Chronicle V1 API - Class Google::Backstory::Process (v1.4.0)

1.4.0 (latest) 1.3.0 1.2.0 1.1.0 1.0.1 0.9.0 0.8.0 0.7.0 0.6.0 0.5.0 0.4.0 0.3.1 0.2.0 0.1.0

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Process.

Information about a process.

Inherits

• Object

Extended By

• Google::Protobuf::MessageExts::ClassMethods

Includes

• Google::Protobuf::MessageExts

Methods

#access_mask

def access_mask() -> ::Integer

Returns

• (::Integer) — A bit mask representing the level of access.

#access_mask=

def access_mask=(value) -> ::Integer

Parameter

• value (::Integer) — A bit mask representing the level of access.

Returns

• (::Integer) — A bit mask representing the level of access.

#command_line

def command_line() -> ::String

Returns

• (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.

#command_line=

def command_line=(value) -> ::String

Parameter

• value (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.

Returns

• (::String) — The command line command that created the process. This field can be used as an entity indicator for process entities.

#command_line_history

def command_line_history() -> ::Array<::String>

Returns

• (::Array<::String>) — The command line history of the process.

#command_line_history=

def command_line_history=(value) -> ::Array<::String>

Parameter

• value (::Array<::String>) — The command line history of the process.

Returns

• (::Array<::String>) — The command line history of the process.

#egid

def egid() -> ::String

Returns

• (::String) — The effective group ID of the process.

#egid=

def egid=(value) -> ::String

Parameter

• value (::String) — The effective group ID of the process.

Returns

• (::String) — The effective group ID of the process.

#euid

def euid() -> ::String

Returns

• (::String) — The effective user ID of the process.

#euid=

def euid=(value) -> ::String

Parameter

• value (::String) — The effective user ID of the process.

Returns

• (::String) — The effective user ID of the process.

#file

def file() -> ::Google::Backstory::File

Returns

• (::Google::Backstory::File) — Information about the file in use by the process.

#file=

def file=(value) -> ::Google::Backstory::File

Parameter

• value (::Google::Backstory::File) — Information about the file in use by the process.

Returns

• (::Google::Backstory::File) — Information about the file in use by the process.

#integrity_level_rid

def integrity_level_rid() -> ::Integer

Returns

• (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.

#integrity_level_rid=

def integrity_level_rid=(value) -> ::Integer

Parameter

• value (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.

Returns

• (::Integer) — The Microsoft Windows integrity level relative ID (RID) of the process.

#ipv6

def ipv6() -> ::Boolean

Returns

• (::Boolean) — This is used to determine if the process is an IPv6 process.

#ipv6=

def ipv6=(value) -> ::Boolean

Parameter

• value (::Boolean) — This is used to determine if the process is an IPv6 process.

Returns

• (::Boolean) — This is used to determine if the process is an IPv6 process.

#kernel_duration

def kernel_duration() -> ::Google::Protobuf::Duration

Returns

• (::Google::Protobuf::Duration) — The kernel time spent in the process.

#kernel_duration=

def kernel_duration=(value) -> ::Google::Protobuf::Duration

Parameter

• value (::Google::Protobuf::Duration) — The kernel time spent in the process.

Returns

• (::Google::Protobuf::Duration) — The kernel time spent in the process.

#parent_pid

def parent_pid() -> ::String

Returns

• (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.

#parent_pid=

def parent_pid=(value) -> ::String

Parameter

• value (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.

Returns

• (::String) — The ID of the parent process. Deprecated: use parent_process.pid instead.

#parent_process

def parent_process() -> ::Google::Backstory::Process

Returns

• (::Google::Backstory::Process) — Information about the parent process.

#parent_process=

def parent_process=(value) -> ::Google::Backstory::Process

Parameter

• value (::Google::Backstory::Process) — Information about the parent process.

Returns

• (::Google::Backstory::Process) — Information about the parent process.

#pgid

def pgid() -> ::String

Returns

• (::String) — The identifier that points to the process group ID leader.

#pgid=

def pgid=(value) -> ::String

Parameter

• value (::String) — The identifier that points to the process group ID leader.

Returns

• (::String) — The identifier that points to the process group ID leader.

#pid

def pid() -> ::String

Returns

• (::String) — The process ID. This field can be used as an entity indicator for process entities.

#pid=

def pid=(value) -> ::String

Parameter

• value (::String) — The process ID. This field can be used as an entity indicator for process entities.

Returns

• (::String) — The process ID. This field can be used as an entity indicator for process entities.

#product_specific_parent_process_id

def product_specific_parent_process_id() -> ::String

Returns

• (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.

#product_specific_parent_process_id=

def product_specific_parent_process_id=(value) -> ::String

Parameter

• value (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.

Returns

• (::String) — A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.

#product_specific_process_id

def product_specific_process_id() -> ::String

Returns

• (::String) — A product specific process id.

#product_specific_process_id=

def product_specific_process_id=(value) -> ::String

Parameter

• value (::String) — A product specific process id.

Returns

• (::String) — A product specific process id.

#real_duration

def real_duration() -> ::Google::Protobuf::Duration

Returns

• (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.

#real_duration=

def real_duration=(value) -> ::Google::Protobuf::Duration

Parameter

• value (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.

Returns

• (::Google::Protobuf::Duration) — The real time spent in the process. This is the sum of the kernel and user time.

#rgid

def rgid() -> ::String

Returns

• (::String) — The real group ID of the process.

#rgid=

def rgid=(value) -> ::String

Parameter

• value (::String) — The real group ID of the process.

Returns

• (::String) — The real group ID of the process.

#ruid

def ruid() -> ::String

Returns

• (::String) — The real user ID of the process.

#ruid=

def ruid=(value) -> ::String

Parameter

• value (::String) — The real user ID of the process.

Returns

• (::String) — The real user ID of the process.

#session_leader_pid

def session_leader_pid() -> ::String

Returns

• (::String) — The process ID of the session leader process.

#session_leader_pid=

def session_leader_pid=(value) -> ::String

Parameter

• value (::String) — The process ID of the session leader process.

Returns

• (::String) — The process ID of the session leader process.

#state

def state() -> ::Google::Backstory::Process::State

Returns

• (::Google::Backstory::Process::State) — The state of the process.

#state=

def state=(value) -> ::Google::Backstory::Process::State

Parameter

• value (::Google::Backstory::Process::State) — The state of the process.

Returns

• (::Google::Backstory::Process::State) — The state of the process.

#token_elevation_type

def token_elevation_type() -> ::Google::Backstory::Process::TokenElevationType

Returns

• (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.

#token_elevation_type=

def token_elevation_type=(value) -> ::Google::Backstory::Process::TokenElevationType

Parameter

• value (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.

Returns

• (::Google::Backstory::Process::TokenElevationType) — The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.

#tty

def tty() -> ::String

Returns

• (::String) — The teletype terminal which the command was executed within.

#tty=

def tty=(value) -> ::String

Parameter

• value (::String) — The teletype terminal which the command was executed within.

Returns

• (::String) — The teletype terminal which the command was executed within.

#user_duration

def user_duration() -> ::Google::Protobuf::Duration

Returns

• (::Google::Protobuf::Duration) — The user time spent in the process.

#user_duration=

def user_duration=(value) -> ::Google::Protobuf::Duration

Parameter

• value (::Google::Protobuf::Duration) — The user time spent in the process.

Returns

• (::Google::Protobuf::Duration) — The user time spent in the process.