Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a new process attribute to track lineage uids #1275

Open
lcostantino opened this issue Dec 9, 2024 · 0 comments
Open

Add a new process attribute to track lineage uids #1275

lcostantino opened this issue Dec 9, 2024 · 0 comments

Comments

@lcostantino
Copy link

lcostantino commented Dec 9, 2024

Currently, there's a "lineage" attribute as part of Process object, that is defined as

"The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']."

That's a very useful, but not accurate given it's providing only the paths and there could be many process with same paths, etc.

The proposal is to add a lineage_uids attribute that will include all ancestors process uids (unique identifiers) for better and accurate tracking the process lineage.

It's still optional, but consumers can easily look here to reconstruct the "process tree" of a given Process object given the field is provided. (Most of the time endpoint products that have the process tree in memory or are able to reconstruct it before generating the Process object)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant