On this page
Edit this page

processes

Endpoint Process Events

Attributes

Entity

Name

Type

Description

Sample Value

process

process_call_trace

string

Stack trace of where open process is called

C:\WINDOWS\SYSTEM32\ntdll.dll+a0344

process

process_command_line

string

Command arguments that were were executed by the process in the endpoint.

C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

process

process_company

string

Company name metadata of the Image file

Microsoft Corporation

process

process_file_description

string

Description of the Image file

Console Window Host

process

process_file_directory

string

Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path.

C:\WINDOWS\system32\

process

process_file_name

string

Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file.

conhost.exe

process

process_file_path

string

The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space.

C:\Windows\System32\conhost.exe

process

process_file_product

string

The Image’s file product name

Microsoft® Windows® Operating System

process

process_file_version

string

Version of the Image file

10.0.16299.15 (WinBuild.160101.0800)

process

process_granted_access

string

granted access code requested/used to open a target process

0x1000

process

process_guid

string

Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.

A98268C1-9C2E-5ACD-0000-0010396CAB00

process

process_hash_imphash

string

IMPHASH hash of the image/binary/file

2505BD03D7BD285E50CE89CEC02B333B

process

process_hash_md5

string

MD5 hash of the image/binary/file

6A255BEBF3DBCD13585538ED47DBAFD7

process

process_hash_sha1

string

SHA1 hash of the image/binary/file

B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2

process

process_hash_sha256

string

SHA256 hash of the image/binary/file

4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C

process

process_hash_sha512

string

SHA512 hash of the image/binary/file

1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB

process

process_id

integer

Process unique identifier used by the current operating system to identify a process.

4756

process

process_injected_address

string

The memory address where the subprocess is injected

0xFFFFBC6422DD9C20

process

process_integrity_level

string

Integrity label assigned to a process

Medium

process

process_is_hidden

boolean

Describes if the process is hidden.

True

process

process_name

string

Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file.

conhost.exe

process

process_parent_call_trace

string

Stack trace of where open process is called

C:\WINDOWS\SYSTEM32\ntdll.dll+a0344

process

process_parent_command_line

string

Command arguments that were were executed by the process in the endpoint.

C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

process

process_parent_company

string

Company name metadata of the Image file

Microsoft Corporation

process

process_parent_file_description

string

Description of the Image file

Console Window Host

process

process_parent_file_directory

string

Current working directory for the Image file related to the process. It does not include the Image file name. Only the Path.

C:\WINDOWS\system32\

process

process_parent_file_name

string

Name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file.

conhost.exe

process

process_parent_file_path

string

The complete path and name of the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space.

C:\Windows\System32\conhost.exe

process

process_parent_file_product

string

The Image’s file product name

Microsoft® Windows® Operating System

process

process_parent_file_version

string

Version of the Image file

10.0.16299.15 (WinBuild.160101.0800)

process

process_parent_granted_access

string

granted access code requested/used to open a target process

0x1000

process

process_parent_guid

string

Process global unique identifer used to identify a process across other operating systems. This can be created by group hashing values such as Process Name, Process Id, Process Start Time, Process Path and even Computer Name. Datasets such as Sysmon call this the ProcessGuid. This is similar to the output from the UUIDGEN command.

A98268C1-9C2E-5ACD-0000-0010396CAB00

process

process_parent_hash_imphash

string

IMPHASH hash of the image/binary/file

2505BD03D7BD285E50CE89CEC02B333B

process

process_parent_hash_md5

string

MD5 hash of the image/binary/file

6A255BEBF3DBCD13585538ED47DBAFD7

process

process_parent_hash_sha1

string

SHA1 hash of the image/binary/file

B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2

process

process_parent_hash_sha256

string

SHA256 hash of the image/binary/file

4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C

process

process_parent_hash_sha512

string

SHA512 hash of the image/binary/file

1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB

process

process_parent_id

integer

Process unique identifier used by the current operating system to identify a process.

4756

process

process_parent_injected_address

string

The memory address where the subprocess is injected

0xFFFFBC6422DD9C20

process

process_parent_integrity_level

string

Integrity label assigned to a process

Medium

process

process_parent_is_hidden

boolean

Describes if the process is hidden.

True

process

process_parent_name

string

Name of the process derived from the Image file or executable file used to define the initial code and data mapped into the process’ virtual address space. This does not contain the full patth of the Image file.

conhost.exe
Tables network_session