Skip to content

process.md

Latest commit

 

History

History
76 lines (62 loc) · 2.75 KB

process.md

File metadata and controls

76 lines (62 loc) · 2.75 KB
title process resource type (deprecated)
description Contains stateful information about the process related to the alert.
ms.localizationpriority medium
author preetikr
ms.subservice security
doc_type resourcePageType
ms.date 07/22/2024
ROBOTS NOINDEX

process resource type (deprecated)

Namespace: microsoft.graph

[!INCLUDE security-alerts-v1-deprecation]

Contains stateful information about the process related to the alert.

Properties

Property Type Description
accountName String User account identifier (user account context the process ran under) for example, AccountName, SID, and so on.
commandLine String The full process invocation commandline including all parameters.
createdDateTime DateTimeOffset Time at which the process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
fileHash fileHash Complex type containing file hashes (cryptographic and location-sensitive).
integrityLevel processIntegrityLevel The integrity level of the process. The possible values are: unknown, untrusted, low, medium, high, system.
isElevated Boolean True if the process is elevated.
name String The name of the process' Image file.
parentProcessCreatedDateTime DateTimeOffset DateTime at which the parent process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
parentProcessId Int32 The Process ID (PID) of the parent process.
parentProcessName String The name of the image file of the parent process.
path String Full path, including filename.
processId Int32 The Process ID (PID) of the process.

JSON representation

The following JSON representation shows the resource type.

{
  "accountName": "String",
  "commandLine": "String",
  "createdDateTime": "String (timestamp)",
  "fileHash": {"@odata.type": "microsoft.graph.fileHash"},
  "integrityLevel": "@odata.type: microsoft.graph.processIntegrityLevel",
  "isElevated": true,
  "name": "String",
  "parentProcessCreatedDateTime": "String (timestamp)",
  "parentProcessId": 1024,
  "parentProcessName": "String",
  "path": "String",
  "processId": 1024
}