schemas/v1/alerts/linux_event_model_event.yaml [1420:2627]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
process.name:
  dashed_name: process-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  short: Process name.
  type: keyword
process.parent.args:
  dashed_name: process-parent-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.parent.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.parent.args_count:
  dashed_name: process-parent-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.parent.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.parent.command_line:
  dashed_name: process-parent-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.parent.command_line
  level: extended
  multi_fields:
  - flat_name: process.parent.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  original_fieldset: process
  short: Full command line that started the process.
  type: wildcard
process.parent.entity_id:
  dashed_name: process-parent-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.parent.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.parent.executable:
  dashed_name: process-parent-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.parent.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.parent.group.id:
  dashed_name: process-parent-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.group.name:
  dashed_name: process-parent-group-name
  description: Name of the group.
  flat_name: process.parent.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.group_leader.entity_id:
  dashed_name: process-parent-group-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.parent.group_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.parent.group_leader.pid:
  dashed_name: process-parent-group-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.parent.group_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.parent.group_leader.start:
  dashed_name: process-parent-group-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.parent.group_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.parent.interactive:
  dashed_name: process-parent-interactive
  description: 'Whether the process is connected to an interactive shell.

    Process interactivity is inferred from the processes file descriptors. If the
    character device for the controlling tty is the same as stdin and stderr for the
    process, the process is considered interactive.

    Note: A non-interactive process can belong to an interactive session and is simply
    one that does not have open file descriptors reading the controlling TTY on FD
    0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process
    is still considered interactive if stdin and stderr are connected to the controlling
    TTY.'
  example: true
  flat_name: process.parent.interactive
  level: extended
  name: interactive
  normalize: []
  original_fieldset: process
  short: Whether the process is connected to an interactive shell.
  type: boolean
process.parent.name:
  dashed_name: process-parent-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.parent.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: process
  short: Process name.
  type: keyword
process.parent.pid:
  dashed_name: process-parent-pid
  description: Process id.
  example: 4242
  flat_name: process.parent.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.parent.real_group.id:
  dashed_name: process-parent-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.real_group.name:
  dashed_name: process-parent-real-group-name
  description: Name of the group.
  flat_name: process.parent.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.real_user.id:
  dashed_name: process-parent-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.real_user.name:
  dashed_name: process-parent-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.saved_group.id:
  dashed_name: process-parent-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.saved_group.name:
  dashed_name: process-parent-saved-group-name
  description: Name of the group.
  flat_name: process.parent.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.saved_user.id:
  dashed_name: process-parent-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.saved_user.name:
  dashed_name: process-parent-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.start:
  dashed_name: process-parent-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.parent.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.parent.supplemental_groups.id:
  dashed_name: process-parent-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.supplemental_groups.name:
  dashed_name: process-parent-supplemental-groups-name
  description: Name of the group.
  flat_name: process.parent.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.tty:
  dashed_name: process-parent-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.parent.tty
  level: extended
  name: tty
  normalize: []
  original_fieldset: process
  short: Information about the controlling TTY device.
  type: object
process.parent.tty.char_device.major:
  dashed_name: process-parent-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.parent.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  original_fieldset: process
  short: The TTY character device's major number.
  type: long
process.parent.tty.char_device.minor:
  dashed_name: process-parent-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.parent.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
  original_fieldset: process
  short: The TTY character device's minor number.
  type: long
process.parent.user.id:
  dashed_name: process-parent-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.user.name:
  dashed_name: process-parent-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.working_directory:
  dashed_name: process-parent-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.parent.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  original_fieldset: process
  short: The working directory of the process.
  type: keyword
process.pid:
  dashed_name: process-pid
  description: Process id.
  example: 4242
  flat_name: process.pid
  format: string
  level: core
  name: pid
  normalize: []
  short: Process id.
  type: long
process.previous.args:
  dashed_name: process-previous-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.previous.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.previous.args_count:
  dashed_name: process-previous-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.previous.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.previous.executable:
  dashed_name: process-previous-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.previous.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.previous.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.previous.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.real_group.id:
  dashed_name: process-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.real_group.name:
  dashed_name: process-real-group-name
  description: Name of the group.
  flat_name: process.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.real_user.id:
  dashed_name: process-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.real_user.name:
  dashed_name: process-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.saved_group.id:
  dashed_name: process-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.saved_group.name:
  dashed_name: process-saved-group-name
  description: Name of the group.
  flat_name: process.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.saved_user.id:
  dashed_name: process-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.saved_user.name:
  dashed_name: process-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.args:
  dashed_name: process-session-leader-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.session_leader.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.session_leader.args_count:
  dashed_name: process-session-leader-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.session_leader.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.session_leader.command_line:
  dashed_name: process-session-leader-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.session_leader.command_line
  level: extended
  multi_fields:
  - flat_name: process.session_leader.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  original_fieldset: process
  short: Full command line that started the process.
  type: wildcard
process.session_leader.entity_id:
  dashed_name: process-session-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.executable:
  dashed_name: process-session-leader-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.session_leader.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.session_leader.group.id:
  dashed_name: process-session-leader-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.group.name:
  dashed_name: process-session-leader-group-name
  description: Name of the group.
  flat_name: process.session_leader.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.interactive:
  dashed_name: process-session-leader-interactive
  description: 'Whether the process is connected to an interactive shell.

    Process interactivity is inferred from the processes file descriptors. If the
    character device for the controlling tty is the same as stdin and stderr for the
    process, the process is considered interactive.

    Note: A non-interactive process can belong to an interactive session and is simply
    one that does not have open file descriptors reading the controlling TTY on FD
    0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process
    is still considered interactive if stdin and stderr are connected to the controlling
    TTY.'
  example: true
  flat_name: process.session_leader.interactive
  level: extended
  name: interactive
  normalize: []
  original_fieldset: process
  short: Whether the process is connected to an interactive shell.
  type: boolean
process.session_leader.name:
  dashed_name: process-session-leader-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.session_leader.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: process
  short: Process name.
  type: keyword
process.session_leader.parent.entity_id:
  dashed_name: process-session-leader-parent-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.parent.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.parent.pid:
  dashed_name: process-session-leader-parent-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.parent.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.parent.session_leader.entity_id:
  dashed_name: process-session-leader-parent-session-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.parent.session_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.parent.session_leader.pid:
  dashed_name: process-session-leader-parent-session-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.parent.session_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.parent.session_leader.start:
  dashed_name: process-session-leader-parent-session-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.parent.session_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.parent.start:
  dashed_name: process-session-leader-parent-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.parent.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.pid:
  dashed_name: process-session-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.real_group.id:
  dashed_name: process-session-leader-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.real_group.name:
  dashed_name: process-session-leader-real-group-name
  description: Name of the group.
  flat_name: process.session_leader.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.real_user.id:
  dashed_name: process-session-leader-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.real_user.name:
  dashed_name: process-session-leader-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.same_as_process:
  dashed_name: process-session-leader-same-as-process
  description: 'This boolean is used to identify if a leader process is the same as
    the top level process.

    For example, if `process.group_leader.same_as_process = true`, it means the process
    event in question is the leader of its process group. Details under `process.*`
    like `pid` would be the same under `process.group_leader.*` The same applies for
    both `process.session_leader` and `process.entry_leader`.

    This field exists to the benefit of EQL and other rule engines since it''s not
    possible to compare equality between two fields in a single document. e.g `process.entity_id`
    = `process.group_leader.entity_id` (top level process is the process group leader)
    OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is
    the entry session leader)

    Instead these rules could be written like: `process.group_leader.same_as_process:
    true` OR `process.entry_leader.same_as_process: true`

