misp-objects/objects/process/definition.json

{
  "name": "process",
  "uuid": "02aeef94-ac23-455c-addb-731757ceafb5",
  "meta-category": "misc",
  "description": "Object describing a system process.",
  "version": 6,
  "attributes": {
    "creation-time": {
      "description": "Local date/time at which the process was created.",
      "ui-priority": 0,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "start-time": {
      "description": "Local date/time at which the process was started.",
      "ui-priority": 0,
      "misp-attribute": "datetime",
      "disable_correlation": true
    },
    "name": {
      "description": "Name of the process",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "pid": {
      "description": "Process ID of the process.",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "parent-pid": {
      "description": "Process ID of the parent process.",
      "ui-priority": 1,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "child-pid": {
      "description": "Process ID of the child(ren) process.",
      "ui-priority": 1,
      "misp-attribute": "text",
      "multiple": true,
      "disable_correlation": true
    },
    "process-state": {
      "description": "State of process.",
      "sane_default": [
        "D uninterruptible sleep (usually IO)",
        "R running or runnable (on run queue)",
        "S interruptible sleep (waiting for an event to complete)",
        "T stopped by job control signal",
        "t stopped by debugger during the tracing",
        "W paging (not valid since the 2.6.xx kernel)",
        "X dead (should never be seen)",
        "Z defunct ('zombie') process, terminated but not reaped by its parent",
        "< high-priority (not nice to other users)",
        "N low-priority (nice to other users)",
        "L has pages locked into memory (for real-time and custom IO)",
        "s is a session leader",
        "l is multi-threaded (using CLONE_THREAD, like NPTL pthreads do)",
        "+ is in the foreground process group"
      ],
      "ui-priority": 1,
      "misp-attribute": "text",
      "multiple": false,
      "disable_correlation": true
    },
    "fake-process-name": {
      "description": "Is the process spawned under a false name.",
      "sane_default": [
        "1",
        "0"
      ],
      "ui-priority": 1,
      "misp-attribute": "boolean",
      "multiple": false,
      "disable_correlation": true
    },
    "port": {
      "description": "Port(s) owned by the process.",
      "ui-priority": 1,
      "misp-attribute": "src-port",
      "multiple": true,
      "disable_correlation": true
    },
    "command-line": {
      "description": "Command line of the process",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "current-directory": {
      "description": "Current working directory of the process",
      "ui-priority": 2,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "image": {
      "description": "Path of process image",
      "ui-priority": 1,
      "misp-attribute": "filename"
    },
    "parent-command-line": {
      "description": "Command line of the parent process",
      "ui-priority": 1,
      "misp-attribute": "text"
    },
    "parent-image": {
      "description": "Path of parent process image",
      "ui-priority": 1,
      "misp-attribute": "filename"
    },
    "user": {
      "description": "User context of the process",
      "ui-priority": 2,
      "misp-attribute": "text",
      "disable_correlation": true
    },
    "integrity-level": {
      "description": "Integrity level of the process",
      "ui-priority": 2,
      "misp-attribute": "text",
      "disable_correlation": true
    }
  },
  "requiredOneOf": [
    "name",
    "pid",
    "image",
    "command-line",
    "current-directory"
  ]
}