IDMEF Process Zoom¶Alert
- Additional Data
The Process Class¶
The Process class is used to describe processes being executed on sources, targets, and analyzers.
The Process class is composed of five aggregate classes:¶
Exactly one. STRING. The name of the program being executed. This is a short name; path and argument information are provided elsewhere.
Zero or one. INTEGER. The process identifier of the process.
Zero or one. STRING. The full path of the program being executed.
Zero or more. STRING. A command-line argument to the program. Multiple arguments may be specified (they are assumed to have occurred in the same order they are provided) with multiple uses of arg.
Zero or more. STRING. An environment string associated with the process; generally of the format "VARIABLE=value". Multiple environment strings may be specified with multiple uses of env.
The Process class has one attribute:¶
Optional. A unique identifier for the process.