Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add entity_id for process and process.parent #747

Merged
merged 2 commits into from
Feb 18, 2020
Merged

Add entity_id for process and process.parent #747

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6682c63
Add entity_id
andrewstucki Feb 13, 2020
6262983
Flesh out description a bit more and add Changelog entry
andrewstucki Feb 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ Thanks, you're awesome :-) -->
#### Added
* Added `dll.*` fields (#679)
* Fieldset for PE metadata. #731
* Globally unique identifier `entity_id` for `process` and `process.parent`. (#747)

#### Improvements

Expand Down
20 changes: 20 additions & 0 deletions code/go/ecs/process.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

34 changes: 34 additions & 0 deletions docs/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3755,6 +3755,23 @@ example: `/usr/bin/ssh -l user 10.0.0.16`

// ===============================================================

| process.entity_id
| Unique identifier for the process.

The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.

Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

type: keyword



example: `c2c455d9f99375d`

| extended

// ===============================================================

| process.executable
| Absolute path to the process executable.

Expand Down Expand Up @@ -3864,6 +3881,23 @@ example: `/usr/bin/ssh -l user 10.0.0.16`

// ===============================================================

| process.parent.entity_id
| Unique identifier for the process.

The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.

Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.

type: keyword



example: `c2c455d9f99375d`

| extended

// ===============================================================

| process.parent.executable
| Absolute path to the process executable.

Expand Down
30 changes: 30 additions & 0 deletions generated/beats/fields.ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2563,6 +2563,21 @@
Some arguments may be filtered to protect sensitive information.'
example: /usr/bin/ssh -l user 10.0.0.16
default_field: false
- name: entity_id
level: extended
type: keyword
ignore_above: 1024
description: 'Unique identifier for the process.

The implementation of this is specified by the data source, but some examples
of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
or a hash of some uniquely identifying components of a process.

Constructing a globally unique identifier is a common practice to mitigate
PID reuse as well as to identify a specific process over time, across multiple
monitored hosts.'
example: c2c455d9f99375d
default_field: false
- name: executable
level: extended
type: keyword
Expand Down Expand Up @@ -2653,6 +2668,21 @@
Some arguments may be filtered to protect sensitive information.'
example: /usr/bin/ssh -l user 10.0.0.16
default_field: false
- name: parent.entity_id
level: extended
type: keyword
ignore_above: 1024
description: 'Unique identifier for the process.

The implementation of this is specified by the data source, but some examples
of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
or a hash of some uniquely identifying components of a process.

Constructing a globally unique identifier is a common practice to mitigate
PID reuse as well as to identify a specific process over time, across multiple
monitored hosts.'
example: c2c455d9f99375d
default_field: false
- name: parent.executable
level: extended
type: keyword
Expand Down
2 changes: 2 additions & 0 deletions generated/csv/fields.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,6 +323,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
1.5.0-dev,true,process,process.args_count,long,extended,,4,Length of the process.args array.
1.5.0-dev,true,process,process.command_line,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
1.5.0-dev,true,process,process.command_line.text,text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
1.5.0-dev,true,process,process.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
1.5.0-dev,true,process,process.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
1.5.0-dev,true,process,process.executable.text,text,extended,,/usr/bin/ssh,Absolute path to the process executable.
1.5.0-dev,true,process,process.exit_code,long,extended,,137,The exit code of the process.
Expand All @@ -336,6 +337,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
1.5.0-dev,true,process,process.parent.args_count,long,extended,,4,Length of the process.args array.
1.5.0-dev,true,process,process.parent.command_line,keyword,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
1.5.0-dev,true,process,process.parent.command_line.text,text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
1.5.0-dev,true,process,process.parent.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
1.5.0-dev,true,process,process.parent.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
1.5.0-dev,true,process,process.parent.executable.text,text,extended,,/usr/bin/ssh,Absolute path to the process executable.
1.5.0-dev,true,process,process.parent.exit_code,long,extended,,137,The exit code of the process.
Expand Down