process resource type

  • Artikel

Namespace: microsoft.graph

Contains stateful information about the process related to the alert.

Properties

Property Type Description
accountName String User account identifier (user account context the process ran under) for example, AccountName, SID, and so on.
commandLine String The full process invocation commandline including all parameters.
createdDateTime DateTimeOffset Time at which the process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
fileHash fileHash Complex type containing file hashes (cryptographic and location-sensitive).
integrityLevel processIntegrityLevel The integrity level of the process. Possible values are: unknown, untrusted, low, medium, high, system.
isElevated Boolean True if the process is elevated.
name String The name of the process' Image file.
parentProcessCreatedDateTime DateTimeOffset DateTime at which the parent process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
parentProcessId Int32 The Process ID (PID) of the parent process.
parentProcessName String The name of the image file of the parent process.
path String Full path, including filename.
processId Int32 The Process ID (PID) of the process.

JSON representation

The following JSON representation shows the resource type.

{
  "accountName": "String",
  "commandLine": "String",
  "createdDateTime": "String (timestamp)",
  "fileHash": {"@odata.type": "microsoft.graph.fileHash"},
  "integrityLevel": "@odata.type: microsoft.graph.processIntegrityLevel",
  "isElevated": true,
  "name": "String",
  "parentProcessCreatedDateTime": "String (timestamp)",
  "parentProcessId": 1024,
  "parentProcessName": "String",
  "path": "String",
  "processId": 1024
}