_SUPPLEMENTAL_GROUPS_ID: Unique identifier for the group on the system/platform.
PROCESS_PARENT_SUPPLEMENTAL_GROUPS_NAME: Name of the group.
PROCESS_PARENT_THREAD_CAPABILITIES_EFFECTIVE: This is the set of capabilities used by the kernel to perform permission checks for the thread.
PROCESS_PARENT_THREAD_CAPABILITIES_PERMITTED: This is a limiting superset for the effective capabilities that the thread may assume.
PROCESS_PARENT_THREAD_ID: Thread ID.
PROCESS_PARENT_THREAD_NAME: Thread name.
PROCESS_PARENT_TITLE: Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.
PROCESS_PARENT_TTY: Information about the controlling TTY device. If set, the process belongs to an interactive session.
PROCESS_PARENT_TTY_CHAR_DEVICE_MAJOR: The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as “ttyS0” and “pts/0”. For more details, please refer to the Linux kernel documentation.
PROCESS_PARENT_TTY_CHAR_DEVICE_MINOR: The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.
PROCESS_PARENT_UPTIME: Seconds the process has been up.
PROCESS_PARENT_USER_ID: Unique identifier of the user.
PROCESS_PARENT_USER_NAME: Short name or login of the user.
PROCESS_PARENT_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_PARENT_WORKING_DIRECTORY: The working directory of the process.
PROCESS_PE_ARCHITECTURE: CPU architecture target for the file.
PROCESS_PE_COMPANY: Internal company name of the file, provided at compile-time.
PROCESS_PE_DESCRIPTION: Internal description of the file, provided at compile-time.
PROCESS_PE_FILE_VERSION: Internal version of the file, provided at compile-time.
PROCESS_PE_GO_IMPORTS: List of imported Go language element names and types.
PROCESS_PE_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
PROCESS_PE_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
PROCESS_PE_GO_IMPORT_HASH: A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
PROCESS_PE_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
PROCESS_PE_IMPHASH: A hash of the imports in a PE file. An imphash – or import hash – can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.
PROCESS_PE_IMPORTS: List of imported element names and types.
PROCESS_PE_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
PROCESS_PE_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
PROCESS_PE_IMPORT_HASH: A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for imphash.
PROCESS_PE_ORIGINAL_FILE_NAME: Internal name of the file, provided at compile-time.
PROCESS_PE_PEHASH: A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.
PROCESS_PE_PRODUCT: Internal product name of the file, provided at compile-time.
PROCESS_PE_SECTIONS: An array containing an object for each section of the PE file. The keys that should be present in these objects are defined by sub-fields underneath pe.sections.*.
PROCESS_PE_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
PROCESS_PE_SECTIONS_NAME: PE Section List name.
PROCESS_PE_SECTIONS_PHYSICAL_SIZE: PE Section List physical size.
PROCESS_PE_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
PROCESS_PE_SECTIONS_VIRTUAL_SIZE: PE Section List virtual size. This is always the same as physical_size.
PROCESS_PGID: Deprecated for removal in next major version release. This field is superseded by process.group_leader.pid. Identifier of the group of processes the process belongs to.
PROCESS_PID: Process id.
PROCESS_PREVIOUS_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_PREVIOUS_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_PREVIOUS_EXECUTABLE: Absolute path to the process executable.
PROCESS_REAL_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_REAL_GROUP_NAME: Name of the group.
PROCESS_REAL_USER_ID: Unique identifier of the user.
PROCESS_REAL_USER_NAME: Short name or login of the user.
PROCESS_SAVED_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_SAVED_GROUP_NAME: Name of the group.
PROCESS_SAVED_USER_ID: Unique identifier of the user.
PROCESS_SAVED_USER_NAME: Short name or login of the user.
PROCESS_SESSION_LEADER_ARGS: Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information.
PROCESS_SESSION_LEADER_ARGS_COUNT: Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.
PROCESS_SESSION_LEADER_COMMAND_LINE: Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information.
PROCESS_SESSION_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_SESSION_LEADER_EXECUTABLE: Absolute path to the process executable.
PROCESS_SESSION_LEADER_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_SESSION_LEADER_GROUP_NAME: Name of the group.
PROCESS_SESSION_LEADER_INTERACTIVE: Whether the process is connected to an interactive shell. Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.
PROCESS_SESSION_LEADER_NAME: Process name. Sometimes called program name or similar.
PROCESS_SESSION_LEADER_PARENT_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_SESSION_LEADER_PARENT_PID: Process id.
