mirror of
https://github.com/OTRF/OSSEM-DD
synced 2026-06-08 12:05:33 +00:00
Swann Legras
90 lines
1.9 KiB
YAML
90 lines
1.9 KiB
YAML
name: Shared_memory Table
|
|
description: OS shared memory regions.
|
|
platform: linux
|
|
log_source: osquery
|
|
event_id: shared_memory
|
|
event_version: 4.4.2
|
|
event_fields:
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: shmid
|
|
type: INTEGER
|
|
description: Shared memory segment ID
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: owner_uid
|
|
type: BIGINT
|
|
description: User ID of owning process
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: creator_uid
|
|
type: BIGINT
|
|
description: User ID of creator process
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: pid
|
|
type: BIGINT
|
|
description: Process ID to last use the segment
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: creator_pid
|
|
type: BIGINT
|
|
description: Process ID that created the segment
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: atime
|
|
type: BIGINT
|
|
description: Attached time
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: dtime
|
|
type: BIGINT
|
|
description: Detached time
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: ctime
|
|
type: BIGINT
|
|
description: Changed time
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: permissions
|
|
type: TEXT
|
|
description: Memory segment permissions
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: size
|
|
type: BIGINT
|
|
description: Size in bytes
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: attached
|
|
type: INTEGER
|
|
description: Number of attached processes
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: status
|
|
type: TEXT
|
|
description: Destination/attach status
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: locked
|
|
type: INTEGER
|
|
description: 1 if segment is locked else 0
|
|
sample_value: TBD
|
|
references:
|
|
- text: OSQuery table documentation
|
|
link: https://osquery.io/schema/current#shared_memory
|
|
tags: []
|