Action Actor

The Action actor is an activity that took place and was recorded by the agent.

Field Name	Data Type	Description
action_app_id_transitions	STRING	List of application ID transitions.
action_boot_instance_cleanup_required	BOOLEAN	Indicates whether or not the agent can clean up open instances from a previous computer restart.
action_boot_time	INTEGER	Computer boot time in ms since epoch time.
action_country	STRING	The destination country of network connections, which is based on the remote IP and GeoLocation enrichment.
action_device_bus_type	INTEGER	For the action, the origin of the device bus type (USB).
action_device_class_guid	STRING	Device setup class GUID.
action_device_class_name	STRING	Device setup class internal friendly name.
action_device_usb_port_connectable	BOOLEAN	Indicates whether or not a user can connect to the USB port that the device is connected to.
action_device_usb_product_id	INTEGER	USB device product ID.
action_device_usb_serial_number	STRING	USB device serial number.
action_device_usb_vendor_id	INTEGER	USB vendor ID.
action_download	INTEGER	Number of downloaded bytes in the last window of time.
action_evtlog_data_fields	STRING	Event log data fields in a JSON array.
action_evtlog_description	STRING	Event log description.
action_evtlog_event_id	INTEGER	Event log event ID.
action_evtlog_level	INTEGER	Event log severity level.
action_evtlog_message	STRING	Event log message field - summary of the event.
action_evtlog_opcode	INTEGER	Event provider specific information, usually similar to "action_evtlog_level".
action_evtlog_pid	INTEGER	Process ID given in the event-log event.
action_evtlog_provider_guid	STRING	Provider GUID
action_evtlog_provider_name	STRING	Windows: Provider name, such as Service Control Manager. Linux: The file from which this event originated.
action_evtlog_raw_params	STRING
action_evtlog_record_id	STRING	Unique ID of this event-log record in the computer's event-log.
action_evtlog_source	INTEGER	Method used to get the event log.
action_evtlog_tid	INTEGER	Thread ID given in the event-log event.
action_evtlog_uid	STRING	User ID given in the event-log event.
action_evtlog_username	STRING	User ID translation of username.
action_evtlog_version	INTEGER	Version of the event log record (private to provider/channel).
action_external_hostname	STRING	The hostname the endpoint connects to. When there is a proxy connection, this value will differ from action_remote_ip.
action_external_port	INTEGER	The external port of the initiated communication. When there is a proxy connection, this value can differ from action_remote_port.
action_file_access_time	INTEGER	The action file access timestamp.
action_file_archive_list	RECORD	Only valid if the file is a ZIP file and the event collection is enabled in the policy.
action_file_attributes	INTEGER	Windows: Bitmask of FILE_ATTRIBUTE_* attributes, which is only relevant for some subtypes. Unix: Always 'null'.
action_file_authenticode_sha1	STRING	SHA-1 (Secure Hash Algorithm 1) of the file signature authenticode.
action_file_authenticode_sha2	STRING	SHA-2 (Secure Hash Algorithm 2) of the file signature authenticode.
action_file_create_time	INTEGER	The action file create timestamp.
action_file_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_device_type	INTEGER	Windows: An enum representing the device type for this file. Regular file = 0 Named pipe = 1
action_file_dir_query	STRING	The query string given to the "query directory" operation.
action_file_dirty_reason	INTEGER	Only valid for sub_type = 6 (write) when a non-null file_size is provided. Indicates the reason this "final" write was issued and why the file hash was recalculated.
action_file_entropy	STRING
action_file_extension	STRING	File extension of action_file_path.
action_file_group	STRING	Linux & MacOS: The new group of the file (user_id).
action_file_group_name	STRING	Name assigned to action_file_group (username).
action_file_hash_control_verdict	STRING	DEPRECATED
action_file_id	STRING	DEPRECATED
action_file_info_company	STRING	Company listed in the file information section of the file.
action_file_info_description	STRING	Description listed in the file information section of the file.
action_file_info_file_version	STRING	File version listed in the file information section of the file.
action_file_info_product_name	STRING	Product name listed in the file information section of the file.
action_file_info_product_version	STRING	Production version listed in the file information section of the file.
action_file_internal_meta_data	STRING	DEPRECATED
action_file_internal_zipped_files	STRING	DEPRECATED
action_file_md5	STRING	The action file hash value in MD5.
action_file_mod_time	INTEGER	The action file modification timestamp.
action_file_mode	RECORD	A representation of the standard UNIX file permissions mask.
action_file_name	STRING	The file name of action_file_path, which is an empty string for directory operations.
action_file_new_file_for_loaded_dll	STRING	DEPRECATED
action_file_original_event_id	STRING	DEPRECATED
action_file_owner	STRING	The new owner of the file according to the user_id.
action_file_owner_name	STRING	The new owner of the file according to the username.
action_file_path	STRING	The path of the file in use.
action_file_prev_type	INTEGER	Before the current write, the previous file type, which is based only on the content of the file. This information can be used to detect header changes. Will be valid ONLY on the file_write event that changes the file type. Windows only
action_file_previous_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_file_previous_file_extension	STRING	File extension of 'action_file_previous_file_path'.
action_file_previous_file_name	STRING	File name of 'action_file_previous_file_path', which is an empty string for directory operations.
action_file_previous_file_path	STRING	The previous path of the file in use.
action_file_remote_file_host	STRING	This is valid when Cortex XDR/XSIAM accesses a file on a remote computer. This means Cortex XDR/XSIAM is the client.
action_file_remote_file_ip	STRING	This is valid when a remote computer accesses a file on this endpoint. This means Cortex XDR/XSIAM is the client. The remote IP can also be a loopback (127.0.0.1 or ::1).
action_file_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_file_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_file_reparse_path	STRING	Only valid for sub_type = 1/2 (create_new/open). Provides the reparse path if the file was opened through a reparse point.
action_file_sec_desc	STRING	Windows: Security descriptor of the file in SDDL.
action_file_sha256	STRING	SHA256 of the binary.
action_file_signature_product	STRING	Signature product - The product family part of the signature.
action_file_signature_status	INTEGER	The signature status of the file in use.
action_file_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_file_size	INTEGER	Size of the file undergoing the process in bytes.
action_file_suspicious_strings_bitmap	INTEGER	Bitmap of suspicious strings found in file content.
action_file_type	INTEGER	Partial file type recognizer.
action_file_type_changedaction_file_id	INTEGER	DEPRECATED
action_file_type_prev	INTEGER
action_file_wildfire_verdict	STRING	DEPRECATED
action_firewall_direction	STRING	Outbound (1) Inbound (2)
action_firewall_local_ip	STRING	The local IP address in the communication.
action_firewall_local_port	INTEGER	The local port in the communication.
action_firewall_protocol	INTEGER	The IP protocol number as specified in RFC 1700.
action_firewall_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_firewall_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_firewall_rule_guid	STRING
action_is_dll_injection	BOOLEAN	Indicates whether or not the action is a DLL Injection.
action_is_injected_thread	BOOLEAN	Indicates whether or not the action was performed by an injected thread.
action_local_ip	STRING	Source IP address.
action_local_ip_int	INTEGER	Source IP in integer format.
action_module_base_address	STRING	The base address where the library was loaded.
action_module_device_info	RECORD	Info about the device (volume + HW) including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_module_file_access_time	INTEGER	Program Executable (PE) metadata collection from the image itself
action_module_file_create_time	INTEGER	Program Executable (PE) metadata collection from the image itself
action_module_file_info	STRING	Program Executable (PE) metadata collection from the image itself
action_module_file_mod_time	INTEGER	Modified time of the file in the module.
action_module_file_size	INTEGER	Size of the file of the process in bytes.
action_module_image_size	INTEGER	Size of the file in virtual memory.
action_module_is_remote	BOOLEAN	Indicates whether or not the module is loaded from a remote process.
action_module_is_replay	BOOLEAN	All existing loaded images are replayed, when the agent starts. This is set to true for images loaded when the agent is not started yet.
action_module_md5	STRING	The module md5 value.
action_module_other_load_location	STRING	This module was already loaded before from a different location. This is the other location.
