Field | Type | Description |
---|---|---|
blocked_md5 | md5 | MD5 of a process blocked due to a banning rule. |
blocked_status | status |
Status of a block attempt on a running process due to a banning rule, one of the following: |
childproc_count | count | Total count of child processes created by this process |
childproc_md5 | md5 |
MD5 of the executable backing the created child processes. |
childproc_sha256 | sha256 |
SHA-256 of the executable backing the created child processes (if available). |
childproc_name | keyword | Filename of the child process executables. |
cmdline | cmdline | Full command line for this process. |
comments | text | Comment string from the class FileVersionInfo (link in Related Content) |
company_name | text | Company name string from the class FileVersionInfo |
copied_mod_len | count | Number of bytes collected |
crossproc_count | count | Total cound of cross process actions by an actor process. |
crossproc_md5 | md5 | MD5 of actor process that performed a cross process action on a target process. For Example: crossproc_md5:6d7c8a951af6ad6835c029b3cb88d333. |
crossproc_sha256 | sha256 | SHA256 of actor process that performed a cross process action on a target process. For Example: crossproc_sha256:BCB8F25FE404CDBFCB0927048F668D7958E590357930CF620F7 4B59839AF2A9C |
crossproc_name | keyword | Name of of actor process that performed a cross process action on a target process. For Example: crossproc_name:ms*.exe |
crossproc_type | keyword |
|
digsig_issuer | text | If digitally signed, the issuer. |
digsig_prog_name | text | If digitally signed, the program name. |
digsig_publisher | text | If digitally signed, the publisher. |
digsig_result | sign | If digitally signed, the result. Values are: • “Bad Signature” • “Invalid Signature” • “Expired” • “Invalid Chain” • “Untrusted Root” • “Signed” • “Unsigned” • “Explicit Distrust” |
digsig_sign_time | datetime | If digitally signed, the time of signing. For Example: start:[2016-12-01T22:15:00 TO 2016-12-01T:23:14:59] |
digsig_subject | text | If digitally signed, the subject. |
domain | text | Network connection to this domain. |
file_desc | text | File description string from the class FileVersionInfo. |
file_version | text | File version string from the class FileVersionInfo. |
fileless_scriptload_cmdline | text | (7.7+) Command line contents of a fileless scriptload event. |
fileless_scriptload_cmdline_length | integer | (7.7+) Length of the command line contents of a fileless scriptload event. |
filemod | path | Path of a file modified by this process. For Example: filemod:c:\windows\system32\boot\winload.exe |
filemod_count | count | Total count of file modifications by this process. |
filewrite_md5 | md5 | MD5 of file written by this process. |
filewrite_sha256 | sha256 | SHA-256 of file written by this process (if available). |
group | keyword | Sensor group this sensor was assigned to at the time of process execution. |
has_emet_config | bool | True or False - Indicates whether process has EMET mitigation configured/enabled. |
has_emet_event | bool | True or False - Indicates whether process has EMET mitigation events. |
host_count | integer | Count of hosts that have seen a binary. |
host_type | keyword | Type of the computer: workstation, server, or domain controller. |
hostname | keyword | Hostname of the computer on which the process was executed. |
internal_name | text | Internal name string from the class FileVersionInfo |
ipaddr | ipaddr | Network connection to or from this IP address. Only a remote (destination) IP address is searchable regardless of incoming or outgoing. IPv4-mapped addresses (::FFFF:1.2.3.4) are stored as IPv4 netconns, and can be queried using either ipaddr:1.2.3.4 or ipv4mapped:1.2.3.4. IPv4-mapped addresses can also be queried using the ipv6addr:::FFFF:1.2.3.4 . Such queries are automatically translated to ipv4mapped:1.2.3.4. For example: ipaddr:192.168.0.0/16 or ipaddr:10.0.1.1 |
ipv6addr | ipv6addr | Network connection to or from this IPv6 address. Only a remote (destination) IP address is searchable regardless of incoming or outgoing. IPv4-compatible IPv6 addresses (::1.2.3.4) are stored as IPv6 netconns and can be queried using either ipv6addr:::1.2.3.4 or ipv6addr::0102:0304 (the latter is the native form; the dotted quad form is automatically translated to the native form). For example: ipv6addr:fe00:b9:266:2011:28dc:43d4:3298:12e2 or ipv6addr:fe00:b9:266:2011::0/50 |
ipport | integer | Network connection to this destination port. |
is_64bit | bool | True if architecture is x64. |
is_executable_image | bool | True if the binary is an EXE (versus DLL or SYS). |
ja3 | keyword | JA3 fingerprint of the server TLS hello packet. For Example: ja3:669181128F1B9B03303D77C6F2EEFD128 |
ja3s | keyword | JA3S fingerprint of the server TLS hello packet. |
last_server_update | datetime | Last activity in this process in the server’s local time. |
last_update | datetime | Last activity in this process in the computer’s local time. |
legal_copyright | text | Legal copyright string from the class FileVersionInfo. |
legal_trademark | text | Legal trademark string from the class FileVersionInfo. |
md5 | md5 | MD5 of the process, parent, child process, loaded module, or a written file. |
sha256 | sha256 | SHA-256 of the process, parent, child process, loaded module, or a written file (if available). |
modload | path | Path of module loaded into this process. |
modload_count | count | Total count of module loads by this process. |
netconn_block_type | integer | (7.7+) The classification of the network connection attempt. This is a sub-field of a netconn event: 0 equals a successful network connection; 1 equals a network connection attempt that was blocked due to the endpoint being in Isolation. |
netconn_count | count | Total count of network connections by this process. For Example: netconn_count:[10 TO * ] for any process with more than 10 network connections. |
observed_filename | path | Full path of the binary at the time of collection. |
orig_mod_len | count | Size in bytes of the binary at time of collection. |
original_filename | text | Original name string from the class FileVersionInfo. |
os_type | keyword | Type of the operating system: Windows, OSX or Linux. |
parent_id | long | The internal Carbon Black EDR process guid for the parent process. |
parent_md5 | md5 | MD5 of the executable backing the parent process. |
parent_sha256 | sha256 | SHA-256 of the executable backing the parent process (if available). |
parent_name | keyword | Filename of the parent process executable. |
path | path | Full path to the executable backing this process. |
private_build | text | Private build string from the class FileVersionInfo. |
process_id | long | The internal Carbon Black EDR process guid for the process. |
process_md5 | MD5 | MD5 of the executable backing this process. |
process_sha256 | sha256 | SHA-256 of the executable backing this process (if available). |
process_name | text | Filename of the executable backing this process. |
product_desc | text | Product description string from the class FileVersionInfo. |
product_name | text | Product name string from the class FileVersionInfo. |
product_version | text | Product version string from the class FileVersionInfo. |
regmod | path | Path of a registry key modified by this process. |
regmod_count | count | Total count of registry modifications by this process. |
sensor_id | long | The internal Carbon Black EDR sensor guid of the computer on which this process was executed. |
server_added_timestamp | datetime | Time this binary was first seen by the server. |
special_build | text | Special build string from the class FileVersionInfo. |
start | datetime | Start time of this process in the computer’s local time. |
tampered | bool | True if attempts were made to modify the sensor's binaries, disk artifacts, or configuration |
username | keyword | User context with which the process was executed. |
watchlist_<id> | datetime | Time that this process or binary matched the watchlist query with |