Skip to content

Latest commit

 

History

History
78 lines (63 loc) · 2.68 KB

process.md

File metadata and controls

78 lines (63 loc) · 2.68 KB
Raw
title description ms.localizationpriority doc_type ms.subservice author
process resource type
Contains stateful information about the process related to the alert.
medium
resourcePageType
security
preetikr

process resource type

Namespace: microsoft.graph

[!INCLUDE beta-disclaimer]

Contains stateful information about the process related to the alert.

Properties

Property Type Description
accountName String User account identifier (user account context the process ran under) for example, AccountName, SID, and so on.
commandLine String The full process invocation commandline including all parameters.
createdDateTime DateTimeOffset Time at which the process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
fileHash fileHash Complex type containing file hashes (cryptographic and location-sensitive).
integrityLevel processIntegrityLevel The integrity level of the process. Possible values are: unknown, untrusted, low, medium, high, system.
isElevated Boolean True if the process is elevated.
name String The name of the process' Image file.
parentProcessCreatedDateTime DateTimeOffset DateTime at which the parent process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
parentProcessId Int32 The Process ID (PID) of the parent process.
parentProcessName String The name of the image file of the parent process.
path String Full path, including filename.
processId Int32 The Process ID (PID) of the process.

JSON representation

The following is a JSON representation of the resource.

{
  "accountName": "String",
  "commandLine": "String",
  "createdDateTime": "String (timestamp)",
  "fileHash": {"@odata.type": "microsoft.graph.fileHash"},
  "integrityLevel": "@odata.type: microsoft.graph.processIntegrityLevel",
  "isElevated": true,
  "name": "String",
  "parentProcessCreatedDateTime": "String (timestamp)",
  "parentProcessId": 1024,
  "parentProcessName": "String",
  "path": "String",
  "processId": 1024
}