Actor Actor

The Actor actor is the process that performed the action.

| Field Name | Data Type | Description |
| --------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| actor\_causality\_id | STRING | Will match 'causality\_actor\_causality\_id' in the causality owner actor fields. |
| actor\_effective\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| actor\_effective\_username | STRING | <p>Name assigned to 'actor_effective_user_sid'.<br>Win: Includes the domain.</p> |
| actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not a user can connect to the USB port that the device is connected to. |
| actor\_os\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the operating system's actor process. |
| actor\_primary\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| actor\_process\_causality\_id | STRING | Cortex XDR/XSIAM unique causality ID for the actor casuality chain. |
| actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| actor\_process\_execution\_time | INTEGER | Timestamp of the execution in epoch time. |
| actor\_process\_file\_access\_time | INTEGER | Creation time of the file that created the actor process. |
| actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| actor\_process\_image\_name | STRING | File name of the actor\_process\_image\_path. |
| actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| actor\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier of the actor process. |
| actor\_process\_integrity\_level | INTEGER | Integrity level of the process. |
| actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is a 64-bit process. |
| actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process a "native process". |
| actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the agent was alive during the execution of the process. |
| actor\_process\_is\_special | INTEGER | <p>Indicates special system processes:<br>RegularProcess = 0<br>KernelProcess = 1<br>AppContainerProcess = 2<br>NonWin32SubsystemProcess = 3</p> |
| actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the actor process. |
| actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature embedded inside the Program Executable (PE) or part of an external catalog file. |
| actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| actor\_process\_signature\_status | INTEGER | <p>Signature status of the process:<br>Signed = 1<br>SignedInvalid = 2<br>Unsigned = 3<br>FailedToObtain = 4<br>WeakHash = 5, where the MD5 is used as the hash algorithm.<br>Unsupported = 6, which means the signature was not calculated.<br>InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.<br>Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p> |
| actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| actor\_thread\_thread\_id | INTEGER | An identifier of the OS thread which is responsible for the event. |
| actor\_type | INTEGER | <p>Enum describing actor type:<br>Local = 1, where the actor is a local process.<br>RemoteRpcNamedPipe = 2, where the actor is a remote procedure call (RPC) over a named-pipe/SMB connection.<br>RemoteRpcHttp = 3, where the actor is a remote procedure call (RPC) over a remote HTTP connection.<br>RemoteRpcTcp = 4, where the actor is a remote procedure call (RPC) over a TCP connection.<br>RemoteFileSmb = 5, where the actor is a remote file operation over SMB.</p> |
| actor\_primary\_normalized\_user | RECORD | A normalized user for the actor. |
| actor\_effective\_normalized\_user | RECORD | Normalized user information. |
| actor\_container\_info | RECORD | Container information for the process. |
| actor\_process\_ns\_pid | | |
| actor\_ns\_user\_sid | | |
| actor\_process\_container\_id | | |
| actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| actor\_local\_ip | STRING | Source IP of the network activity. |
| actor\_local\_port | INTEGER | Source port for the network activity |
| actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the actor process image. |
| actor\_process\_static\_analysis\_score | DEPRECATED | |
| actor\_process\_file\_original\_name | STRING | Original file name of the actor image based on the file information metadata. |
| actor\_process\_file\_internal\_name | STRING | Internal name of the actor image based on the file information metadata. |