Process Context
When available, process information is included with tampering events:
| Field | UI Label | Description |
|---|
| process.pid | Process ID | The process identifier |
| process.imagePath | Process image path | The full path to the process executable |
| process.cliArgs | Process Command-Line arguments | The command-line arguments used to launch the process |
| process.parentProcess.imagePath | Parent process path | The parent process executable path |
Certificate Context
For network and infrastructure tampering events involving certificates:
| Field | UI Label | Description |
|---|
| certificate.issuer | Certificate issuer | The certificate issuer name |
| certificate.subject | Certificate subject | The certificate subject name |
| certificate.serialNumber | Serial number | The certificate serial number |
| certificate.createdTime | Created | Certificate creation timestamp |
| certificate.expirationTime | Expiration | Certificate expiration timestamp |
| certificate.fingerprints[].value | Fingerprint | Certificate fingerprint hash value |
| certificate.fingerprints[].algorithm | Algorithm | Hash algorithm used (MD5, SHA-1, SHA-256, SHA-512) |
RCE Exploit Context
The rceExploitAttempt event is generated when the browser detects an attempted remote code execution exploit (e.g., via WebAssembly-based attacks):
| Field | UI Label | Description |
|---|
| rceExploit.sensor | Detection Sensor | The sensor that detected the exploit (e.g., WASM_GUARD) |
| rceExploit.url | Exploited URL | The URL where the exploit was attempted |