    Note: This field is only set on `process.entry_leader`, `process.session_leader`
    and `process.group_leader`.'
  example: true
  flat_name: process.session_leader.same_as_process
  level: extended
  name: same_as_process
  normalize: []
  original_fieldset: process
  short: This boolean is used to identify if a leader process is the same as the top
    level process.
  type: boolean
process.session_leader.saved_group.id:
  dashed_name: process-session-leader-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.saved_group.name:
  dashed_name: process-session-leader-saved-group-name
  description: Name of the group.
  flat_name: process.session_leader.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.saved_user.id:
  dashed_name: process-session-leader-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.saved_user.name:
  dashed_name: process-session-leader-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.start:
  dashed_name: process-session-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.supplemental_groups.id:
  dashed_name: process-session-leader-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.supplemental_groups.name:
  dashed_name: process-session-leader-supplemental-groups-name
  description: Name of the group.
  flat_name: process.session_leader.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.tty:
  dashed_name: process-session-leader-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.session_leader.tty
  level: extended
  name: tty
  normalize: []
  original_fieldset: process
  short: Information about the controlling TTY device.
  type: object
process.session_leader.tty.char_device.major:
  dashed_name: process-session-leader-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.session_leader.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  original_fieldset: process
  short: The TTY character device's major number.
  type: long
process.session_leader.tty.char_device.minor:
  dashed_name: process-session-leader-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.session_leader.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
  original_fieldset: process
  short: The TTY character device's minor number.
  type: long
process.session_leader.user.id:
  dashed_name: process-session-leader-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.user.name:
  dashed_name: process-session-leader-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.working_directory:
  dashed_name: process-session-leader-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.session_leader.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  original_fieldset: process
  short: The working directory of the process.
  type: keyword
process.start:
  dashed_name: process-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.start
  level: extended
  name: start
  normalize: []
  short: The time the process started.
  type: date
process.supplemental_groups.id:
  dashed_name: process-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.supplemental_groups.name:
  dashed_name: process-supplemental-groups-name
  description: Name of the group.
  flat_name: process.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.tty:
  dashed_name: process-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.tty
  level: extended
  name: tty
  normalize: []
  short: Information about the controlling TTY device.
  type: object
process.tty.char_device.major:
  dashed_name: process-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  short: The TTY character device's major number.
  type: long
process.tty.char_device.minor:
  dashed_name: process-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



schemas/v1/process/linux_event_model_event.yaml [1571:2778]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
process.name:
  dashed_name: process-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  short: Process name.
  type: keyword
process.parent.args:
  dashed_name: process-parent-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.parent.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.parent.args_count:
  dashed_name: process-parent-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.parent.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.parent.command_line:
  dashed_name: process-parent-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.parent.command_line
  level: extended
  multi_fields:
  - flat_name: process.parent.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  original_fieldset: process
  short: Full command line that started the process.
  type: wildcard
process.parent.entity_id:
  dashed_name: process-parent-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.parent.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.parent.executable:
  dashed_name: process-parent-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.parent.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.parent.group.id:
  dashed_name: process-parent-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.group.name:
  dashed_name: process-parent-group-name
  description: Name of the group.
  flat_name: process.parent.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.group_leader.entity_id:
  dashed_name: process-parent-group-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.parent.group_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.parent.group_leader.pid:
  dashed_name: process-parent-group-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.parent.group_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.parent.group_leader.start:
  dashed_name: process-parent-group-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.parent.group_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.parent.interactive:
  dashed_name: process-parent-interactive
  description: 'Whether the process is connected to an interactive shell.

    Process interactivity is inferred from the processes file descriptors. If the
    character device for the controlling tty is the same as stdin and stderr for the
    process, the process is considered interactive.

