Action Actor ↗

The Action actor is an activity that took place and was recorded by the agent.

Field Name Data Type Description
action_app_id_transitions STRING List of application ID transitions.
action_boot_instance_cleanup_required BOOLEAN Indicates whether or not the agent can clean up open instances from a previous computer restart.
action_boot_time INTEGER Computer boot time in ms since epoch time.
action_country STRING The destination country of network connections, which is based on the remote IP and GeoLocation enrichment.
action_device_bus_type INTEGER For the action, the origin of the device bus type (USB).
action_device_class_guid STRING Device setup class GUID.
action_device_class_name STRING Device setup class internal friendly name.
action_device_usb_port_connectable BOOLEAN Indicates whether or not a user can connect to the USB port that the device is connected to.
action_device_usb_product_id INTEGER USB device product ID.
action_device_usb_serial_number STRING USB device serial number.
action_device_usb_vendor_id INTEGER USB vendor ID.
action_download INTEGER Number of downloaded bytes in the last window of time.
action_evtlog_data_fields STRING Event log data fields in a JSON array.
action_evtlog_description STRING Event log description.
action_evtlog_event_id INTEGER Event log event ID.
action_evtlog_level INTEGER Event log severity level.
action_evtlog_message STRING Event log message field - summary of the event.
action_evtlog_opcode INTEGER Event provider specific information, usually similar to "action_evtlog_level".
action_evtlog_pid INTEGER Process ID given in the event-log event.
action_evtlog_provider_guid STRING Provider GUID
action_evtlog_provider_name STRING <p>Windows: Provider name, such as Service Control Manager.
Linux: The file from which this event originated.</p>
action_evtlog_raw_params STRING  
action_evtlog_record_id STRING Unique ID of this event-log record in the computer's event-log.
action_evtlog_source INTEGER Method used to get the event log.
action_evtlog_tid INTEGER Thread ID given in the event-log event.
action_evtlog_uid STRING User ID given in the event-log event.
action_evtlog_username STRING User ID translation of username.
action_evtlog_version INTEGER Version of the event log record (private to provider/channel).
action_external_hostname STRING <p>The hostname the endpoint connects to.
When there is a proxy connection, this value will differ from action_remote_ip.</p>
action_external_port INTEGER <p>The external port of the initiated communication.
When there is a proxy connection, this value can differ from action_remote_port.</p>
action_file_access_time INTEGER The action file access timestamp.
action_file_archive_list RECORD Only valid if the file is a ZIP file and the event collection is enabled in the policy.
action_file_attributes INTEGER <p>Windows: Bitmask of FILE_ATTRIBUTE_* attributes, which is only relevant for some subtypes.
Unix: Always 'null'.</p>
action_file_authenticode_sha1 STRING SHA-1 (Secure Hash Algorithm 1) of the file signature authenticode.
action_file_authenticode_sha2 STRING SHA-2 (Secure Hash Algorithm 2) of the file signature authenticode.
action_file_create_time INTEGER The action file create timestamp.
action_file_device_info RECORD Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_device_type INTEGER <p>Windows: An enum representing the device type for this file.
Regular file = 0
Named pipe = 1</p>
action_file_dir_query STRING The query string given to the "query directory" operation.
action_file_dirty_reason INTEGER <p>Only valid for sub_type = 6 (write) when a non-null file_size is provided.
Indicates the reason this "final" write was issued and why the file hash was recalculated.</p>
action_file_entropy STRING  
action_file_extension STRING File extension of action_file_path.
action_file_group STRING Linux & MacOS: The new group of the file (user_id).
action_file_group_name STRING Name assigned to action_file_group (username).
action_file_hash_control_verdict STRING DEPRECATED
action_file_id STRING DEPRECATED
action_file_info_company STRING Company listed in the file information section of the file.
action_file_info_description STRING Description listed in the file information section of the file.
action_file_info_file_version STRING File version listed in the file information section of the file.
action_file_info_product_name STRING Product name listed in the file information section of the file.
action_file_info_product_version STRING Production version listed in the file information section of the file.
action_file_internal_meta_data STRING DEPRECATED
action_file_internal_zipped_files STRING DEPRECATED
action_file_md5 STRING The action file hash value in MD5.
action_file_mod_time INTEGER The action file modification timestamp.
action_file_mode RECORD A representation of the standard UNIX file permissions mask.
action_file_name STRING The file name of action_file_path, which is an empty string for directory operations.
action_file_new_file_for_loaded_dll STRING DEPRECATED
action_file_original_event_id STRING DEPRECATED
action_file_owner STRING The new owner of the file according to the user_id.
action_file_owner_name STRING The new owner of the file according to the username.
action_file_path STRING The path of the file in use.
action_file_prev_type INTEGER <p>Before the current write, the previous file type, which is based only on the content of the file. This information can be used to detect header changes.
