mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
18 lines
935 B
YAML
18 lines
935 B
YAML
name: Get Process Info
|
|
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71
|
|
version: '2.0'
|
|
date: '2019-04-01'
|
|
description: This search queries the Endpoint data model to give you details about
|
|
the process running on a host which is under investigation. To gather the process
|
|
info, enter the values for the process name in question and the destination IP address.
|
|
how_to_implement: To successfully implement this search you must be ingesting endpoint
|
|
data and populating the Endpoint data model.
|
|
author: Bhavin Patel, Splunk
|
|
inputs:
|
|
- process_name
|
|
- dest
|
|
search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as
|
|
lastTime from datamodel=Endpoint.Processes where Proceses.dest={dest} Proceses.process_name={process_name}
|
|
by Processes.parent_process Processes.process_name Processes.user Processes.dest
|
|
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` '
|