> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/action-actor.md). # Action Actor The Action actor is an activity that took place and was recorded by the agent. | Field Name | Data Type | Description | | --------------------------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | action\_app\_id\_transitions | STRING | List of application ID transitions. | | action\_boot\_instance\_cleanup\_required | BOOLEAN | Indicates whether or not the agent can clean up open instances from a previous computer restart. | | action\_boot\_time | INTEGER | Computer boot time in ms since epoch time. | | action\_country | STRING | The destination country of network connections, which is based on the remote IP and GeoLocation enrichment. | | action\_device\_bus\_type | INTEGER | For the action, the origin of the device bus type (USB). | | action\_device\_class\_guid | STRING | Device setup class GUID. | | action\_device\_class\_name | STRING | Device setup class internal friendly name. | | action\_device\_usb\_port\_connectable | BOOLEAN | Indicates whether or not a user can connect to the USB port that the device is connected to. | | action\_device\_usb\_product\_id | INTEGER | USB device product ID. | | action\_device\_usb\_serial\_number | STRING | USB device serial number. | | action\_device\_usb\_vendor\_id | INTEGER | USB vendor ID. | | action\_download | INTEGER | Number of downloaded bytes in the last window of time. | | action\_evtlog\_data\_fields | STRING | Event log data fields in a JSON array. | | action\_evtlog\_description | STRING | Event log description. | | action\_evtlog\_event\_id | INTEGER | Event log event ID. | | action\_evtlog\_level | INTEGER | Event log severity level. | | action\_evtlog\_message | STRING | Event log message field - summary of the event. | | action\_evtlog\_opcode | INTEGER | Event provider specific information, usually similar to "action\_evtlog\_level". | | action\_evtlog\_pid | INTEGER | Process ID given in the event-log event. | | action\_evtlog\_provider\_guid | STRING | Provider GUID | | action\_evtlog\_provider\_name | STRING |

Windows: Provider name, such as Service Control Manager.
Linux: The file from which this event originated.

| | action\_evtlog\_raw\_params | STRING | | | action\_evtlog\_record\_id | STRING | Unique ID of this event-log record in the computer's event-log. | | action\_evtlog\_source | INTEGER | Method used to get the event log. | | action\_evtlog\_tid | INTEGER | Thread ID given in the event-log event. | | action\_evtlog\_uid | STRING | User ID given in the event-log event. | | action\_evtlog\_username | STRING | User ID translation of username. | | action\_evtlog\_version | INTEGER | Version of the event log record (private to provider/channel). | | action\_external\_hostname | STRING |

The hostname the endpoint connects to.
When there is a proxy connection, this value will differ from action\_remote\_ip.

| | action\_external\_port | INTEGER |

The external port of the initiated communication.
When there is a proxy connection, this value can differ from action\_remote\_port.

| | action\_file\_access\_time | INTEGER | The action file access timestamp. | | action\_file\_archive\_list | RECORD | Only valid if the file is a ZIP file and the event collection is enabled in the policy. | | action\_file\_attributes | INTEGER |

Windows: Bitmask of FILE\_ATTRIBUTE\_\* attributes, which is only relevant for some subtypes.
Unix: Always 'null'.

| | action\_file\_authenticode\_sha1 | STRING | SHA-1 (Secure Hash Algorithm 1) of the file signature authenticode. | | action\_file\_authenticode\_sha2 | STRING | SHA-2 (Secure Hash Algorithm 2) of the file signature authenticode. | | action\_file\_create\_time | INTEGER | The action file create timestamp. | | action\_file\_device\_info | RECORD | Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. | | action\_file\_device\_type | INTEGER |

Windows: An enum representing the device type for this file.
Regular file = 0
Named pipe = 1

| | action\_file\_dir\_query | STRING | The query string given to the "query directory" operation. | | action\_file\_dirty\_reason | INTEGER |

Only valid for sub\_type = 6 (write) when a non-null file\_size is provided.
Indicates the reason this "final" write was issued and why the file hash was recalculated.

