Causality Actor

The Causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR/XSIAM agent identified as being responsible for initiating the process tree.

| Field Name | Data Type | Description |
| -------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| causality\_actor\_causality\_id | STRING | Causality ID of the causality actor. |
| causality\_actor\_effective\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| causality\_actor\_effective\_username | STRING | Source effective username. |
| causality\_actor\_primary\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| causality\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| causality\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| causality\_actor\_process\_causality\_id | STRING | Causality ID of the causality actor process. |
| causality\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| causality\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| causality\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| causality\_actor\_process\_execution\_time | INTEGER | Causality actor process execution time in epoch time. |
| causality\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the process. |
| causality\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| causality\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| causality\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| causality\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| causality\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| causality\_actor\_process\_image\_name | STRING | File name of the 'causality\_actor\_process\_image\_path'. |
| causality\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| causality\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| causality\_actor\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the causality actor process. |
| causality\_actor\_process\_integrity\_level | INTEGER | Process integrity level. |
| causality\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64-bit. |
| causality\_actor\_process\_is\_native | BOOLEAN | Indicates whether this process is a "native process". On a 32-bit machine the value is always true; on a 64-bit machine, it is true, if the process is a 64-bit process. |
| causality\_actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the Agent was alive during the execution of the process. |
| causality\_actor\_process\_is\_special | INTEGER | <p>Indicates special system processes:<br>RegularProcess = 0<br>KernelProcess = 1<br>AppContainerProcess = 2<br>NonWin32SubsystemProcess = 3</p> |
| causality\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| causality\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the causality actor process |
| causality\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| causality\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| causality\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| causality\_actor\_process\_signature\_status | INTEGER | <p>Signature status of the process: Signed = 1<br>SignedInvalid = 2<br>Unsigned = 3<br>FailedToObtain = 4<br>WeakHash = 5, which means that MD5 is used as the hash algorithm.<br>Unsupported = 6, which means the signature was not calculated.<br>InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.<br>Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p> |
| causality\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| causality\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| causality\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| causality\_actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| causality\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| causality\_actor\_remote\_port\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| causality\_actor\_session\_id | INTEGER | Sesion ID |
| causality\_actor\_type | INTEGER | <p>Local = 1. The actor is a local process<br>RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection.<br>RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection.<br>RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection.<br>RemoteFileSmb = 5. The actor is a remote file operation over SMB.</p> |
| causality\_actor\_primary\_normalized\_user | RECORD | Normalized user information. |
| causality\_actor\_container\_info | RECORD | The container information for the process. |
| causality\_actor\_process\_ns\_pid | | |
| causality\_actor\_ns\_user\_sid | | |
| causality\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| causality\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| causality\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| causality\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| causality\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| causality\_actor\_local\_ip | | |
| causality\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the causality actor process image. |
| causality\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| causality\_actor\_local\_port | | |
| causality\_actor\_process\_container\_id | | |
| causality\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-2 authenticode. |
| causality\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-1 authenticode. |
| causality\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| causality\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |