DST Action Actor

The DST Action actor is the receiving process for actions performed remotely from one host to another.

| Field Name | Data Type | Description |
| -------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| dst\_actor\_causality\_id | STRING | Causality ID of the destination actor. |
| dst\_actor\_effective\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| dst\_actor\_effective\_username | STRING | Name assigned to the 'actor\_effective\_user\_sid'. |
| dst\_actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not this destination actor's thread is an injected thread. |
| dst\_actor\_os\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the destination operating system's actor process. |
| dst\_actor\_primary\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective unique identifier (UID) of the executed binary.</p> |
| dst\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| dst\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_actor\_process\_causality\_id | STRING | Causality ID of the destination actor process. |
| dst\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| dst\_actor\_process\_execution\_time | INTEGER | Destination actor process execution time in epoch time. |
| dst\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the destination actor process. |
| dst\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| dst\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| dst\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| dst\_actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| dst\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| dst\_actor\_process\_image\_name | STRING | File name of the 'dst\_actor\_process\_image\_path'. |
| dst\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| dst\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| dst\_actor\_process\_instance\_id | STRING | Process instance ID. |
| dst\_actor\_process\_integrity\_level | INTEGER | Process integrity level. |
| dst\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64-bit. |
| dst\_actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32-bit machine the value is always true, and on a 64-bit machine the value is true, if the process is 64-bit. |
| dst\_actor\_process\_is\_replay | BOOLEAN | A boolean value that specifies whether the Agent was alive during the execution of the process. |
| dst\_actor\_process\_is\_special | INTEGER | <p>Indicates special system processes:<br>RegularProcess = 0<br>KernelProcess = 1<br>AppContainerProcess = 2<br>NonWin32SubsystemProcess = 3</p> |
| dst\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the destination actor process |
| dst\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| dst\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| dst\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| dst\_actor\_process\_signature\_status | INTEGER | <p>Signature status of the process: Signed = 1<br>SignedInvalid = 2<br>Unsigned = 3<br>FailedToObtain = 4<br>WeakHash = 5. Means that MD5 is used as the hash algorithm.<br>Unsupported = 6. This means signature was not calculated.<br>InvalidCVE2020_0601 = 7. This means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601<br>Deleted = 8. Means that the file was deleted by the time the agent tried to calculate signature.</p> |
| dst\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| dst\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| dst\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| dst\_actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| dst\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| dst\_actor\_thread\_thread\_id | INTEGER | An identifier of the operating system (OS) thread responsible for the event. |
| dst\_actor\_type | INTEGER | <p>The type of actor: Local = 1. The actor is a local process.<br>RemoteRpcNamedPipe = 2. The actor is a Remote Procedure Call (RPC) over a named-pipe/SMB connection.<br>RemoteRpcHttp = 3. The actor is a Remote Procedure Call (RPC) over a remote HTTP connection.<br>RemoteRpcTcp = 4. The actor is a Remote Procedure Call (RPC) over a TCP connection.<br>RemoteFileSmb = 5. The actor is a remote file operation over SMB.</p> |
| dst\_actor\_primary\_normalized\_user | RECORD | A normalized user for the destination actor. |
| dst\_actor\_effective\_normalized\_user | RECORD | A normalized user for the destination actor. |
| dst\_actor\_container\_info | RECORD | Container information for the destination process. |
| dst\_actor\_process\_ns\_pid | | |
| dst\_actor\_ns\_user\_sid | | |
| dst\_actor\_process\_container\_id | STRING | Container ID that is running this destination process. |
| dst\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| dst\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| dst\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| dst\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| dst\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| dst\_actor\_local\_ip | | |
| dst\_actor\_local\_port | | |
| dst\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| dst\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| dst\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the actor process image. |
| dst\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| dst\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| dst\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |