struct

ECS::LogEntry::Process::Parent

Inherits JSON::Serializable < Struct < Value < Object

Constructors

new(pull : JSON::PullParser)

Source

new

Initialize all values as nil

Source

new(*, __pull_for_json_serializable pull : JSON::PullParser)

Source

Instance methods

args(new_value : String)

A chainable setter for args

Source

args

process.parent.args

Array of process arguments.

May be filtered to protect sensitive information.

Level: Extended Type: Keyword Example:

["ssh", "-l", "user", "10.0.0.16"]

Source

args=(args : String | Nil)

process.parent.args

Array of process arguments.

May be filtered to protect sensitive information.

Level: Extended Type: Keyword Example:

["ssh", "-l", "user", "10.0.0.16"]

Source

args_count(new_value : UInt64)

A chainable setter for args_count

Source

args_count

process.parent.args_count

Length of the process.args array.

This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.

Level: Extended Type: Long Example:

Source

args_count=(args_count : UInt64 | Nil)

process.parent.args_count

Length of the process.args array.

This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.

Level: Extended Type: Long Example:

Source

codesignature(value : CodeSignature)

A chainable setter for codesignature

Source

codesignature

Source

codesignature

Initialize a new CodeSignature, yield it to the block

Source

codesignature=(codesignature : CodeSignature | Nil)

Source

command_line(new_value : String)

A chainable setter for command_line

Source

command_line

process.parent.command_line

Full command line that started the process, including the absolute path to the executable, and all arguments.

Some arguments may be filtered to protect sensitive information.

Level: Extended Type: Keyword Example:

/usr/bin/ssh -l user 10.0.0.16

Source

command_line=(command_line : String | Nil)

process.parent.command_line

Full command line that started the process, including the absolute path to the executable, and all arguments.

Some arguments may be filtered to protect sensitive information.

Level: Extended Type: Keyword Example:

/usr/bin/ssh -l user 10.0.0.16

Source

entity_id(new_value : String)

A chainable setter for entity_id

Source

entity_id

process.parent.entity_id

Unique identifier for the process.

The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.

Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

Level: Extended Type: Keyword Example:

c2c455d9f99375d

Source

entity_id=(entity_id : String | Nil)

process.parent.entity_id

Unique identifier for the process.

Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

Level: Extended Type: Keyword Example:

c2c455d9f99375d

Source

executable(new_value : String)

A chainable setter for executable

Source

executable

process.parent.executable

Absolute path to the process executable.

Level: Extended Type: Keyword Example:

/usr/bin/ssh

Source

executable=(executable : String | Nil)

process.parent.executable

Absolute path to the process executable.

Level: Extended Type: Keyword Example:

/usr/bin/ssh

Source

exit_code(new_value : UInt64)

A chainable setter for exit_code

Source

exit_code

process.parent.exit_code

The exit code of the process, if this is a termination event.

The field should be absent if there is no exit code for the event (e.g. process start).

Level: Extended Type: Long Example:

Source

exit_code=(exit_code : UInt64 | Nil)

process.parent.exit_code

The exit code of the process, if this is a termination event.

The field should be absent if there is no exit code for the event (e.g. process start).

Level: Extended Type: Long Example:

Source

hash(value : Hash)

A chainable setter for hash

Source

hash

Generates an UInt64 hash value for this object.

This method must have the property that a == b implies a.hash == b.hash.

The hash value is used along with == by the Hash class to determine if two objects reference the same hash key.

Subclasses must not override this method. Instead, they must define hash(hasher), though usually the macro def_hash can be used to generate this method.

Source

hash

Initialize a new Hash, yield it to the block

Source

hash=(hash : Hash | Nil)

Source

name(new_value : String)

A chainable setter for name

Source

name

process.parent.name

Process name.

Sometimes called program name or similar.

Level: Extended Type: Keyword Example:

ssh

Source

name=(name : String | Nil)

process.parent.name

Process name.

Sometimes called program name or similar.

Level: Extended Type: Keyword Example:

ssh

Source

pgid(new_value : UInt64)

A chainable setter for pgid

Source

pgid

process.parent.pgid

Identifier of the group of processes the process belongs to.

Level: Extended Type: Long

Source

pgid=(pgid : UInt64 | Nil)

process.parent.pgid

Identifier of the group of processes the process belongs to.

Level: Extended Type: Long

Source

pid(new_value : UInt64)

A chainable setter for pid

Source

pid

process.parent.pid

Process id.

Level: Core Type: Long Example:

Source

pid=(pid : UInt64 | Nil)

process.parent.pid

Process id.

Level: Core Type: Long Example:

Source

ppid(new_value : UInt64)

A chainable setter for ppid

Source

ppid

process.parent.ppid

Parent process' pid.

Level: Extended Type: Long Example:

Source

ppid=(ppid : UInt64 | Nil)

process.parent.ppid

Parent process' pid.

Level: Extended Type: Long Example:

Source

start(new_value : Time)

A chainable setter for start

Source

start

process.parent.start

The time the process started.

Level: Extended Type: Date Example:

2016-05-23T08:05:34.853Z

Source

start=(start : Time | Nil)

process.parent.start

The time the process started.

Level: Extended Type: Date Example:

2016-05-23T08:05:34.853Z

Source

thread(value : Thread)

A chainable setter for thread

Source

thread

Source

thread

Initialize a new Thread, yield it to the block

Source

thread=(thread : Thread | Nil)

Source

title(new_value : String)

A chainable setter for title

Source

title

process.parent.title

Process title.

The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.

Level: Extended Type: Keyword

Source

title=(title : String | Nil)

process.parent.title

Process title.

The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.

Level: Extended Type: Keyword

Source

uptime(new_value : UInt64)

A chainable setter for uptime

Source

uptime

process.parent.uptime

Seconds the process has been up.

Level: Extended Type: Long Example:

Source

uptime=(uptime : UInt64 | Nil)

process.parent.uptime

Seconds the process has been up.

Level: Extended Type: Long Example:

Source

working_directory(new_value : String)

A chainable setter for working_directory

Source

working_directory

process.parent.working_directory

The working directory of the process.

Level: Extended Type: Keyword Example:

/home/alice

Source

working_directory=(working_directory : String | Nil)

process.parent.working_directory

The working directory of the process.

Level: Extended Type: Keyword Example:

/home/alice

Source

Constructors

Instance methods

Nested types