    Note: A non-interactive process can belong to an interactive session and is simply
    one that does not have open file descriptors reading the controlling TTY on FD
    0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process
    is still considered interactive if stdin and stderr are connected to the controlling
    TTY.'
  example: true
  flat_name: process.parent.interactive
  level: extended
  name: interactive
  normalize: []
  original_fieldset: process
  short: Whether the process is connected to an interactive shell.
  type: boolean
process.parent.name:
  dashed_name: process-parent-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.parent.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: process
  short: Process name.
  type: keyword
process.parent.pid:
  dashed_name: process-parent-pid
  description: Process id.
  example: 4242
  flat_name: process.parent.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.parent.real_group.id:
  dashed_name: process-parent-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.real_group.name:
  dashed_name: process-parent-real-group-name
  description: Name of the group.
  flat_name: process.parent.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.real_user.id:
  dashed_name: process-parent-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.real_user.name:
  dashed_name: process-parent-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.saved_group.id:
  dashed_name: process-parent-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.saved_group.name:
  dashed_name: process-parent-saved-group-name
  description: Name of the group.
  flat_name: process.parent.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.saved_user.id:
  dashed_name: process-parent-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.saved_user.name:
  dashed_name: process-parent-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.start:
  dashed_name: process-parent-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.parent.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.parent.supplemental_groups.id:
  dashed_name: process-parent-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.parent.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.parent.supplemental_groups.name:
  dashed_name: process-parent-supplemental-groups-name
  description: Name of the group.
  flat_name: process.parent.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.parent.tty:
  dashed_name: process-parent-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.parent.tty
  level: extended
  name: tty
  normalize: []
  original_fieldset: process
  short: Information about the controlling TTY device.
  type: object
process.parent.tty.char_device.major:
  dashed_name: process-parent-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.parent.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  original_fieldset: process
  short: The TTY character device's major number.
  type: long
process.parent.tty.char_device.minor:
  dashed_name: process-parent-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.parent.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
  original_fieldset: process
  short: The TTY character device's minor number.
  type: long
process.parent.user.id:
  dashed_name: process-parent-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.parent.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.parent.user.name:
  dashed_name: process-parent-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.parent.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.parent.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.parent.working_directory:
  dashed_name: process-parent-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.parent.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.parent.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.parent.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  original_fieldset: process
  short: The working directory of the process.
  type: keyword
process.pid:
  dashed_name: process-pid
  description: Process id.
  example: 4242
  flat_name: process.pid
  format: string
  level: core
  name: pid
  normalize: []
  short: Process id.
  type: long
process.previous.args:
  dashed_name: process-previous-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.previous.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.previous.args_count:
  dashed_name: process-previous-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.previous.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.previous.executable:
  dashed_name: process-previous-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.previous.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.previous.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.previous.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.real_group.id:
  dashed_name: process-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.real_group.name:
  dashed_name: process-real-group-name
  description: Name of the group.
  flat_name: process.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.real_user.id:
  dashed_name: process-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.real_user.name:
  dashed_name: process-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.saved_group.id:
  dashed_name: process-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.saved_group.name:
  dashed_name: process-saved-group-name
  description: Name of the group.
  flat_name: process.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.saved_user.id:
  dashed_name: process-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.saved_user.name:
  dashed_name: process-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.args:
  dashed_name: process-session-leader-args
  description: 'Array of process arguments, starting with the absolute path to the
    executable.

    May be filtered to protect sensitive information.'
  example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]'
  flat_name: process.session_leader.args
  ignore_above: 1024
  level: extended
  name: args
  normalize:
  - array
  original_fieldset: process
  short: Array of process arguments.
  type: keyword
process.session_leader.args_count:
  dashed_name: process-session-leader-args-count
  description: 'Length of the process.args array.

    This field can be useful for querying or performing bucket analysis on how many
    arguments were provided to start a process. More arguments may be an indication
    of suspicious activity.'
  example: 4
  flat_name: process.session_leader.args_count
  level: extended
  name: args_count
  normalize: []
  original_fieldset: process
  short: Length of the process.args array.
  type: long
process.session_leader.command_line:
  dashed_name: process-session-leader-command-line
  description: 'Full command line that started the process, including the absolute
    path to the executable, and all arguments.

    Some arguments may be filtered to protect sensitive information.'
  example: /usr/bin/ssh -l user 10.0.0.16
  flat_name: process.session_leader.command_line
  level: extended
  multi_fields:
  - flat_name: process.session_leader.command_line.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.command_line.text
    name: text
    norms: false
    type: text
  name: command_line
  normalize: []
  original_fieldset: process
  short: Full command line that started the process.
  type: wildcard
process.session_leader.entity_id:
  dashed_name: process-session-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.executable:
  dashed_name: process-session-leader-executable
  description: Absolute path to the process executable.
  example: /usr/bin/ssh
  flat_name: process.session_leader.executable
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.executable.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.executable.text
    name: text
    norms: false
    type: text
  name: executable
  normalize: []
  original_fieldset: process
  short: Absolute path to the process executable.
  type: keyword
process.session_leader.group.id:
  dashed_name: process-session-leader-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.group.name:
  dashed_name: process-session-leader-group-name
  description: Name of the group.
  flat_name: process.session_leader.group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.interactive:
  dashed_name: process-session-leader-interactive
  description: 'Whether the process is connected to an interactive shell.

    Process interactivity is inferred from the processes file descriptors. If the
    character device for the controlling tty is the same as stdin and stderr for the
    process, the process is considered interactive.

