Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Process.
Information about a process.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#access_mask
def access_mask() -> ::Integer
Returns
- (::Integer) — A bit mask representing the level of access.
#access_mask=
def access_mask=(value) -> ::Integer
Parameter
- value (::Integer) — A bit mask representing the level of access.
Returns
- (::Integer) — A bit mask representing the level of access.
#command_line
def command_line() -> ::String
Returns
- (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.
#command_line=
def command_line=(value) -> ::String
Parameter
- value (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.
Returns
- (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.
#command_line_history
def command_line_history() -> ::Array<::String>
Returns
- (::Array<::String>) — The command line history of the process.
#command_line_history=
def command_line_history=(value) -> ::Array<::String>
Parameter
- value (::Array<::String>) — The command line history of the process.
Returns
- (::Array<::String>) — The command line history of the process.
#egid
def egid() -> ::String
Returns
- (::String) — The effective group ID of the process.
#egid=
def egid=(value) -> ::String
Parameter
- value (::String) — The effective group ID of the process.
Returns
- (::String) — The effective group ID of the process.
#euid
def euid() -> ::String
Returns
- (::String) — The effective user ID of the process.
#euid=
def euid=(value) -> ::String
Parameter
- value (::String) — The effective user ID of the process.
Returns
- (::String) — The effective user ID of the process.
#file
def file() -> ::Google::Backstory::File
Returns
- (::Google::Backstory::File) — Information about the file in use by the process.
#file=
def file=(value) -> ::Google::Backstory::File
Parameter
- value (::Google::Backstory::File) — Information about the file in use by the process.
Returns
- (::Google::Backstory::File) — Information about the file in use by the process.
#integrity_level_rid
def integrity_level_rid() -> ::Integer
Returns
- (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.
#integrity_level_rid=
def integrity_level_rid=(value) -> ::Integer
Parameter
- value (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.
Returns
- (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.
#ipv6
def ipv6() -> ::Boolean
Returns
- (::Boolean) — This is used to determine if the process is an IPv6 process.
#ipv6=
def ipv6=(value) -> ::Boolean
Parameter
- value (::Boolean) — This is used to determine if the process is an IPv6 process.
Returns
- (::Boolean) — This is used to determine if the process is an IPv6 process.
#kernel_duration
def kernel_duration() -> ::Google::Protobuf::Duration
Returns
- (::Google::Protobuf::Duration) — The kernel time spent in the process.
#kernel_duration=
def kernel_duration=(value) -> ::Google::Protobuf::Duration
Parameter
- value (::Google::Protobuf::Duration) — The kernel time spent in the process.
Returns
- (::Google::Protobuf::Duration) — The kernel time spent in the process.
#parent_pid
def parent_pid() -> ::String
Returns
- (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.
#parent_pid=
def parent_pid=(value) -> ::String
Parameter
- value (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.
Returns
- (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.
#parent_process
def parent_process() -> ::Google::Backstory::Process
Returns
- (::Google::Backstory::Process) — Information about the parent process.
#parent_process=
def parent_process=(value) -> ::Google::Backstory::Process
Parameter
- value (::Google::Backstory::Process) — Information about the parent process.
Returns
- (::Google::Backstory::Process) — Information about the parent process.
#pgid
def pgid() -> ::String
Returns
- (::String) — The identifier that points to the process group ID leader.
#pgid=
def pgid=(value) -> ::String
Parameter
- value (::String) — The identifier that points to the process group ID leader.
Returns
- (::String) — The identifier that points to the process group ID leader.
#pid
def pid() -> ::String
Returns
- (::String) — The process ID. This field can be used as an entity indicator for process entities.
#pid=
def pid=(value) -> ::String
Parameter
- value (::String) — The process ID. This field can be used as an entity indicator for process entities.
Returns
- (::String) — The process ID. This field can be used as an entity indicator for process entities.
#product_specific_parent_process_id
def product_specific_parent_process_id() -> ::String
Returns
- (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
#product_specific_parent_process_id=
def product_specific_parent_process_id=(value) -> ::String
Parameter
- value (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
Returns
- (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
#product_specific_process_id
def product_specific_process_id() -> ::String
Returns
- (::String) — A product specific process id.
#product_specific_process_id=
def product_specific_process_id=(value) -> ::String
Parameter
- value (::String) — A product specific process id.
Returns
- (::String) — A product specific process id.
#real_duration
def real_duration() -> ::Google::Protobuf::Duration
Returns
- (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.
#real_duration=
def real_duration=(value) -> ::Google::Protobuf::Duration
Parameter
- value (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.
Returns
- (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.
#rgid
def rgid() -> ::String
Returns
- (::String) — The real group ID of the process.
#rgid=
def rgid=(value) -> ::String
Parameter
- value (::String) — The real group ID of the process.
Returns
- (::String) — The real group ID of the process.
#ruid
def ruid() -> ::String
Returns
- (::String) — The real user ID of the process.
#ruid=
def ruid=(value) -> ::String
Parameter
- value (::String) — The real user ID of the process.
Returns
- (::String) — The real user ID of the process.
#session_leader_pid
def session_leader_pid() -> ::String
Returns
- (::String) — The process ID of the session leader process.
#session_leader_pid=
def session_leader_pid=(value) -> ::String
Parameter
- value (::String) — The process ID of the session leader process.
Returns
- (::String) — The process ID of the session leader process.
#state
def state() -> ::Google::Backstory::Process::State
Returns
- (::Google::Backstory::Process::State) — The state of the process.
#state=
def state=(value) -> ::Google::Backstory::Process::State
Parameter
- value (::Google::Backstory::Process::State) — The state of the process.
Returns
- (::Google::Backstory::Process::State) — The state of the process.
#token_elevation_type
def token_elevation_type() -> ::Google::Backstory::Process::TokenElevationType
Returns
- (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
#token_elevation_type=
def token_elevation_type=(value) -> ::Google::Backstory::Process::TokenElevationType
Parameter
- value (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
Returns
- (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
#tty
def tty() -> ::String
Returns
- (::String) — The teletype terminal which the command was executed within.
#tty=
def tty=(value) -> ::String
Parameter
- value (::String) — The teletype terminal which the command was executed within.
Returns
- (::String) — The teletype terminal which the command was executed within.
#user_duration
def user_duration() -> ::Google::Protobuf::Duration
Returns
- (::Google::Protobuf::Duration) — The user time spent in the process.
#user_duration=
def user_duration=(value) -> ::Google::Protobuf::Duration
Parameter
- value (::Google::Protobuf::Duration) — The user time spent in the process.
Returns
- (::Google::Protobuf::Duration) — The user time spent in the process.