IDMEF Process Zoom¶

Whole Diagram

Alert

• Time
• Analyzer
  • Node/Address
  • Process
• Source/Target
  • Node/Address
  • Process
  • User/UserId
  • Service
  • File
• Assessment
• Classification
• Additional Data

---

---

The Process Class¶

The Process class is used to describe processes being executed on sources, targets, and analyzers.

The Process class is composed of five aggregate classes:¶

• name

Exactly one. STRING. The name of the program being executed. This is a short name; path and argument information are provided elsewhere.

• pid

Zero or one. INTEGER. The process identifier of the process.

• path

Zero or one. STRING. The full path of the program being executed.

• arg

Zero or more. STRING. A command-line argument to the program. Multiple arguments may be specified (they are assumed to have occurred in the same order they are provided) with multiple uses of arg.

• env

Zero or more. STRING. An environment string associated with the process; generally of the format "VARIABLE=value". Multiple environment strings may be specified with multiple uses of env.

The Process class has one attribute:¶

• ident

Optional. A unique identifier for the process.