OS Actor

The OS actor is the process identified by the operation system as the process that performed the action.

| Field Name | Data Type | Description |
| ------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| os\_actor\_causality\_id | STRING | the causality chain identifier of the Operating System actor |
| os\_actor\_effective\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| os\_actor\_effective\_username | STRING | the username which launched the Operating System actor process |
| os\_actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not the thread is injected to the operating system actor process. |
| os\_actor\_primary\_user\_sid | STRING | <p>Win: Primary user token of the executed binary.<br>Unix: Effective UID of the executed binary.</p> |
| os\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| os\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| os\_actor\_process\_causality\_id | STRING | the causality chain identifier of the Operating System actor process |
| os\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| os\_actor\_process\_execution\_time | INTEGER | the execution timestamp |
| os\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the process |
| os\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| os\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| os\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| os\_actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| os\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| os\_actor\_process\_image\_name | STRING | the process image name on the disk |
| os\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| os\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| os\_actor\_process\_instance\_id | STRING | Process instance identifier. |
| os\_actor\_process\_integrity\_level | INTEGER | the integrity level of the process (INTEGER) |
| os\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is compiled for 64 bit. |
| os\_actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32 bit machine the value will be always true, on 64 bit machine it will be true if the process is 64 bit. |
| os\_actor\_process\_is\_replay | BOOLEAN | <p>Indicates whether or not the process event data is replayed or not.<br>replayed means that the agent sent the data after the action occured for example after a reboot</p> |
| os\_actor\_process\_is\_special | INTEGER | <p>Indicates special system processes:<br>RegularProcess = 0<br>KernelProcess = 1<br>AppContainerProcess = 2<br>NonWin32SubsystemProcess = 3</p> |
| os\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| os\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the operating system actor process |
| os\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| os\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| os\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| os\_actor\_process\_signature\_status | INTEGER | <p>Signature status of the process:<br>Signed = 1<br>SignedInvalid = 2<br>Unsigned = 3<br>FailedToObtain = 4<br>WeakHash = 5, where the MD5 is used as the hash algorithm.<br>Unsupported = 6, which means the signature was not calculated.<br>InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.<br>Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.</p> |
| os\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| os\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| os\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| os\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| os\_actor\_session\_id | INTEGER | session id of the actor process |
| os\_actor\_thread\_thread\_id | INTEGER | thread id of the thread in the process which made the action |
| os\_actor\_type | INTEGER | <p>Enum describing actor type:<br>Local = 1. The actor is a local process<br>RemoteRpcNamedPipe = 2. The actor is remote RPC over a named-pipe/SMB connection<br>RemoteRpcHttp = 3. The actor is remote RPC a remote HTTP connection<br>RemoteRpcTcp = 4. The actor is remote RPC over a TCP connection<br>RemoteFileSmb = 5. The actor is a remote file operation over SMB</p> |
| os\_actor\_container\_info | RECORD | Container information for the process. |
| os\_actor\_process\_ns\_pid | | |
| os\_actor\_ns\_user\_sid | | |
| os\_actor\_process\_container\_id | | |
| os\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| os\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| os\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the os actor process image. |
| os\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| os\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| os\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| os\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| os\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| os\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| os\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| os\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |