OTRF-OSSEM-DD/linux/osquery/events/processes.yml

name: Processes Table
description: All running processes on the host system.
platform: linux
log_source: osquery
event_id: processes
event_version: 4.4.2
event_fields:
- standard_name: TBD
  standard_type: TBD
  name: pid
  type: BIGINT
  description: Process (or thread) ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: name
  type: TEXT
  description: The process path or shorthand argv[0]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: path
  type: TEXT
  description: Path to executed binary
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: cmdline
  type: TEXT
  description: Complete argv
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: state
  type: TEXT
  description: Process state
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: cwd
  type: TEXT
  description: Process current working directory
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: root
  type: TEXT
  description: Process virtual root directory
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: uid
  type: BIGINT
  description: Unsigned user ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: gid
  type: BIGINT
  description: Unsigned group ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: euid
  type: BIGINT
  description: Unsigned effective user ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: egid
  type: BIGINT
  description: Unsigned effective group ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: suid
  type: BIGINT
  description: Unsigned saved user ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: sgid
  type: BIGINT
  description: Unsigned saved group ID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: wired_size
  type: BIGINT
  description: Bytes of unpagable memory used by process
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: resident_size
  type: BIGINT
  description: Bytes of private memory used by process
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: total_size
  type: BIGINT
  description: Total virtual memory size
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: user_time
  type: BIGINT
  description: CPU time in milliseconds spent in user space
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: system_time
  type: BIGINT
  description: CPU time in milliseconds spent in kernel space
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: disk_bytes_read
  type: BIGINT
  description: Bytes read from disk
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: disk_bytes_written
  type: BIGINT
  description: Bytes written to disk
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: start_time
  type: BIGINT
  description: Process start time in seconds since Epoch, in case of error -1
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: parent
  type: BIGINT
  description: Process parent's PID
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: pgroup
  type: BIGINT
  description: Process group
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: threads
  type: INTEGER
  description: Number of threads used by process
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: nice
  type: INTEGER
  description: Process nice level (-20 to 20, default 0)
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: is_elevated_token
  type: INTEGER
  description: Process uses elevated token yes=1, no=0 [WINDOWS]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: elapsed_time
  type: BIGINT
  description: Elapsed time in seconds this process has been running. [WINDOWS]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: handle_count
  type: BIGINT
  description: Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: percent_processor_time
  type: BIGINT
  description: Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: upid
  type: BIGINT
  description: A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: uppid
  type: BIGINT
  description: The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: cpu_type
  type: INTEGER
  description: A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]
  sample_value: TBD
- standard_name: TBD
  standard_type: TBD
  name: cpu_subtype
  type: INTEGER
  description: The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]
  sample_value: TBD
references:
- text: OSQuery table documentation
  link: https://osquery.io/schema/current#processes
tags: []