InspectedProcess

InspectedProcess

Basic information about an inspected process. Complete Process details can be obtained from InspectedProcessDetails.

JSON Example

{
    "process_info": {
        "name": "string",
        "process_id": "string",
        "vm_id": "string",
        "site_id": "string",
        "node_id": "string",
        "process_sha256": "string",
        "process_command_line": "string",
        "binary_path": "string",
        "parent_process_id": "string",
        "parent_process_binary_path": "string",
        "parent_process_uuid": "string",
        "process_uuid": "string"
    },
    "last_inspected": 0,
    "inspection_status": "string",
    "threat_score": 0,
    "verdict": "string",
    "error_message": "string",
    "error_code": "string",
    "malware_family": [
        "string"
    ],
    "malware_class": [
        "string"
    ],
    "inspections_count": 0
}

ProcessInfo

process_info

Optional

Information about the process like ID and name.

EpochMsTimestamp

last_inspected

Optional

Timestamp in milliseconds since epoch.

InspectionStatus

inspection_status

Optional

Denotes the current analysis status of the inspection event.

Enumeration: IN_PROGRESS, COMPLETED, ERROR

integer

threat_score

Optional

Threat score in the range of 0 to 100. A score of 100 is considered high potential threat.

Verdict

verdict

Optional

This property describes the behavior of the file at runtime. Following is the meaning of each verdict:

• BENIGN: File with no malicious code.
• TRUSTED: Behavioural analysis or prevalence indicates a trusted file.
• HIGHLY_TRUSTED: File from a highly trusted source. For example, Microsoft published the file.
• SUSPICIOUS: File contains suspicious code and on execution can turn out to be a malware.
• MALICIOUS: File is a malicious file containing malware or bad code that can harm the system.
• UNKNOWN: File behavior is UNKNOWN at this point in time or there is some error in the analysis pipeline and verdict could not be concluded.
• UNINSPECTED: File is marked as excluded and hence was not inspected by the analysis pipeline.

Enumeration: BENIGN, TRUSTED, HIGHLY_TRUSTED, SUSPICIOUS, MALICIOUS, UNKNOWN, UNINSPECTED

string

error_message

Optional

Error message corresponding to last inspection of this process. This field will be populated only when there is some error in the last inspection.

string

error_code

Optional

Error code corresponding to last inspection of this process. This field will be populated only when there is some error in the last inspection.

array of string

malware_family

Optional

Family of the malware.

array of string

malware_class

Optional

Class of the malware.

integer

inspections_count

Optional

Total count of process inspection events for all the child processes under the root process.

Property Of

InspectedProcessDetails