Understanding The Process Tree

[AvesterFahimipour]

Hello Everyone,

My intention is to fully understand the process tree naming convention for cortex XDR and the more I look at the logs the more confusing it becomes.

From my understanding the process tree from child to grandparent should look like below

action_process - child

actor_process - parent

os_actor_process - ???

causality_actor_process - grand parent

What confuses me is that different process logs tend to vary a lot, in some cases I see actor, OS and causality having the same PID and in some cases I even see causality and action having the same PID.

What is the proper way of understanding the process tree for cortex XDR?

[AvesterFahimipour]

Hello again community,

After more research I believe that the action is always the child and the actor is always the parent.

And it seems that the OS and causality are the two that can be variables, but I still dont fully understand their behavior or what the OS and causality mean.

[afurze · Accepted solution]

Hi AvesterFahimipour,

The fields you are asking about shouldn't be thought about in terms of parent/child relationships, but instead, as their names suggest, actor and action.  The actor is the process doing the action, and, obviously, the action is what is being performed.  So if the agent is logging a process start, then yes, you will have action as the child and actor as the parent, however, if we are talking about another type of log, say, file activity, then the actor is the process and the action is the file activity.

Causality is the process that Cortex XDR has determined was responsible for originating the chain of events which led to the action being performed.  The OS actor is the process identified by the operating system as the process that performed the action.

[AvesterFahimipour]

Yah, I understood that about files but the causality and OS one was still vague to me.

What would be the cause of the actor and OS actor not being the same?

Thanks for the answer.