Process Data - Sandfly Security

Process data contains all attributes about a process that was flagged by Sandfly Security or the user. It contains not only process-specific information, but also information on the binary associated with the process if it is available. The binary information mirrors that available under the File Data type. If the process holds eBPF programs, maps, or links, the ebpf object summarizes them: their counts, the program types and names, the hook points, and any eBPF objects that are hidden from the process's file descriptor list.

{
	"name": "",
	"extension": "",
	"cmdline": "",
	"cmdargs": null,
	"command": "",
	"date": {
		"created": "",
		"created_minutes": 0
	},
	"pid": 0,
	"ppid": 0,
	"pgid": 0,
	"uid": 0,
	"username": "",
	"gid": 0,
	"groupname": "",
	"login_uid": 0,
	"login_uid_username": "",
	"session_id": 0,
	"path": "",
	"true_path": "",
	"cwd": "",
	"entropy": 0,
	"state": "",
	"system_uptime": "",
	"flags_list": null,
	"selinux_context": "",
	"file_descriptors": [
		{
			"number": 0,
			"path": "",
			"type": "",
			"class": "",
			"hidden": false,
			"selinux_context": ""
		}
	],
	"ebpf": {
		"prog_count": 0,
		"map_count": 0,
		"link_count": 0,
		"hidden_objects": 0,
		"prog_types": null,
		"programs": null,
		"hooks": null
	},
	"environ": null,
	"stack": null,
	"cgroup": [
		{
			"hierarchy_id": "",
			"controller_list": "",
			"path": ""
		}
	],
	"container": {
		"id": "",
		"id_short": "",
		"rootdir": ""
	},
	"network_ports": {
		"operating": false
	},
	"hash": {
		"md5": "",
		"sha1": "",
		"sha256": "",
		"sha512": ""
	},
	"file": {
		"date": {
			"created": "",
			"created_minutes": 0,
			"modified": "",
			"modified_minutes": 0,
			"accessed": "",
			"accessed_minutes": 0
		},
		"nlink": 0,
		"mode": "",
		"uid": 0,
		"username": "",
		"gid": 0,
		"groupname": "",
		"size": 0,
		"size_mismatch": false,
		"path": "",
		"path_root": "",
		"name": "",
		"capabilities": {},
		"flags_list": null,
		"entropy": 0,
		"hash": {
			"md5": "",
			"sha1": "",
			"sha256": "",
			"sha512": ""
		},
		"magic_num": {
			"hex": "",
			"text": "",
			"type": "",
			"class": "",
			"expected_extensions": null
		},
		"mount": {
			"mountpoint": "",
			"device": "",
			"fs_type": ""
		},
		"container": {
			"id": "",
			"id_short": "",
			"rootdir": ""
		},
		"data": null,
		"analysis": {
			"binary": {
				"interpreter": "",
				"build_id": "",
				"comment": "",
				"architecture": "",
				"type": "",
				"hardening": null,
				"hardening_missing": null,
				"capabilities": null,
				"suspicious": null,
				"anomalies": null,
				"properties": null,
				"confirmed": null,
				"exec_targets": null,
				"decoded_strings": null,
				"decode_keys_xor": null,
				"counts": {
					"imported_symbols": 0,
					"static_symbols": 0,
					"exported_symbols": 0,
					"syscalls": 0,
					"imported_libs": 0
				},
				"suspicious_symbols": null,
				"suspicious_syscalls": null,
				"suspicious_strings": null,
				"suspicious_exported_symbols": null,
				"imports": null,
				"iocs": {
					"ips": null,
					"urls": null,
					"paths": null
				},
				"overlay": {
					"size": 0,
					"ratio": 0,
					"entropy": 0,
					"content_type": ""
				},
				"threat_score": 0,
				"threat_score_lr": 0,
				"threat_score_gbdt": 0,
				"score_path": ""
			}
		}
	},
	"status": {
		"name": "",
		"umask": "",
		"state": "",
		"tgid": 0,
		"ngid": 0,
		"pid": 0,
		"ppid": 0,
		"tracer_pid": 0,
		"uid": 0,
		"uid_effective": 0,
		"uid_saved_set": 0,
		"uid_file_system": 0,
		"gid": 0,
		"gid_effective": 0,
		"gid_saved_set": 0,
		"gid_file_system": 0,
		"groupids": null,
		"groupnames": null,
		"ns_tgid": 0,
		"ns_pid": 0,
		"ns_pgid": 0,
		"ns_sid": 0,
		"vm_peak": 0,
		"vm_size": 0,
		"threads": 0,
		"cap_inh": "",
		"cap_prm": "",
		"cap_eff": "",
		"cap_bnd": "",
		"cap_amb": "",
		"seccomp": 0,
		"seccomp_filters": 0,
		"flags": null,
		"empty": false
	},
	"capabilities": {}
}