Guardduty  >  Structures  >  ProcessDetails

ProcessDetails

Structure Class

ProcessDetails dataclass

Information about the observed process.

Attributes

euid class-attribute instance-attribute

euid: int | None = None

The effective user ID of the user that executed the process.

executable_path class-attribute instance-attribute

executable_path: str | None = None

The absolute path of the process executable file.

executable_sha256 class-attribute instance-attribute

executable_sha256: str | None = None

The SHA256 hash of the process executable.

lineage class-attribute instance-attribute

lineage: list[LineageObject] | None = None

Information about the process's lineage.

name class-attribute instance-attribute

name: str | None = None

The name of the process.

namespace_pid class-attribute instance-attribute

namespace_pid: int | None = None

The ID of the child process.

parent_uuid class-attribute instance-attribute

parent_uuid: str | None = None

The unique ID of the parent process. This ID is assigned to the parent process by GuardDuty.

pid class-attribute instance-attribute

pid: int | None = None

The ID of the process.

pwd class-attribute instance-attribute

pwd: str | None = None

The present working directory of the process.

start_time class-attribute instance-attribute

start_time: datetime | None = None

The time when the process started. This is in UTC format.

user class-attribute instance-attribute

user: str | None = None

The user that executed the process.

user_id class-attribute instance-attribute

user_id: int | None = None

The unique ID of the user that executed the process.

uuid class-attribute instance-attribute

uuid: str | None = None

The unique ID assigned to the process by GuardDuty.