Collected runtime event types that GuardDuty uses

Process name

Name of the observed process.

Process Path

Absolute path of the process executable.

Process ID

The ID assigned to the process by the operating system.

Namespace PID

The process ID of the process in a secondary PID namespace other than the host level PID namespace. For processes inside a container, it is the process ID observed inside the container.

Process User ID

The unique ID of the user that executed the process.

Process UUID

The unique ID assigned to the process by GuardDuty.

Process GID

Process ID of the process group.

Process EGID

Effective group ID of the process group.

Process EUID

Effective user ID of the process.

Process User Name

The user name that executed the process.

Process Start Time

The time when the process was created. This field is in the UTC date string format (2023-03-22T19:37:20.168Z).

Process Executable SHA-256

The SHA256 hash of the process executable.

Process Script Path

Path of the script file that was executed.

Process Environment Variable

The environment variable made available to the process. Only LD_PRELOAD and LD_LIBRARY_PATH get collected.

Process Present Working Directory (PWD)

Present working directory of the process.

Parent process

Process details of the parent process. A parent process is a process that created the observed process.

Command Line Arguments

Presently, this field is limited to specific agent versions corresponding to the resource type:

For more information, see GuardDuty agent release history.

Command-line arguments provided at the time of process execution. This field might contain sensitive customer data.

Container Name

Name of the container.

When available, this field displays the value of the label io.kubenetes.container.name.

Container UID

The unique ID of the container assigned by the container runtime.

Container Runtime

The container runtime (such as docker or containerd) used to run the container.

Container Image ID

The ID of the container image.

Container Image Name

Name of the container image.

Task Amazon Resource Name (ARN)

The ARN of the task.

Cluster Name

The name of the Amazon ECS cluster.

Family Name

The task definition's family name. The family is used as a name for the task definition that is used to launch the task.

Service Name

The name of the Amazon ECS service, if the task was launched as part of a service.

Launch Type

The infrastructure on which your task runs. For Runtime Monitoring with resource type as ECSCluster, the launch type could be either EC2 or FARGATE.

CPU

The number of CPU units used by the task as expressed in the task definition.

Pod ID

The ID of the Kubernetes pod.

Pod name

Name of the Kubernetes pod.

Pod Namespace

Name of the Kubernetes namespace to which the Kubernetes workload belongs.

Kubernetes Cluster Name

Name of the Kubernetes cluster.

Socket Type

Type of socket to indicate communication semantics. For example, SOCK_RAW.

Address Family

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP v4 protocol.

Direction ID

The ID of the connection direction.

Protocol Number

The layer 4 protocol number such as 17 for UDP and 6 for TCP.

DNS Remote Endpoint IP

The remote IP of the connection.

DNS Remote Endpoint Port

The port number of the connection.

DNS Local Endpoint IP

The local IP of the connection.

DNS Local Endpoint Port

The port number of the connection.

DNS Payload

The payload of DNS packets that contains DNS queries and responses.

Filepath

Path of the file that is opened in this event.

Flags

Describes the file access mode, such as read-only, write-only, and read-write.

Module Name

Name of the module loaded into the kernel.

Address Range

The address range for which the access protections were modified.

Memory Regions

Specifies the Region of a process's address space such as stack and heap.

Flags

Represents options that control the behavior of this event.

Mount Target

The path where the mount source is mounted.

Mount Source

The path on the host that is mounted at the mount target.

Filesystem Type

Represents the type of mounted fileSystem.

Flags

Represents options that control the behavior of this event.

Link Path

Path where the hard link gets created.

Target Path

Path of the file at which the hard link points.

Link Path

Path where the symbolic link is created.

Target Path

Path of the file at which the symbolic link points.

Old File Descriptor

A file descriptor that represents an open file object.

New File Descriptor

A new file descriptor that is a duplicate of the old file descriptor. Both the old and new file descriptors represent the same open file object.

Dup Remote Endpoint IP

The remote IP address of the network socket represented by the old file descriptor. Only applicable when the old file descriptor represents a network socket.

Dup Remote Endpoint Port

The remote port of the network socket represented by the old file descriptor. Only applicable when the old file descriptor represents a network socket.

Dup Local Endpoint IP

The local IP address of the network socket represented by the old file descriptor. Only applicable when the old file descriptor represents a network socket.

Dup Local Endpoint Port

The local port of the network socket represented by the old file descriptor. Only applicable when the old file descriptor represents a network socket.

Filepath

Path of the file to which the memory is mapped.

Address family

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP version of 4 protocol.

Socket Type

Type of socket to indicate communication semantics. For example, SOCK_RAW.

Protocol number

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

Address family

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP v4 protocol.

Socket Type

Type of socket to indicate communication semantics. For example, SOCK_RAW.

Protocol Number

Specifies a particular protocol within the address family. Usually there is a single protocol in address families. For example, the address family AF_INET only has the IP protocol.

Filepath

Path of the socket file if the address family is AF_UNIX.

Remote Endpoint IP

The remote IP of the connection.

Remote Endpoint Port

The port number of the connection.

Local Endpoint IP

The local IP of the connection.

Local Endpoint Port

The port number of the connection.

Flags

Represents options that control the behavior of this event.

Target PID

Process ID of the process from which memory is being read.

Target Process UUID

The unique ID of the target process.

Target Executable Path

The absolute path of the target process executable file.

Flags

Represents options that control the behavior of this event.

Target PID

Process ID of the process to which memory is being written.

Target Process UUID

The unique ID of the target process.

Target Executable Path

The absolute path of the target process executable file.

Target PID

Process ID of the target process.

Target Process UUID

The unique ID of the target process.

Target Executable Path

The absolute path of the target process executable file.

Flags

Represents options that control the behavior of this event.

Address Family

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP v4 protocol.

Socket type

Type of socket to indicate communication semantics. For example, SOCK_RAW.

Protocol number

The layer 4 protocol number such as 17 for UDP and 6 for TCP.

Local endpoint IP

The local IP of the connection.

Local endpoint port

The port number of the connection.

Address Family

Represents the communication protocol associated with the address. For example, the address family AF_INET is used for IP v4 protocol.

Socket type

Type of socket to indicate communication semantics. For example, SOCK_RAW.

Protocol number

The layer 4 protocol number such as 17 for UDP and 6 for TCP.

Local endpoint IP

The local IP of the connection.

Local endpoint port

The port number of the connection.

Filepath

Path where the file that is renamed.

Target

The new path of the file.

New EUID

The new effective user ID of the process.

New UID

The new user ID of the process.

Filepath

Path of the file that invokes this event.

Filemode

The updated access permissions for the associated file.