| | action\_file\_entropy | STRING | | | action\_file\_extension | STRING | File extension of action\_file\_path. | | action\_file\_group | STRING | Linux & MacOS: The new group of the file (user\_id). | | action\_file\_group\_name | STRING | Name assigned to action\_file\_group (username). | | action\_file\_hash\_control\_verdict | STRING | DEPRECATED | | action\_file\_id | STRING | DEPRECATED | | action\_file\_info\_company | STRING | Company listed in the file information section of the file. | | action\_file\_info\_description | STRING | Description listed in the file information section of the file. | | action\_file\_info\_file\_version | STRING | File version listed in the file information section of the file. | | action\_file\_info\_product\_name | STRING | Product name listed in the file information section of the file. | | action\_file\_info\_product\_version | STRING | Production version listed in the file information section of the file. | | action\_file\_internal\_meta\_data | STRING | DEPRECATED | | action\_file\_internal\_zipped\_files | STRING | DEPRECATED | | action\_file\_md5 | STRING | The action file hash value in MD5. | | action\_file\_mod\_time | INTEGER | The action file modification timestamp. | | action\_file\_mode | RECORD | A representation of the standard UNIX file permissions mask. | | action\_file\_name | STRING | The file name of action\_file\_path, which is an empty string for directory operations. | | action\_file\_new\_file\_for\_loaded\_dll | STRING | DEPRECATED | | action\_file\_original\_event\_id | STRING | DEPRECATED | | action\_file\_owner | STRING | The new owner of the file according to the user\_id. | | action\_file\_owner\_name | STRING | The new owner of the file according to the username. | | action\_file\_path | STRING | The path of the file in use. | | action\_file\_prev\_type | INTEGER |

Before the current write, the previous file type, which is based only on the content of the file. This information can be used to detect header changes.
Will be valid ONLY on the file\_write event that changes the file type.
Windows only

| | action\_file\_previous\_device\_info | RECORD | Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. | | action\_file\_previous\_file\_extension | STRING | File extension of 'action\_file\_previous\_file\_path'. | | action\_file\_previous\_file\_name | STRING | File name of 'action\_file\_previous\_file\_path', which is an empty string for directory operations. | | action\_file\_previous\_file\_path | STRING | The previous path of the file in use. | | action\_file\_remote\_file\_host | STRING |

This is valid when Cortex XDR/XSIAM accesses a file on a remote computer.
This means Cortex XDR/XSIAM is the client.

| | action\_file\_remote\_file\_ip | STRING |

This is valid when a remote computer accesses a file on this endpoint.
This means Cortex XDR/XSIAM is the client.
The remote IP can also be a loopback (127.0.0.1 or ::1).

| | action\_file\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. | | action\_file\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. | | action\_file\_reparse\_path | STRING | Only valid for sub\_type = 1/2 (create\_new/open). Provides the reparse path if the file was opened through a reparse point. | | action\_file\_sec\_desc | STRING | Windows: Security descriptor of the file in SDDL. | | action\_file\_sha256 | STRING | SHA256 of the binary. | | action\_file\_signature\_product | STRING | Signature product - The product family part of the signature. | | action\_file\_signature\_status | INTEGER | The signature status of the file in use. | | action\_file\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. | | action\_file\_size | INTEGER | Size of the file undergoing the process in bytes. | | action\_file\_suspicious\_strings\_bitmap | INTEGER | Bitmap of suspicious strings found in file content. | | action\_file\_type | INTEGER | Partial file type recognizer. | | action\_file\_type\_changedaction\_file\_id | INTEGER | DEPRECATED | | action\_file\_type\_prev | INTEGER | | | action\_file\_wildfire\_verdict | STRING | DEPRECATED | | action\_firewall\_direction | STRING |

Outbound (1)
Inbound (2)

| | action\_firewall\_local\_ip | STRING | The local IP address in the communication. | | action\_firewall\_local\_port | INTEGER | The local port in the communication. | | action\_firewall\_protocol | INTEGER | The IP protocol number as specified in RFC 1700. | | action\_firewall\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. | | action\_firewall\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. | | action\_firewall\_rule\_guid | STRING | | | action\_is\_dll\_injection | BOOLEAN | Indicates whether or not the action is a DLL Injection. | | action\_is\_injected\_thread | BOOLEAN | Indicates whether or not the action was performed by an injected thread. | | action\_local\_ip | STRING | Source IP address. | | action\_local\_ip\_int | INTEGER | Source IP in integer format. | | action\_module\_base\_address | STRING | The base address where the library was loaded. | | action\_module\_device\_info | RECORD | Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. | | action\_module\_file\_access\_time | INTEGER | Program Executable (PE) metadata collection from the image itself | | action\_module\_file\_create\_time | INTEGER | Program Executable (PE) metadata collection from the image itself | | action\_module\_file\_info | STRING | Program Executable (PE) metadata collection from the image itself | | action\_module\_file\_mod\_time | INTEGER | Modified time of the file in the module. | | action\_module\_file\_size | INTEGER | Size of the file of the process in bytes. | | action\_module\_image\_size | INTEGER | Size of the file in virtual memory. | | action\_module\_is\_remote | BOOLEAN | Indicates whether or not the module is loaded from a remote process. | | action\_module\_is\_replay | BOOLEAN | All existing loaded images are replayed, when the agent starts. This is set to true for images loaded when the agent is not started yet. | | action\_module\_md5 | STRING | The module md5 value. | | action\_module\_other\_load\_location | STRING | This module was already loaded before from a different location. This is the other location. | | action\_module\_path | STRING | The path of the module in use. | | action\_module\_process\_instance\_id | STRING | Cortex instance ID of the process loading the module. | | action\_module\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the loaded module. | | action\_module\_sha256 | STRING | SHA256 of the binary. | | action\_module\_signature\_product | STRING | Signature product - The product family part of the signature. | | action\_module\_signature\_status | INTEGER | The signature status of the module in action. | | action\_module\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. | | action\_network\_connection\_id | STRING | The ID of the network connection. | | action\_network\_creation\_time | INTEGER | The start time of the network session. | | action\_network\_http | STRING | HTTP headers | | action\_network\_is\_ipv6 | BOOLEAN | Indicates whether or not action\_remote\_ip is an IPv6 endpoint. | | action\_network\_is\_npcap | BOOLEAN | Indicates whether or not this action is an npcap event. | | action\_network\_is\_server | BOOLEAN |

True for incoming connections.
False for outgoing ones.

| | action\_network\_packet\_data | STRING | The data is converted to hexadecimal. Each byte is converted to 2 characters representing the character value of the byte. | | action\_network\_protocol | INTEGER | Internet protocol number based on IPPROTO or normalized to IPPROTO (same as Java). | | action\_network\_stats\_is\_last | BOOLEAN | True, if the connection was terminated, and false otherwise. | | action\_network\_stats\_seq | INTEGER | Sequence number of the statistics "packet". | | action\_network\_success | BOOLEAN | Indicates whether or not the session was successful. | | action\_pkts\_received | INTEGER | Total number of packets received so far from the destination to the source. | | action\_pkts\_sent | INTEGER | Total number of packets sent so far from the source to the destination. | | action\_powered\_off | BOOLEAN | True, if the computer is powered off, such as suspended or hibernated, and false otherwise. | | action\_process\_causality\_id | STRING | Causality ID of the terminated process. | | action\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. | | action\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. | | action\_process\_file\_info | STRING | Metadata from the exe file of the process. | | action\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. | | action\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. | | action\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. | | action\_process\_image\_command\_line\_indices | STRING | Process command line - The command used to execute the process. | | action\_process\_image\_extension | STRING | Process image extension - File extension | | action\_process\_image\_md5 | STRING | MD5 of the binary. | | action\_process\_image\_name | STRING | File name of the 'action\_process\_image\_path'. | | action\_process\_image\_path | STRING | Process image path - A string identifying the location of the process execution. | | action\_process\_image\_sha256 | STRING | SHA256 of the binary. | | action\_process\_instance\_execution\_time | INTEGER | Instance execution time. | | action\_process\_instance\_id | STRING | Cortex instance ID of the process. | | action\_process\_integrity\_level | INTEGER | Integrity level of the process created. | | action\_process\_is\_causality\_root | BOOLEAN | Indicates whether or not the created process is a new causality root process. | | action\_process\_is\_replay | BOOLEAN |

