Understanding The Process Tree

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Understanding The Process Tree

L1 Bithead

Hello Everyone,

My intention is to fully understand the process tree naming convention for cortex XDR and the more I look at the logs the more confusing it becomes.

From my understanding the process tree from child to grandparent should look like below

action_process - child
actor_process - parent
os_actor_process - ???
causality_actor_process - grand parent

What confuses me is that different process logs tend to vary a lot, in some cases I see actor, OS and causality having the same PID and in some cases I even see causality and action having the same PID.

What is the proper way of understanding the process tree for cortex XDR?
1 accepted solution

Accepted Solutions

Hi AvesterFahimipour,

 

The fields you are asking about shouldn't be thought about in terms of parent/child relationships, but instead, as their names suggest, actor and action.  The actor is the process doing the action, and, obviously, the action is what is being performed.  So if the agent is logging a process start, then yes, you will have action as the child and actor as the parent, however, if we are talking about another type of log, say, file activity, then the actor is the process and the action is the file activity.

Causality is the process that Cortex XDR has determined was responsible for originating the chain of events which led to the action being performed.  The OS actor is the process identified by the operating system as the process that performed the action.

View solution in original post

3 REPLIES 3

L1 Bithead

Hello again community,

After more research I believe that the action is always the child and the actor is always the parent.

And it seems that the OS and causality are the two that can be variables, but I still dont fully understand their behavior or what the OS and causality mean.

Hi AvesterFahimipour,

 

The fields you are asking about shouldn't be thought about in terms of parent/child relationships, but instead, as their names suggest, actor and action.  The actor is the process doing the action, and, obviously, the action is what is being performed.  So if the agent is logging a process start, then yes, you will have action as the child and actor as the parent, however, if we are talking about another type of log, say, file activity, then the actor is the process and the action is the file activity.

Causality is the process that Cortex XDR has determined was responsible for originating the chain of events which led to the action being performed.  The OS actor is the process identified by the operating system as the process that performed the action.

L1 Bithead

Yah, I understood that about files but the causality and OS one was still vague to me.

What would be the cause of the actor and OS actor not being the same?

Thanks for the answer.

  • 1 accepted solution
  • 719 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!