mirror of
https://github.com/OTRF/OSSEM-DD
synced 2026-06-08 12:05:33 +00:00
Swann Legras
84 lines
2.0 KiB
YAML
84 lines
2.0 KiB
YAML
name: Process_open_sockets Table
|
|
description: Processes which have open network sockets on the system.
|
|
platform: linux
|
|
log_source: osquery
|
|
event_id: process_open_sockets
|
|
event_version: 4.4.2
|
|
event_fields:
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: pid
|
|
type: INTEGER
|
|
description: Process (or thread) ID
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: fd
|
|
type: BIGINT
|
|
description: Socket file descriptor number
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: socket
|
|
type: BIGINT
|
|
description: Socket handle or inode number
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: family
|
|
type: INTEGER
|
|
description: Network protocol (IPv4, IPv6)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: protocol
|
|
type: INTEGER
|
|
description: Transport protocol (TCP/UDP)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: local_address
|
|
type: TEXT
|
|
description: Socket local address
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: remote_address
|
|
type: TEXT
|
|
description: Socket remote address
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: local_port
|
|
type: INTEGER
|
|
description: Socket local port
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: remote_port
|
|
type: INTEGER
|
|
description: Socket remote port
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: path
|
|
type: TEXT
|
|
description: For UNIX sockets (family=AF_UNIX), the domain path
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: state
|
|
type: TEXT
|
|
description: 'TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]'
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: net_namespace
|
|
type: TEXT
|
|
description: The inode number of the network namespace [LINUX]
|
|
sample_value: TBD
|
|
references:
|
|
- text: OSQuery table documentation
|
|
link: https://osquery.io/schema/current#process_open_sockets
|
|
tags: []
|