Windows: The following events are replayed: Processes started before the agent is started. Module load events for modules loaded in replayed processes. Drivers loaded using module load before the agent is started.
For loaded drivers, the process is always a special KernelProcess.

| | action\_process\_is\_special | INTEGER |

Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3

| | action\_process\_is\_txn | | | | action\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the new process | | action\_process\_remote\_session\_ip | STRING | Windows: When the process was started from a remote Terminal Services session, the IP address of the remote client connected to the session. | | action\_process\_requested\_parent\_iid | STRING | Windows: Same as the "action\_process\_requested\_parent\_pid", but the instance ID. | | action\_process\_requested\_parent\_pid | INTEGER | Windows: A parent process can request to set the parent-pid of the child process to something other than their own. This is used for a "runas" scenario where the os\_actor is different from the actor. Yet, it can also be used by malware to fake the parent pid. This field gives the requested parent pid, while giving the true actor/os\_actor for the operation. | | action\_process\_signature\_product | STRING | Signature product - The product family part of the signature. | | action\_process\_signature\_status | INTEGER |

Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.

| | action\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. | | action\_process\_termination\_code | INTEGER | Process exit code. | | action\_process\_termination\_date | INTEGER | Instance termination time. | | action\_process\_user\_sid | STRING |

Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.

| | action\_process\_username | STRING | Name assigned to the 'action\_process\_user\_sid'. | | action\_protocol | INTEGER | IP protocol of the network event. | | action\_proxy | BOOLEAN |

Indicates whether or not Cortex XDR/XSIAM performed an HTTP proxy resolution to get these fields:
action\_external\_hostname, action\_external\_port. If true, the hostname/port fields are taken from the HTTP packet data. Otherwise, they are taken from other protocols like DNS.

| | action\_registry\_data | STRING | Registry data being written to the specific key. | | action\_registry\_file\_path | STRING |

Four operations:
Load
Save
Restore
Unload

| | action\_registry\_key\_name | STRING | Registry key name being accessed. | | action\_registry\_old\_data | STRING | Registry data being replaced by a new value. | | action\_registry\_old\_key\_name | STRING | Old registry key name that is being renamed. | | action\_registry\_return\_val | INTEGER | Return value from the registry operation. | | action\_registry\_value\_name | STRING | Registry value name being accessed. | | action\_registry\_value\_type | INTEGER |

Regular types:
REG\_SZ (1)
REG\_EXPAND\_SZ (2)
REG\_BINARY (3)
REG\_DWORD (4)
REG\_DWORD\_BIG\_ENDIAN (5)
REG\_LINK (6)
REG\_MULTI\_SZ (7)
REG\_RESOURCE\_LIST (8)
REG\_FULL\_RESOURCE\_DESCRIPTOR (9)
REG\_RESOURCE\_REQUIREMENTS\_LIST (10)
REG\_QWORD (11)

| | action\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. | | action\_remote\_ip\_int | INTEGER | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. | | action\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. | | action\_remote\_process\_causality\_id | STRING | Causality ID of the remote injected process. | | action\_remote\_process\_file\_access\_time | INTEGER | Access time of the file that created the process. | | action\_remote\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. | | action\_remote\_process\_image\_extension | STRING | Process image extension - File extension. | | action\_remote\_process\_image\_md5 | STRING | MD5 of the binary. | | action\_remote\_process\_image\_name | STRING | Image name of the remote injected process. | | action\_remote\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. | | action\_remote\_process\_image\_sha256 | STRING | SHA256 of the binary. | | action\_remote\_process\_instance\_id | STRING | Instance ID of the remote injected process. | | action\_remote\_process\_integrity\_level | INTEGER | Integrity level of the remote injected process. | | action\_remote\_process\_is\_causality\_root | BOOLEAN | Indicates whether or not the remote process being injected into is a causality root. | | action\_remote\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the remote process | | action\_remote\_process\_signature\_product | STRING | Signature product - The product family part of the signature. | | action\_remote\_process\_signature\_status | INTEGER |

Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.

| | action\_remote\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. | | action\_remote\_process\_thread\_id | INTEGER | Target thread of remote execution. | | action\_remote\_process\_thread\_start\_address | STRING | Memory address of the thread being injected into a remote process. | | action\_remote\_process\_user\_sid | STRING |

Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.

| | action\_remote\_process\_username | STRING | Name assigned to the action\_process\_user\_sid field. | | action\_rpc\_func\_opnum | INTEGER | Integer identifying the function called. | | action\_rpc\_interface\_uuid | STRING | Universally Unique IDentifier (UUID) identifying the interface. An interface is only uniquely identified by the UUID + Major version + Minor version. | | action\_rpc\_interface\_version\_major | INTEGER | Major version of the Remote Procedure Call (RPC) interface. | | action\_rpc\_interface\_version\_minor | INTEGER | Minor version of the Remote Procedure Call (RPC) interface. | | action\_session\_duration | INTEGER | Number of milliseconds (ms) since the session started. | | action\_syscall\_etw\_based | BOOLEAN | Indicates whether or not the system call based on Event Tracing for Windows (ETW) or on native hooking. | | action\_syscall\_int\_params | STRING | Action parameters where the value is an integer in the system call invocation. | | action\_syscall\_stack\_ptr | STRING | Stack pointer creating the captured syscall. | | action\_syscall\_string\_params | STRING | Action parameters where the value is a string in the system call invocation. | | action\_syscall\_target\_image\_name | STRING | Base image name of the target process, such as lsass.exe. | | action\_syscall\_target\_image\_path | STRING | Process image path - A string identifying the location of the execution. | | action\_syscall\_target\_instance\_id | STRING | Instance ID of the target process, when one exists. | | action\_syscall\_target\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the syscall target process | | action\_syscall\_target\_thread\_id | INTEGER | Target thread ID of the captured syscall. | | action\_thread\_thread\_id | INTEGER | Thread ID creating the captured syscall. | | action\_total\_download | INTEGER | Total number of payload bytes from the destination to the source so far. | | action\_total\_upload | INTEGER | Total number of payload bytes from the source to the destination so far. | | action\_upload | INTEGER | Number of uploaded bytes in the last time window. | | action\_user\_agent | STRING | The user agent used by an actor to perform an action. | | action\_user\_is\_local\_session | BOOLEAN | Indicates whether or not the user log in from a remote computer or locally. | | action\_user\_status | INTEGER |

Agent user status change event.
Enum mapping:
1 - logon
2 - logoff
3 - locked / screen saver on
4 - unlocked / screen saver off
5 - Reconnect
6 - Disconnect

| | action\_user\_status\_sid | STRING | Security identifier (SID) of the user. | | action\_username | STRING | Name of the user. | | action\_local\_nat\_port | INTEGER | Source NAT port. | | action\_remote\_nat\_port | INTEGER | Destination NAT port. | | action\_local\_nat\_ip | STRING | Source NAT IP address. | | action\_remote\_nat\_ip | STRING | Destination NAT IP address. | | action\_nat | BOOLEAN | Indicates whether or not the connection is NAT. | | action\_rpc\_items | RECORD | EAL remote procedure call (RPC) data items. | | action\_category\_of\_app\_id | STRING | App-ID category. | | action\_sub\_category\_of\_app\_id | STRING | App-ID sub category. | | action\_app\_id\_risk | INTEGER | App-ID risk | | action\_location | RECORD | Geolocation information of the source IP. | | action\_as\_data | RECORD | ASN data from the source of the network activity. | | action\_evtlog\_normalized\_user | RECORD | A normalized user for the event log event. | | action\_direction\_confidence | INTEGER | | | action\_evtlog\_int\_fields | RECORD | | | action\_file\_pe\_info | RECORD | Only valid according to collection policy. Usually, enabled on some write-file events. The field is not aptly named since it sometimes contains info on non-PE files as well. | | action\_file\_last\_writer\_actor | STRING | Instance ID of the actor that wrote the file. | | action\_file\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the PE or part of an external catalog file. | | action\_file\_auth\_sha1 | STRING | SHA1 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_file\_auth\_sha2 | STRING | SHA256 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_file\_reparse\_count | INTEGER | Only valid for sub\_type = 1/2 (create\_new/open), which provides the reparse count if the file was open through a reparse point. | | action\_file\_pipe\_impersonation\_integrity\_level | INTEGER | When the event type is impersonate\_pipe, this field contains the integrity level of the token that is used for the impersonation. | | action\_file\_operation\_flags | INTEGER | The specified flags for the file operation. | | action\_file\_is\_anonymous | BOOLEAN | Indicates whether or not the file was created without an accesible path from the filesystem (`open(..., O_TMPFILE)`, `memfd_create`). | | action\_module\_last\_writer\_actor | STRING | Instance ID of the actor that wrote the file for the module. | | action\_module\_code\_integrity | INTEGER | The value of ci!g\_CiOptions when the driver is loaded. | | action\_module\_boot\_code\_integrity | INTEGER | The value of ci!g\_CiOptions at boot time. | | action\_module\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the PE or part of an external catalog file. | | action\_module\_system\_properties | INTEGER | Addition properties of the DLL. | | action\_module\_auth\_sha2 | STRING | SHA256 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_module\_auth\_sha1 | STRING | SHA1 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_local\_port | INTEGER | Source port | | action\_network\_icmp\_data | RECORD | Only valid for event\_sub\_type = 18. ICMP packet data. | | action\_network\_creation\_time\_original | INTEGER | | | action\_network\_is\_loopback | BOOLEAN |