PROCESS_SESSION_LEADER_PARENT_SESSION_LEADER_ENTITY_ID: Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.
PROCESS_SESSION_LEADER_PARENT_SESSION_LEADER_PID: Process id.
PROCESS_SESSION_LEADER_PARENT_SESSION_LEADER_START: The time the process started.
PROCESS_SESSION_LEADER_PARENT_SESSION_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_SESSION_LEADER_PARENT_START: The time the process started.
PROCESS_SESSION_LEADER_PARENT_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_SESSION_LEADER_PID: Process id.
PROCESS_SESSION_LEADER_REAL_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_SESSION_LEADER_REAL_GROUP_NAME: Name of the group.
PROCESS_SESSION_LEADER_REAL_USER_ID: Unique identifier of the user.
PROCESS_SESSION_LEADER_REAL_USER_NAME: Short name or login of the user.
PROCESS_SESSION_LEADER_SAME_AS_PROCESS: This boolean is used to identify if a leader process is the same as the top level process. For example, if process.group_leader.same_as_process = true, it means the process event in question is the leader of its process group. Details under process.* like pid would be the same under process.group_leader.* The same applies for both process.session_leader and process.entry_leader. This field exists to the benefit of EQL and other rule engines since it’s not possible to compare equality between two fields in a single document. e.g process.entity_id = process.group_leader.entity_id (top level process is the process group leader) OR process.entity_id = process.entry_leader.entity_id (top level process is the entry session leader) Instead these rules could be written like: process.group_leader.same_as_process: true OR process.entry_leader.same_as_process: true Note: This field is only set on process.entry_leader, process.session_leader and process.group_leader.
PROCESS_SESSION_LEADER_SAVED_GROUP_ID: Unique identifier for the group on the system/platform.
PROCESS_SESSION_LEADER_SAVED_GROUP_NAME: Name of the group.
PROCESS_SESSION_LEADER_SAVED_USER_ID: Unique identifier of the user.
PROCESS_SESSION_LEADER_SAVED_USER_NAME: Short name or login of the user.
PROCESS_SESSION_LEADER_START: The time the process started.
PROCESS_SESSION_LEADER_SUPPLEMENTAL_GROUPS_ID: Unique identifier for the group on the system/platform.
PROCESS_SESSION_LEADER_SUPPLEMENTAL_GROUPS_NAME: Name of the group.
PROCESS_SESSION_LEADER_TTY: Information about the controlling TTY device. If set, the process belongs to an interactive session.
PROCESS_SESSION_LEADER_TTY_CHAR_DEVICE_MAJOR: The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as “ttyS0” and “pts/0”. For more details, please refer to the Linux kernel documentation.
PROCESS_SESSION_LEADER_TTY_CHAR_DEVICE_MINOR: The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.
PROCESS_SESSION_LEADER_USER_ID: Unique identifier of the user.
PROCESS_SESSION_LEADER_USER_NAME: Short name or login of the user.
PROCESS_SESSION_LEADER_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_SESSION_LEADER_WORKING_DIRECTORY: The working directory of the process.
PROCESS_START: The time the process started.
PROCESS_SUPPLEMENTAL_GROUPS_ID: Unique identifier for the group on the system/platform.
PROCESS_SUPPLEMENTAL_GROUPS_NAME: Name of the group.
PROCESS_THREAD_CAPABILITIES_EFFECTIVE: This is the set of capabilities used by the kernel to perform permission checks for the thread.
PROCESS_THREAD_CAPABILITIES_PERMITTED: This is a limiting superset for the effective capabilities that the thread may assume.
PROCESS_THREAD_ID: Thread ID.
PROCESS_THREAD_NAME: Thread name.
PROCESS_TITLE: Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.
PROCESS_TTY: Information about the controlling TTY device. If set, the process belongs to an interactive session.
PROCESS_TTY_CHAR_DEVICE_MAJOR: The major number identifies the driver associated with the device. The character device’s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as “ttyS0” and “pts/0”. For more details, please refer to the Linux kernel documentation.
PROCESS_TTY_CHAR_DEVICE_MINOR: The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.
PROCESS_TTY_COLUMNS: The number of character columns per line. e.g terminal width Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = ‘text_output’
PROCESS_TTY_ROWS: The number of character rows in the terminal. e.g terminal height Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = ‘text_output’
PROCESS_UPTIME: Seconds the process has been up.
PROCESS_USER_ID: Unique identifier of the user.
PROCESS_USER_NAME: Short name or login of the user.
PROCESS_VPID: Virtual process id. The process id within a pid namespace. This is not necessarily unique across all processes on the host but it is unique within the process namespace that the process exists within.
PROCESS_WORKING_DIRECTORY: The working directory of the process.

Module process

Module process Copy item path

Constants§

Module process