    Note: A non-interactive process can belong to an interactive session and is simply
    one that does not have open file descriptors reading the controlling TTY on FD
    0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process
    is still considered interactive if stdin and stderr are connected to the controlling
    TTY.'
  example: true
  flat_name: process.session_leader.interactive
  level: extended
  name: interactive
  normalize: []
  original_fieldset: process
  short: Whether the process is connected to an interactive shell.
  type: boolean
process.session_leader.name:
  dashed_name: process-session-leader-name
  description: 'Process name.

    Sometimes called program name or similar.'
  example: ssh
  flat_name: process.session_leader.name
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.name.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.name.text
    name: text
    norms: false
    type: text
  name: name
  normalize: []
  original_fieldset: process
  short: Process name.
  type: keyword
process.session_leader.parent.entity_id:
  dashed_name: process-session-leader-parent-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.parent.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.parent.pid:
  dashed_name: process-session-leader-parent-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.parent.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.parent.session_leader.entity_id:
  dashed_name: process-session-leader-parent-session-leader-entity-id
  description: 'Unique identifier for the process.

    The implementation of this is specified by the data source, but some examples
    of what could be used here are a process-generated UUID, Sysmon Process GUIDs,
    or a hash of some uniquely identifying components of a process.

    Constructing a globally unique identifier is a common practice to mitigate PID
    reuse as well as to identify a specific process over time, across multiple monitored
    hosts.'
  example: c2c455d9f99375d
  flat_name: process.session_leader.parent.session_leader.entity_id
  ignore_above: 1024
  level: extended
  name: entity_id
  normalize: []
  original_fieldset: process
  short: Unique identifier for the process.
  type: keyword
process.session_leader.parent.session_leader.pid:
  dashed_name: process-session-leader-parent-session-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.parent.session_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.parent.session_leader.start:
  dashed_name: process-session-leader-parent-session-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.parent.session_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.parent.start:
  dashed_name: process-session-leader-parent-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.parent.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.pid:
  dashed_name: process-session-leader-pid
  description: Process id.
  example: 4242
  flat_name: process.session_leader.pid
  format: string
  level: core
  name: pid
  normalize: []
  original_fieldset: process
  short: Process id.
  type: long
process.session_leader.real_group.id:
  dashed_name: process-session-leader-real-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.real_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.real_group.name:
  dashed_name: process-session-leader-real-group-name
  description: Name of the group.
  flat_name: process.session_leader.real_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.real_user.id:
  dashed_name: process-session-leader-real-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.real_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.real_user.name:
  dashed_name: process-session-leader-real-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.real_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.real_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.same_as_process:
  dashed_name: process-session-leader-same-as-process
  description: 'This boolean is used to identify if a leader process is the same as
    the top level process.

    For example, if `process.group_leader.same_as_process = true`, it means the process
    event in question is the leader of its process group. Details under `process.*`
    like `pid` would be the same under `process.group_leader.*` The same applies for
    both `process.session_leader` and `process.entry_leader`.

    This field exists to the benefit of EQL and other rule engines since it''s not
    possible to compare equality between two fields in a single document. e.g `process.entity_id`
    = `process.group_leader.entity_id` (top level process is the process group leader)
    OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is
    the entry session leader)

    Instead these rules could be written like: `process.group_leader.same_as_process:
    true` OR `process.entry_leader.same_as_process: true`

