An operating system process.
Fields
| Field Name | Description |
|---|---|
pid - Int!
|
The process identifier (PID) for this process on the Endpoint where it was seen. |
name - String!
|
The name of the process' executable file. |
path - String!
|
The full path to the executable file. |
commandLineArgs - String!
|
The executable file path followed by the command line options at invocation. |
workingDir - String!
|
The file system directory the process was invoked from. |
executableOnDisk - Boolean!
|
True of the process' executable file is found on the disk. |
memory - ProcessMemory!
|
Information about the process' memory utilization. |
disk - ProcessDisk!
|
The process' usage of hard disks. |
startTime - Time
|
The time the process was started if available. |
parent - Int!
|
The process identifier (PID) of this process' parent process. |
processGroup - [Int]
|
The process group's identifiers (PIDs) if available. |
threads - Uint64
|
The number of threads or light-weight-process' (LWP) the process has. |
elapsedTime - DurationMs
|
The duration the process has been running if available. |
cpuPercent - Float!
|
The percentage of CPU time used by this process, on a 0 to 100 scale (not a 0 to 1 fraction), e.g. 62.5 meaning 62.5%. |
openFiles - [OpenFile!]
|
Files currently open by this process. |
openSockets - [OpenSocket!]
|
Sockets currently opened by this process. |
osSpecific - ProcessOsSpecific
|
Operating specific attributes of this process. |
Used by
ProcessesPayloadtype: Payload for the processes query.
Example
Example
{
"pid": 987,
"name": "abc123",
"path": "abc123",
"commandLineArgs": "xyz789",
"workingDir": "xyz789",
"executableOnDisk": false,
"memory": ProcessMemory,
"disk": ProcessDisk,
"startTime": "2021-10-07T18:23:25.829Z",
"parent": 123,
"processGroup": [123],
"threads": "8589934592",
"elapsedTime": "600",
"cpuPercent": 123.45,
"openFiles": [OpenFile],
"openSockets": [OpenSocket],
"osSpecific": ProcessWindows
}