mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
39 lines
697 B
YAML
39 lines
697 B
YAML
name: Endpoint.Processes
|
|
prefix: Processes
|
|
fields:
|
|
- action
|
|
- cpu_load_percent
|
|
- dest
|
|
- dest_bunit
|
|
- dest_category
|
|
- dest_is_expected
|
|
- dest_priority
|
|
- dest_requires_av
|
|
- dest_should_timesync
|
|
- dest_should_update
|
|
- loaded_file
|
|
- mem_used
|
|
- original_file_name
|
|
- os
|
|
- parent_process
|
|
- parent_process_exec
|
|
- parent_process_id
|
|
- parent_process_guid
|
|
- parent_process_name
|
|
- parent_process_path
|
|
- process
|
|
- process_current_directory
|
|
- process_exec
|
|
- process_hash
|
|
- process_guid
|
|
- process_id
|
|
- process_integrity_level
|
|
- process_name
|
|
- process_path
|
|
- tag
|
|
- user
|
|
- user_id
|
|
- user_bunit
|
|
- user_category
|
|
- user_priority
|
|
- vendor_product |