    Note: This field is only set on `process.entry_leader`, `process.session_leader`
    and `process.group_leader`.'
  example: true
  flat_name: process.session_leader.same_as_process
  level: extended
  name: same_as_process
  normalize: []
  original_fieldset: process
  short: This boolean is used to identify if a leader process is the same as the top
    level process.
  type: boolean
process.session_leader.saved_group.id:
  dashed_name: process-session-leader-saved-group-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.saved_group.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.saved_group.name:
  dashed_name: process-session-leader-saved-group-name
  description: Name of the group.
  flat_name: process.session_leader.saved_group.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.saved_user.id:
  dashed_name: process-session-leader-saved-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.saved_user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.saved_user.name:
  dashed_name: process-session-leader-saved-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.saved_user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.saved_user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.start:
  dashed_name: process-session-leader-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.session_leader.start
  level: extended
  name: start
  normalize: []
  original_fieldset: process
  short: The time the process started.
  type: date
process.session_leader.supplemental_groups.id:
  dashed_name: process-session-leader-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.session_leader.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.session_leader.supplemental_groups.name:
  dashed_name: process-session-leader-supplemental-groups-name
  description: Name of the group.
  flat_name: process.session_leader.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.session_leader.tty:
  dashed_name: process-session-leader-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.session_leader.tty
  level: extended
  name: tty
  normalize: []
  original_fieldset: process
  short: Information about the controlling TTY device.
  type: object
process.session_leader.tty.char_device.major:
  dashed_name: process-session-leader-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.session_leader.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  original_fieldset: process
  short: The TTY character device's major number.
  type: long
process.session_leader.tty.char_device.minor:
  dashed_name: process-session-leader-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.session_leader.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
  original_fieldset: process
  short: The TTY character device's minor number.
  type: long
process.session_leader.user.id:
  dashed_name: process-session-leader-user-id
  description: Unique identifier of the user.
  example: S-1-5-21-202424912787-2692429404-2351956786-1000
  flat_name: process.session_leader.user.id
  ignore_above: 1024
  level: core
  name: id
  normalize: []
  original_fieldset: user
  short: Unique identifier of the user.
  type: keyword
process.session_leader.user.name:
  dashed_name: process-session-leader-user-name
  description: Short name or login of the user.
  example: a.einstein
  flat_name: process.session_leader.user.name
  ignore_above: 1024
  level: core
  multi_fields:
  - flat_name: process.session_leader.user.name.text
    name: text
    type: match_only_text
  name: name
  normalize: []
  original_fieldset: user
  short: Short name or login of the user.
  type: keyword
process.session_leader.working_directory:
  dashed_name: process-session-leader-working-directory
  description: The working directory of the process.
  example: /home/alice
  flat_name: process.session_leader.working_directory
  ignore_above: 1024
  level: extended
  multi_fields:
  - flat_name: process.session_leader.working_directory.caseless
    ignore_above: 1024
    name: caseless
    normalizer: lowercase
    type: keyword
  - flat_name: process.session_leader.working_directory.text
    name: text
    norms: false
    type: text
  name: working_directory
  normalize: []
  original_fieldset: process
  short: The working directory of the process.
  type: keyword
process.start:
  dashed_name: process-start
  description: The time the process started.
  example: '2016-05-23T08:05:34.853Z'
  flat_name: process.start
  level: extended
  name: start
  normalize: []
  short: The time the process started.
  type: date
process.supplemental_groups.id:
  dashed_name: process-supplemental-groups-id
  description: Unique identifier for the group on the system/platform.
  flat_name: process.supplemental_groups.id
  ignore_above: 1024
  level: extended
  name: id
  normalize: []
  original_fieldset: group
  short: Unique identifier for the group on the system/platform.
  type: keyword
process.supplemental_groups.name:
  dashed_name: process-supplemental-groups-name
  description: Name of the group.
  flat_name: process.supplemental_groups.name
  ignore_above: 1024
  level: extended
  name: name
  normalize: []
  original_fieldset: group
  short: Name of the group.
  type: keyword
process.tty:
  dashed_name: process-tty
  description: Information about the controlling TTY device. If set, the process belongs
    to an interactive session.
  flat_name: process.tty
  level: extended
  name: tty
  normalize: []
  short: Information about the controlling TTY device.
  type: object
process.tty.char_device.major:
  dashed_name: process-tty-char-device-major
  description: The major number identifies the driver associated with the device.
    The character device's major and minor numbers can be algorithmically combined
    to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0".
    For more details, please refer to the Linux kernel documentation.
  example: 4
  flat_name: process.tty.char_device.major
  level: extended
  name: tty.char_device.major
  normalize: []
  short: The TTY character device's major number.
  type: long
process.tty.char_device.minor:
  dashed_name: process-tty-char-device-minor
  description: "The minor number is used only by the driver specified by the major\
    \ number; other parts of the kernel don\u2019t use it, and merely pass it along\
    \ to the driver. It is common for a driver to control several devices; the minor\
    \ number provides a way for the driver to differentiate among them."
  example: 1
  flat_name: process.tty.char_device.minor
  level: extended
  name: tty.char_device.minor
  normalize: []
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