Valid for stream\_connect, datagram\_connect, raw\_data, outbound\_icmp and stream\_statistics.
Indicates whether or not both sides of a connection are on the same host. Always false for mac and linux.

| | action\_socket\_type | INTEGER |

0 : Unknown type
1 : Stream
2 : Datagram
3 : Raw

| | action\_process\_pe\_load\_info | RECORD | Windows: Information about the loaded PE image. | | action\_process\_token | RECORD | Security context of the process. | | action\_process\_privileges | INTEGER | String representing a 64-bit integer. These are the enabled special privileges that the process is running with. | | action\_process\_fds | RECORD | Unix: FD information about 'stdin', 'stdout', and 'stderr'. | | action\_process\_is\_container\_root | BOOLEAN | Linux: True for the process that creates the container. | | action\_process\_container\_info | | | | action\_process\_ns\_pid | INTEGER | The PID of the new process in the relevant Linux namespace. | | action\_process\_ns\_user\_sid | STRING | Linux-only: Effective UID of the executed binary in the relevant Linux namespace. | | action\_process\_ns\_user\_real\_sid | STRING | Linux-only: Real UID of the executed binary in the relevant Linux namespace. | | action\_process\_is\_remote\_session\_root | | | | action\_process\_remote\_session\_port | | | | action\_process\_local\_session\_ip | | | | action\_process\_local\_session\_port | | | | action\_process\_static\_analysis\_score | INTEGER | Static analysis score of executed binary. Scale of 0-1, where 0 is definitely benign, and 1 is definitely malware. | | action\_process\_container\_id | STRING | Linux: The ID of the container in which this process is running. | | action\_process\_user\_real\_sid | STRING | Unix-only: Real UID of the executed binary. | | action\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the PE or part of an external catalog file. | | action\_process\_file\_access\_time | INTEGER | Access time of the file that created the process. | | action\_process\_cwd | STRING | Working directory from which the process was executed. | | action\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64 bit. | | action\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit. | | action\_process\_peb | STRING | Windows: The address of the PEB of the process. | | action\_process\_peb32 | STRING | Windows: The address of the PEB32 of the process. Only non-zero if this is a WOW64 process. | | action\_process\_image\_auth\_sha1 | RECORD | SHA1 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_process\_image\_auth\_sha2 | STRING | SHA256 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_process\_last\_writer\_actor | STRING | Instance ID of the actor that wrote the file for this process. | | action\_process\_script | STRING | When the executable is an interpreter, the script that it is executing. | | action\_process\_script\_device\_info | RECORD | Info about the device (volume + HW) from which this script was executed. | | action\_process\_environment\_variables | MAP | Envrionment variables that were sent on the process execution. | | action\_remote\_process\_file\_info | RECORD | Metadata from the EXE file of the process. | | action\_remote\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. | | action\_remote\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. | | action\_remote\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the PE or part of an external catalog file. | | action\_remote\_process\_is\_special | INTEGER |

Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3

| | action\_remote\_process\_is\_replay | BOOLEAN | Indicates whether or not the agent was alive during the execution of the process. | | action\_remote\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64 bit. | | action\_remote\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit. | | action\_remote\_process\_file\_size | INTEGER | Size of the file of the process in bytes. | | action\_remote\_process\_image\_auth\_sha1 | STRING | SHA1 of the binary's Authenticode, which is the part of a PE used when signing. | | action\_remote\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. | | action\_remote\_process\_last\_writer\_actor | STRING | The instance ID of the last writer that changed the file of the process. | | action\_user\_session\_id | INTEGER | Windows: Session ID of the process. | | action\_mount\_device\_info | RECORD | Info about the device (volume + HW). | | action\_rpc\_func\_exception\_code | INTEGER | If an exception occurred during this remote procedure call (RPC), the exception code is provided. Otherwise, the value is 0. | | action\_rpc\_interface\_name | STRING | Description of the remote procedure call (RPC) interface, taken from the IDL file. | | action\_rpc\_func\_str\_call\_fields | RECORD |

Parameters where the keys are the names of the argument in the function call. The values are the values of the parameters. Values are strings. For instance, if we have a remote procedure call (RPC) to CreateService(ServiceName, ServiceType), we will get something like
{ "ServiceName": "MyServiceName1", "ServiceType": "3"}.

| | action\_rpc\_func\_name | STRING | Function name taken from the IDL file. | | action\_rpc\_func\_int\_call\_fields | RECORD | Same as the field action\_rpc\_func\_str\_call\_fields, but the values are integers. Since the values are in a uint64\_t format, they are still serialized as strings. | | action\_device\_usb\_vendor\_name | | | | action\_device\_usb\_product\_name | | | | action\_device\_usb\_interface\_class | INTEGER | | | action\_device\_usb\_interface\_sub\_class | INTEGER | | | action\_thread\_start\_address | INTEGER | Start address of the thread function, which is serialized as a string as it can be a true 64-bit address. | | action\_thread\_parent\_pid | INTEGER | Windows: Same as the actor info. | | action\_thread\_parent\_tid | INTEGER | Windows: Same as the actor info. | | action\_thread\_parent\_iid | STRING | Windows: Same as the actor info. | | action\_thread\_child\_pid | INTEGER | | | action\_thread\_child\_tid | INTEGER | | | action\_thread\_child\_iid | STRING | | | action\_thread\_stack\_base | STRING | Windows: Base of the stack. | | action\_thread\_stack\_limit | STRING | Windows: Limit of the stack. | | action\_thread\_teb | STRING | Windows: Address of the TEB of the thread. | | action\_process\_handle\_is\_kernel | BOOLEAN | Indicates whether or not a handle is used by the kernel. | | action\_process\_handle\_granted\_access | INTEGER | Access rights that were granted when opening the handle. | | action\_process\_handle\_opened\_process\_pid | INTEGER | PID of the process opened. | | action\_process\_handle\_opened\_process\_iid | STRING | IID of the process opened. | | address\_mapping | RECORD |

symbol\_name: Name of the suspicious function.
image\_path: Path of the image containing the function or image injected to.
index: By default, set to 1. In Syscall events, points to a function parameter number.

| | action\_ns\_flags | INTEGER |

Unshare: Flags raw value.
Setns: nstype raw value.

| | action\_ns\_path | STRING | Setns-only: Path to the namespace file descriptor. | | action\_time\_change\_clock\_diff\_ms | INTEGER | Difference in milliseconds from previous system time. | | action\_trace\_flags | INTEGER | Flags that were sent to the ptrace function. | | action\_trace\_ret | INTEGER | Return value of the ptrace function. | | action\_trace\_request\_id | INTEGER | Request ID of the ptrace function. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/action-actor.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.