Guardduty  >  Structures  >  LineageObject

LineageObject

Structure Class

LineageObject dataclass

Information about the runtime process details.

Attributes

euid class-attribute instance-attribute

euid: int | None = None

The effective user ID that was used to execute the process.

executable_path class-attribute instance-attribute

executable_path: str | None = None

The absolute path of the process executable file.

name class-attribute instance-attribute

name: str | None = None

The name of the process.

namespace_pid class-attribute instance-attribute

namespace_pid: int | None = None

The process ID of the child process.

parent_uuid class-attribute instance-attribute

parent_uuid: str | None = None

The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.

pid class-attribute instance-attribute

pid: int | None = None

The ID of the process.

start_time class-attribute instance-attribute

start_time: datetime | None = None

The time when the process started. This is in UTC format.

user_id class-attribute instance-attribute

user_id: int | None = None

The user ID of the user that executed the process.

uuid class-attribute instance-attribute

uuid: str | None = None

The unique ID assigned to the process by GuardDuty.