Will be valid ONLY on the file_write event that changes the file type.
Windows only</p>
action_file_previous_device_info RECORD Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_previous_file_extension STRING File extension of 'action_file_previous_file_path'.
action_file_previous_file_name STRING File name of 'action_file_previous_file_path', which is an empty string for directory operations.
action_file_previous_file_path STRING The previous path of the file in use.
action_file_remote_file_host STRING <p>This is valid when Cortex XDR/XSIAM accesses a file on a remote computer.
This means Cortex XDR/XSIAM is the client.</p>
action_file_remote_file_ip STRING <p>This is valid when a remote computer accesses a file on this endpoint.
This means Cortex XDR/XSIAM is the client.
The remote IP can also be a loopback (127.0.0.1 or ::1).</p>
action_file_remote_ip STRING Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_file_remote_port INTEGER Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_file_reparse_path STRING Only valid for sub_type = 1/2 (create_new/open). Provides the reparse path if the file was opened through a reparse point.
action_file_sec_desc STRING Windows: Security descriptor of the file in SDDL.
action_file_sha256 STRING SHA256 of the binary.
action_file_signature_product STRING Signature product - The product family part of the signature.
action_file_signature_status INTEGER The signature status of the file in use.
action_file_signature_vendor STRING Signature vendor - The vendor part of the signature.
action_file_size INTEGER Size of the file undergoing the process in bytes.
action_file_suspicious_strings_bitmap INTEGER Bitmap of suspicious strings found in file content.
action_file_type INTEGER Partial file type recognizer.
action_file_type_changedaction_file_id INTEGER DEPRECATED
action_file_type_prev INTEGER  
action_file_wildfire_verdict STRING DEPRECATED
action_firewall_direction STRING <p>Outbound (1)
Inbound (2)</p>
action_firewall_local_ip STRING The local IP address in the communication.
action_firewall_local_port INTEGER The local port in the communication.
action_firewall_protocol INTEGER The IP protocol number as specified in RFC 1700.
action_firewall_remote_ip STRING Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_firewall_remote_port INTEGER Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_firewall_rule_guid STRING  
action_is_dll_injection BOOLEAN Indicates whether or not the action is a DLL Injection.
action_is_injected_thread BOOLEAN Indicates whether or not the action was performed by an injected thread.
action_local_ip STRING Source IP address.
action_local_ip_int INTEGER Source IP in integer format.
action_module_base_address STRING The base address where the library was loaded.
action_module_device_info RECORD Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_module_file_access_time INTEGER Program Executable (PE) metadata collection from the image itself
action_module_file_create_time INTEGER Program Executable (PE) metadata collection from the image itself
action_module_file_info STRING Program Executable (PE) metadata collection from the image itself
action_module_file_mod_time INTEGER Modified time of the file in the module.
action_module_file_size INTEGER Size of the file of the process in bytes.
action_module_image_size INTEGER Size of the file in virtual memory.
action_module_is_remote BOOLEAN Indicates whether or not the module is loaded from a remote process.
action_module_is_replay BOOLEAN All existing loaded images are replayed, when the agent starts. This is set to true for images loaded when the agent is not started yet.
action_module_md5 STRING The module md5 value.
action_module_other_load_location STRING This module was already loaded before from a different location. This is the other location.
action_module_path STRING The path of the module in use.
action_module_process_instance_id STRING Cortex instance ID of the process loading the module.
action_module_process_os_pid INTEGER The Operating System (OS) Process Identifier (PID) of the loaded module.
action_module_sha256 STRING SHA256 of the binary.
action_module_signature_product STRING Signature product - The product family part of the signature.
action_module_signature_status INTEGER The signature status of the module in action.
action_module_signature_vendor STRING Signature vendor - The vendor part of the signature.
action_network_connection_id STRING The ID of the network connection.
action_network_creation_time INTEGER The start time of the network session.
action_network_http STRING HTTP headers
action_network_is_ipv6 BOOLEAN Indicates whether or not action_remote_ip is an IPv6 endpoint.
action_network_is_npcap BOOLEAN Indicates whether or not this action is an npcap event.
action_network_is_server BOOLEAN <p>True for incoming connections.
False for outgoing ones.</p>
action_network_packet_data STRING The data is converted to hexadecimal. Each byte is converted to 2 characters representing the character value of the byte.
action_network_protocol INTEGER Internet protocol number based on IPPROTO or normalized to IPPROTO (same as Java).
action_network_stats_is_last BOOLEAN True, if the connection was terminated, and false otherwise.
action_network_stats_seq INTEGER Sequence number of the statistics "packet".
action_network_success BOOLEAN Indicates whether or not the session was successful.
action_pkts_received INTEGER Total number of packets received so far from the destination to the source.
action_pkts_sent INTEGER Total number of packets sent so far from the source to the destination.
action_powered_off BOOLEAN True, if the computer is powered off, such as suspended or hibernated, and false otherwise.
action_process_causality_id STRING Causality ID of the terminated process.
action_process_device_info RECORD Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_process_file_create_time INTEGER Creation time of the file that created the process.
action_process_file_info STRING Metadata from the exe file of the process.
action_process_file_mod_time INTEGER Modification time of the file that created the process.
action_process_file_size INTEGER Size of the file involved in the process in bytes.
action_process_image_command_line STRING Process command line - The command used to execute the process.
action_process_image_command_line_indices STRING Process command line - The command used to execute the process.
action_process_image_extension STRING Process image extension - File extension
action_process_image_md5 STRING MD5 of the binary.
action_process_image_name STRING File name of the 'action_process_image_path'.
action_process_image_path STRING Process image path - A string identifying the location of the process execution.
action_process_image_sha256 STRING SHA256 of the binary.
action_process_instance_execution_time INTEGER Instance execution time.
action_process_instance_id STRING Cortex instance ID of the process.
action_process_integrity_level INTEGER Integrity level of the process created.
action_process_is_causality_root BOOLEAN Indicates whether or not the created process is a new causality root process.
action_process_is_replay BOOLEAN <p>Windows: The following events are replayed: Processes started before the agent is started. Module load events for modules loaded in replayed processes. Drivers loaded using module load before the agent is started.
For loaded drivers, the process is always a special KernelProcess.</p>
action_process_is_special INTEGER <p>Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3</p>
action_process_is_txn    
action_process_os_pid INTEGER The Operating System (OS) Process Identifier (PID) of the new process
action_process_remote_session_ip STRING Windows: When the process was started from a remote Terminal Services session, the IP address of the remote client connected to the session.
action_process_requested_parent_iid STRING Windows: Same as the "action_process_requested_parent_pid", but the instance ID.
action_process_requested_parent_pid INTEGER Windows: A parent process can request to set the parent-pid of the child process to something other than their own. This is used for a "runas" scenario where the os_actor is different from the actor. Yet, it can also be used by malware to fake the parent pid. This field gives the requested parent pid, while giving the true actor/os_actor for the operation.
action_process_signature_product STRING Signature product - The product family part of the signature.
action_process_signature_status INTEGER <p>Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
action_process_signature_vendor STRING Signature vendor - The vendor part of the signature.
action_process_termination_code INTEGER Process exit code.
action_process_termination_date INTEGER Instance termination time.
action_process_user_sid STRING <p>Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.</p>
action_process_username STRING Name assigned to the 'action_process_user_sid'.
action_protocol INTEGER IP protocol of the network event.
action_proxy BOOLEAN <p>Indicates whether or not Cortex XDR/XSIAM performed an HTTP proxy resolution to get these fields:
action_external_hostname, action_external_port. If true, the hostname/port fields are taken from the HTTP packet data. Otherwise, they are taken from other protocols like DNS.</p>
action_registry_data STRING Registry data being written to the specific key.
action_registry_file_path STRING <p>Four operations:
Load
Save
Restore
Unload</p>
action_registry_key_name STRING Registry key name being accessed.
action_registry_old_data STRING Registry data being replaced by a new value.
action_registry_old_key_name STRING Old registry key name that is being renamed.
action_registry_return_val INTEGER Return value from the registry operation.
action_registry_value_name STRING Registry value name being accessed.
action_registry_value_type INTEGER <p>Regular types:
REG_SZ (1)
REG_EXPAND_SZ (2)
REG_BINARY (3)
REG_DWORD (4)
REG_DWORD_BIG_ENDIAN (5)
REG_LINK (6)
REG_MULTI_SZ (7)
REG_RESOURCE_LIST (8)
REG_FULL_RESOURCE_DESCRIPTOR (9)
REG_RESOURCE_REQUIREMENTS_LIST (10)
REG_QWORD (11)</p>
action_remote_ip STRING Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_ip_int INTEGER Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_port INTEGER Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_remote_process_causality_id STRING Causality ID of the remote injected process.
action_remote_process_file_access_time INTEGER Access time of the file that created the process.
action_remote_process_image_command_line STRING Process command line - The command used to execute the process.
action_remote_process_image_extension STRING Process image extension - File extension.
action_remote_process_image_md5 STRING MD5 of the binary.
action_remote_process_image_name STRING Image name of the remote injected process.
action_remote_process_image_path STRING Process image path - A string identifying the location of the execution.
action_remote_process_image_sha256 STRING SHA256 of the binary.
action_remote_process_instance_id STRING Instance ID of the remote injected process.
action_remote_process_integrity_level INTEGER Integrity level of the remote injected process.
action_remote_process_is_causality_root BOOLEAN Indicates whether or not the remote process being injected into is a causality root.
action_remote_process_os_pid INTEGER The Operating System (OS) Process Identifier (PID) of the remote process
action_remote_process_signature_product STRING Signature product - The product family part of the signature.
action_remote_process_signature_status INTEGER <p>Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p>
action_remote_process_signature_vendor STRING Signature vendor - The vendor part of the signature.
action_remote_process_thread_id INTEGER Target thread of remote execution.
action_remote_process_thread_start_address STRING Memory address of the thread being injected into a remote process.
action_remote_process_user_sid STRING <p>Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.</p>
action_remote_process_username STRING Name assigned to the action_process_user_sid field.
action_rpc_func_opnum INTEGER Integer identifying the function called.
action_rpc_interface_uuid STRING Universally Unique IDentifier (UUID) identifying the interface. An interface is only uniquely identified by the UUID + Major version + Minor version.
action_rpc_interface_version_major INTEGER Major version of the Remote Procedure Call (RPC) interface.
action_rpc_interface_version_minor INTEGER Minor version of the Remote Procedure Call (RPC) interface.
action_session_duration INTEGER Number of milliseconds (ms) since the session started.
action_syscall_etw_based BOOLEAN Indicates whether or not the system call based on Event Tracing for Windows (ETW) or on native hooking.
action_syscall_int_params STRING Action parameters where the value is an integer in the system call invocation.
action_syscall_stack_ptr STRING Stack pointer creating the captured syscall.
action_syscall_string_params STRING Action parameters where the value is a string in the system call invocation.
action_syscall_target_image_name STRING Base image name of the target process, such as lsass.exe.
action_syscall_target_image_path STRING Process image path - A string identifying the location of the execution.
action_syscall_target_instance_id STRING Instance ID of the target process, when one exists.
action_syscall_target_os_pid INTEGER The Operating System (OS) Process Identifier (PID) of the syscall target process
action_syscall_target_thread_id INTEGER Target thread ID of the captured syscall.
action_thread_thread_id INTEGER Thread ID creating the captured syscall.
action_total_download INTEGER Total number of payload bytes from the destination to the source so far.
action_total_upload INTEGER Total number of payload bytes from the source to the destination so far.
action_upload INTEGER Number of uploaded bytes in the last time window.
action_user_agent STRING The user agent used by an actor to perform an action.
action_user_is_local_session BOOLEAN Indicates whether or not the user log in from a remote computer or locally.
action_user_status INTEGER <p>Agent user status change event.
Enum mapping:
1 - logon
2 - logoff
3 - locked / screen saver on
4 - unlocked / screen saver off
5 - Reconnect
6 - Disconnect</p>
action_user_status_sid STRING Security identifier (SID) of the user.
action_username STRING Name of the user.
action_local_nat_port INTEGER Source NAT port.
action_remote_nat_port INTEGER Destination NAT port.
action_local_nat_ip STRING Source NAT IP address.
action_remote_nat_ip STRING Destination NAT IP address.
action_nat BOOLEAN Indicates whether or not the connection is NAT.
action_rpc_items RECORD EAL remote procedure call (RPC) data items.
action_category_of_app_id STRING App-ID category.
action_sub_category_of_app_id STRING App-ID sub category.
action_app_id_risk INTEGER App-ID risk
action_location RECORD Geolocation information of the source IP.
action_as_data RECORD ASN data from the source of the network activity.
action_evtlog_normalized_user RECORD A normalized user for the event log event.
action_direction_confidence INTEGER  
action_evtlog_int_fields RECORD  
action_file_pe_info RECORD Only valid according to collection policy. Usually, enabled on some write-file events. The field is not aptly named since it sometimes contains info on non-PE files as well.
action_file_last_writer_actor STRING Instance ID of the actor that wrote the file.
action_file_signature_is_embedded BOOLEAN Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_file_auth_sha1 STRING SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_auth_sha2 STRING SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_reparse_count INTEGER Only valid for sub_type = 1/2 (create_new/open), which provides the reparse count if the file was open through a reparse point.
action_file_pipe_impersonation_integrity_level INTEGER When the event type is impersonate_pipe, this field contains the integrity level of the token that is used for the impersonation.
action_file_operation_flags INTEGER The specified flags for the file operation.
action_file_is_anonymous BOOLEAN Indicates whether or not the file was created without an accesible path from the filesystem (open(..., O_TMPFILE), memfd_create).
action_module_last_writer_actor STRING Instance ID of the actor that wrote the file for the module.
action_module_code_integrity INTEGER The value of ci!g_CiOptions when the driver is loaded.
action_module_boot_code_integrity INTEGER The value of ci!g_CiOptions at boot time.
action_module_signature_is_embedded BOOLEAN Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_module_system_properties INTEGER Addition properties of the DLL.
action_module_auth_sha2 STRING SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_module_auth_sha1 STRING SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_local_port INTEGER Source port
action_network_icmp_data RECORD Only valid for event_sub_type = 18. ICMP packet data.
action_network_creation_time_original INTEGER  
action_network_is_loopback BOOLEAN <p>Valid for stream_connect, datagram_connect, raw_data, outbound_icmp and stream_statistics.
Indicates whether or not both sides of a connection are on the same host. Always false for mac and linux.</p>
action_socket_type INTEGER <p>0 : Unknown type
1 : Stream
2 : Datagram
3 : Raw</p>
action_process_pe_load_info RECORD Windows: Information about the loaded PE image.
action_process_token RECORD Security context of the process.
action_process_privileges INTEGER String representing a 64-bit integer. These are the enabled special privileges that the process is running with.
action_process_fds RECORD Unix: FD information about 'stdin', 'stdout', and 'stderr'.
action_process_is_container_root BOOLEAN Linux: True for the process that creates the container.
action_process_container_info    
action_process_ns_pid INTEGER The PID of the new process in the relevant Linux namespace.
action_process_ns_user_sid STRING Linux-only: Effective UID of the executed binary in the relevant Linux namespace.
action_process_ns_user_real_sid STRING Linux-only: Real UID of the executed binary in the relevant Linux namespace.
action_process_is_remote_session_root    
action_process_remote_session_port    
action_process_local_session_ip    
action_process_local_session_port    
action_process_static_analysis_score INTEGER Static analysis score of executed binary. Scale of 0-1, where 0 is definitely benign, and 1 is definitely malware.
action_process_container_id STRING Linux: The ID of the container in which this process is running.
action_process_user_real_sid STRING Unix-only: Real UID of the executed binary.
action_process_signature_is_embedded BOOLEAN Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_process_file_access_time INTEGER Access time of the file that created the process.
action_process_cwd STRING Working directory from which the process was executed.
action_process_is_64bit BOOLEAN Indicates whether or not the process is 64 bit.
action_process_is_native BOOLEAN Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_process_peb STRING Windows: The address of the PEB of the process.
action_process_peb32 STRING Windows: The address of the PEB32 of the process. Only non-zero if this is a WOW64 process.
action_process_image_auth_sha1 RECORD SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_image_auth_sha2 STRING SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_last_writer_actor STRING Instance ID of the actor that wrote the file for this process.
action_process_script STRING When the executable is an interpreter, the script that it is executing.
action_process_script_device_info RECORD Info about the device (volume + HW) from which this script was executed.
action_process_environment_variables MAP Envrionment variables that were sent on the process execution.
action_remote_process_file_info RECORD Metadata from the EXE file of the process.
action_remote_process_file_create_time INTEGER Creation time of the file that created the process.
action_remote_process_file_mod_time INTEGER Modification time of the file that created the process.
action_remote_process_signature_is_embedded BOOLEAN Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_remote_process_is_special INTEGER <p>Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3</p>
action_remote_process_is_replay BOOLEAN Indicates whether or not the agent was alive during the execution of the process.
action_remote_process_is_64bit BOOLEAN Indicates whether or not the process is 64 bit.
action_remote_process_is_native BOOLEAN Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_remote_process_file_size INTEGER Size of the file of the process in bytes.
action_remote_process_image_auth_sha1 STRING SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_remote_process_image_auth_sha2 STRING Process image SHA-2 authenticode.
action_remote_process_last_writer_actor STRING The instance ID of the last writer that changed the file of the process.
action_user_session_id INTEGER Windows: Session ID of the process.
action_mount_device_info RECORD Info about the device (volume + HW).
action_rpc_func_exception_code INTEGER If an exception occurred during this remote procedure call (RPC), the exception code is provided. Otherwise, the value is 0.
action_rpc_interface_name STRING Description of the remote procedure call (RPC) interface, taken from the IDL file.
action_rpc_func_str_call_fields RECORD <p>Parameters where the keys are the names of the argument in the function call. The values are the values of the parameters. Values are strings. For instance, if we have a remote procedure call (RPC) to CreateService(ServiceName, ServiceType), we will get something like
{ "ServiceName": "MyServiceName1", "ServiceType": "3"}.</p>
action_rpc_func_name STRING Function name taken from the IDL file.
action_rpc_func_int_call_fields RECORD Same as the field action_rpc_func_str_call_fields, but the values are integers. Since the values are in a uint64_t format, they are still serialized as strings.
action_device_usb_vendor_name    
action_device_usb_product_name    
action_device_usb_interface_class INTEGER  
action_device_usb_interface_sub_class INTEGER  
action_thread_start_address INTEGER Start address of the thread function, which is serialized as a string as it can be a true 64-bit address.
action_thread_parent_pid INTEGER Windows: Same as the actor info.
action_thread_parent_tid INTEGER Windows: Same as the actor info.
action_thread_parent_iid STRING Windows: Same as the actor info.
action_thread_child_pid INTEGER  
action_thread_child_tid INTEGER  
action_thread_child_iid STRING  
action_thread_stack_base STRING Windows: Base of the stack.
action_thread_stack_limit STRING Windows: Limit of the stack.
action_thread_teb STRING Windows: Address of the TEB of the thread.
action_process_handle_is_kernel BOOLEAN Indicates whether or not a handle is used by the kernel.
action_process_handle_granted_access INTEGER Access rights that were granted when opening the handle.
action_process_handle_opened_process_pid INTEGER PID of the process opened.
action_process_handle_opened_process_iid STRING IID of the process opened.
address_mapping RECORD <p>symbol_name: Name of the suspicious function.
image_path: Path of the image containing the function or image injected to.
index: By default, set to 1. In Syscall events, points to a function parameter number.</p>
action_ns_flags INTEGER <p>Unshare: Flags raw value.
Setns: nstype raw value.</p>
action_ns_path STRING Setns-only: Path to the namespace file descriptor.
action_time_change_clock_diff_ms INTEGER Difference in milliseconds from previous system time.
action_trace_flags INTEGER Flags that were sent to the ptrace function.
action_trace_ret INTEGER Return value of the ptrace function.
action_trace_request_id INTEGER Request ID of the ptrace function.