Causality Actor

Description

The Causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR agent identified as being responsible for initiating the process tree.

Actor Fields

This actor uses:
causality_actor
. It has the following fields:
Field Name
(Datatype)
Description
causality_​actor_​primary_​user_​sid
(STRING)
None Available
causality_​actor_​primary_​username
(STRING)
None Available
causality_​actor_​process_​auth_​id
(STRING)
None Available
causality_​actor_​process_​command_​line
(STRING)
None Available
causality_​actor_​process_​device_​info
(record)
Info about the device (volume + HW) from which this process started - these fields represent HW info and will be populated only for USB devices
causality_​actor_​process_​file_​create_​time
(INTEGER)
None Available
causality_​actor_​process_​file_​mod_​time
(INTEGER)
None Available
causality_​actor_​process_​file_​size
(INTEGER)
None Available
causality_​actor_​process_​image_​extension
(STRING)
None Available
causality_​actor_​process_​image_​md5
(STRING)
None Available
causality_​actor_​process_​image_​name
(STRING)
None Available
causality_​actor_​process_​image_​path
(STRING)
None Available
causality_​actor_​process_​image_​sha256
(STRING)
None Available
causality_​actor_​process_​logon_​id
(STRING)
None Available
causality_​actor_​process_​os_​pid
(INTEGER)
None Available
causality_​actor_​process_​session_​id
(INTEGER)
None Available
causality_​actor_​process_​signature_​is_​embedded
(BOOLEAN)
None Available
causality_​actor_​process_​signature_​product
(STRING)
None Available
causality_​actor_​process_​signature_​vendor
(STRING)
None Available
causality_​actor_​remote_​host
(STRING)
None Available
causality_​actor_​remote_​ip
(STRING)
None Available
causality_​actor_​remote_​pipe_​name
(STRING)
None Available
causality_​actor_​remote_​port
(INTEGER)
None Available

Recommended For You