You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/ecs-process.md
-6Lines changed: 0 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,9 +21,7 @@ These fields can help you correlate metrics information with a process id/name f
21
21
|$$$field-process-args-count$$$[process.args_count](#field-process-args-count)| Length of the process.args array.<br><br>This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.<br><br>type: long<br><br>example: `4`<br><br>[](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation)[process.args_count](https://opentelemetry.io/docs/specs/semconv/attributes-registry/process/#process-args-count)| extended |
22
22
|$$$field-process-command-line$$$[process.command_line](#field-process-command-line)| Full command line that started the process, including the absolute path to the executable, and all arguments.<br><br>Some arguments may be filtered to protect sensitive information.<br><br>type: wildcard<br><br>Multi-fields:<br><br>* process.command_line.text (type: match_only_text)<br><br>example: `/usr/bin/ssh -l user 10.0.0.16`<br><br>[](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation)[process.command_line](https://opentelemetry.io/docs/specs/semconv/attributes-registry/process/#process-command-line)| extended |
23
23
|$$$field-process-end$$$[process.end](#field-process-end)| The time the process ended.<br><br>type: date<br><br>example: `2016-05-23T08:05:34.853Z`| extended |
24
-
|$$$field-process-endpoint-security-client$$$[process.endpoint_security_client](#field-process-endpoint-security-client)|_This field is beta and subject to change._ Processes that have an endpoint security client must have the com.apple.endpointsecurity entitlement and the value is set to true in the message.<br><br>type: boolean | extended |
25
24
|$$$field-process-entity-id$$$[process.entity_id](#field-process-entity-id)| Unique identifier for the process.<br><br>The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.<br><br>Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.<br><br>type: keyword<br><br>example: `c2c455d9f99375d`| extended |
26
-
|$$$field-process-entry-meta-type$$$[process.entry_meta.type](#field-process-entry-meta-type)| The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console<br><br>Note: This field is only set on process.session_leader.<br><br>type: keyword | extended |
27
25
|$$$field-process-env-vars$$$[process.env_vars](#field-process-env-vars)| Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.<br><br>May be filtered to protect sensitive information.<br><br>type: keyword<br><br>Note: This field should contain an array of values.<br><br>example: `["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]`| extended |
28
26
|$$$field-process-executable$$$[process.executable](#field-process-executable)| Absolute path to the process executable.<br><br>type: keyword<br><br>Multi-fields:<br><br>* process.executable.text (type: match_only_text)<br><br>example: `/usr/bin/ssh`<br><br>[](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation)[process.executable.path](https://opentelemetry.io/docs/specs/semconv/attributes-registry/process/#process-executable-path)| extended |
29
27
|$$$field-process-exit-code$$$[process.exit_code](#field-process-exit-code)| The exit code of the process, if this is a termination event.<br><br>The field should be absent if there is no exit code for the event (e.g. process start).<br><br>type: long<br><br>example: `137`| extended |
@@ -38,11 +36,7 @@ These fields can help you correlate metrics information with a process id/name f
38
36
|$$$field-process-io-total-bytes-skipped$$$[process.io.total_bytes_skipped](#field-process-io-total-bytes-skipped)| The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero<br><br>type: long | extended |
39
37
|$$$field-process-io-type$$$[process.io.type](#field-process-io-type)| The type of object on which the IO action (read or write) was taken.<br><br>Currently only 'tty' is supported. Other types may be added in the future for 'file' and 'socket' support.<br><br>type: keyword | extended |
40
38
|$$$field-process-name$$$[process.name](#field-process-name)| Process name.<br><br>Sometimes called program name or similar.<br><br>type: keyword<br><br>Multi-fields:<br><br>* process.name.text (type: match_only_text)<br><br>example: `ssh`| extended |
41
-
|$$$field-process-origin-referrer-url$$$[process.origin_referrer_url](#field-process-origin-referrer-url)|_This field is beta and subject to change._ The URL of the webpage that linked to the process's executable file.<br><br>type: keyword<br><br>example: `http://example.com/article1.html`| extended |
42
-
|$$$field-process-origin-url$$$[process.origin_url](#field-process-origin-url)|_This field is beta and subject to change._ The URL where the process's executable file is hosted.<br><br>type: keyword<br><br>example: `http://example.com/files/example.exe`| extended |
43
39
|$$$field-process-pid$$$[process.pid](#field-process-pid)| Process id.<br><br>type: long<br><br>example: `4242`<br><br>[](/reference/ecs-opentelemetry.md#ecs-opentelemetry-relation)[process.pid](https://opentelemetry.io/docs/specs/semconv/attributes-registry/process/#process-pid)| core |
44
-
|$$$field-process-platform-binary$$$[process.platform_binary](#field-process-platform-binary)|_This field is beta and subject to change._ Binaries that are shipped by the operating system are defined as platform binaries, this value is then set to true.<br><br>type: boolean | extended |
45
-
| $$$field-process-same-as-process$$$ [process.same_as_process](#field-process-same-as-process) | This boolean is used to identify if a leader process is the same as the top level process.<br><br>For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.<br><br>This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)<br><br>Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`<br><br>Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.<br><br>type: boolean<br><br>example: `True` | extended |
46
40
|$$$field-process-start$$$[process.start](#field-process-start)| The time the process started.<br><br>type: date<br><br>example: `2016-05-23T08:05:34.853Z`| extended |
47
41
|$$$field-process-thread-capabilities-effective$$$[process.thread.capabilities.effective](#field-process-thread-capabilities-effective)| This is the set of capabilities used by the kernel to perform permission checks for the thread.<br><br>type: keyword<br><br>Note: This field should contain an array of values.<br><br>example: `["CAP_BPF", "CAP_SYS_ADMIN"]`| extended |
48
42
|$$$field-process-thread-capabilities-permitted$$$[process.thread.capabilities.permitted](#field-process-thread-capabilities-permitted)| This is a limiting superset for the effective capabilities that the thread may assume.<br><br>type: keyword<br><br>Note: This field should contain an array of values.<br><br>example: `["CAP_BPF", "CAP_SYS_ADMIN"]`| extended |
0 commit comments