Get all chain of process related to causalty actor

[Bouzeghoub]

Hi,

Please, can we get all chain of process related to casualty actor via XQL.

For Example👇 

BR.

[susekar]

Hello @Bouzeghoub ,

Greetings for the day.

To retrieve the full chain of process events related to a causality actor (Causality Group Owner or CGO) via XQL, you must use the definitive causality_id field within the xdr_data dataset.

While alert APIs provide metadata like actor_process_instance_id, they do not return the entire event graph. The causality_id is the primary identifier that links all raw events—including process executions, network connections, and file activities—that constitute the entire causality chain.

Recommended XQL Query

To see the process lineage, use the following query structure 

dataset = xdr_data 
| filter causality_id = "[INSERT_CAUSALITY_ID_HERE]" 
| filter event_type = ENUM.PROCESS
| fields _time, agent_hostname, actor_process_image_name, actor_process_command_line, action_process_image_name, action_process_image_command_line, causality_actor_process_image_name
| sort asc _time

Key Fields for Analyzing the Chain

• causality_id: The unique ID linking every event in the specific causality group.
• actor_process_image_name: The process that initiated the action (the "parent" or "initiator").
• action_process_image_name: The process that is being executed or targeted (the "child" or "target").
• causality_actor_process_image_name: The name of the root process (CGO) that started the entire chain.
• actor_process_instance_id and action_process_instance_id: Unique IDs for specific process instances used to map exact nodes in the hierarchy.

How to Find the Causality ID

If you are starting from a specific alert and want to move to XQL:
1. Locate the alert in the Alerts or Incidents table.
2. The causality_id can be found in the alert metadata (often listed as actor_causality_id).
3. Alternatively, you can right-click an event in the UI and select View in XQL to see the raw data, where the causality_id field will be populated for that event.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New Year!!

Thanks & Regards,
S. Subashkar Sekar

[Bouzeghoub]

Thank you @susekar, but we want to see all chain related with causality.

Please see the image above.

BR.