action_module_path	STRING	The path of the module in use.
action_module_process_instance_id	STRING	Cortex instance ID of the process loading the module.
action_module_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the loaded module.
action_module_sha256	STRING	SHA256 of the binary.
action_module_signature_product	STRING	Signature product - The product family part of the signature.
action_module_signature_status	INTEGER	The signature status of the module in action.
action_module_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_network_connection_id	STRING	The ID of the network connection.
action_network_creation_time	INTEGER	The start time of the network session.
action_network_http	STRING	HTTP headers
action_network_is_ipv6	BOOLEAN	Indicates whether or not action_remote_ip is an IPv6 endpoint.
action_network_is_npcap	BOOLEAN	Indicates whether or not this action is an npcap event.
action_network_is_server	BOOLEAN	True for incoming connections. False for outgoing ones.
action_network_packet_data	STRING	The data is converted to hexadecimal. Each byte is converted to 2 characters representing the character value of the byte.
action_network_protocol	INTEGER	Internet protocol number based on IPPROTO or normalized to IPPROTO (same as Java).
action_network_stats_is_last	BOOLEAN	True, if the connection was terminated, and false otherwise.
action_network_stats_seq	INTEGER	Sequence number of the statistics "packet".
action_network_success	BOOLEAN	Indicates whether or not the session was successful.
action_pkts_received	INTEGER	Total number of packets received so far from the destination to the source.
action_pkts_sent	INTEGER	Total number of packets sent so far from the source to the destination.
action_powered_off	BOOLEAN	True, if the computer is powered off, such as suspended or hibernated, and false otherwise.
action_process_causality_id	STRING	Causality ID of the terminated process.
action_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
action_process_file_create_time	INTEGER	Creation time of the file that created the process.
action_process_file_info	STRING	Metadata from the exe file of the process.
action_process_file_mod_time	INTEGER	Modification time of the file that created the process.
action_process_file_size	INTEGER	Size of the file involved in the process in bytes.
action_process_image_command_line	STRING	Process command line - The command used to execute the process.
action_process_image_command_line_indices	STRING	Process command line - The command used to execute the process.
action_process_image_extension	STRING	Process image extension - File extension
action_process_image_md5	STRING	MD5 of the binary.
action_process_image_name	STRING	File name of the 'action_process_image_path'.
action_process_image_path	STRING	Process image path - A string identifying the location of the process execution.
action_process_image_sha256	STRING	SHA256 of the binary.
action_process_instance_execution_time	INTEGER	Instance execution time.
action_process_instance_id	STRING	Cortex instance ID of the process.
action_process_integrity_level	INTEGER	Integrity level of the process created.
action_process_is_causality_root	BOOLEAN	Indicates whether or not the created process is a new causality root process.
action_process_is_replay	BOOLEAN	Windows: The following events are replayed: Processes started before the agent is started. Module load events for modules loaded in replayed processes. Drivers loaded using module load before the agent is started. For loaded drivers, the process is always a special KernelProcess.
action_process_is_special	INTEGER	Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3
action_process_is_txn
action_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the new process
action_process_remote_session_ip	STRING	Windows: When the process was started from a remote Terminal Services session, the IP address of the remote client connected to the session.
action_process_requested_parent_iid	STRING	Windows: Same as the "action_process_requested_parent_pid", but the instance ID.
action_process_requested_parent_pid	INTEGER	Windows: A parent process can request to set the parent-pid of the child process to something other than their own. This is used for a "runas" scenario where the os_actor is different from the actor. Yet, it can also be used by malware to fake the parent pid. This field gives the requested parent pid, while giving the true actor/os_actor for the operation.
action_process_signature_product	STRING	Signature product - The product family part of the signature.
action_process_signature_status	INTEGER	Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.
action_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_process_termination_code	INTEGER	Process exit code.
action_process_termination_date	INTEGER	Instance termination time.
action_process_user_sid	STRING	Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.
action_process_username	STRING	Name assigned to the 'action_process_user_sid'.
action_protocol	INTEGER	IP protocol of the network event.
action_proxy	BOOLEAN	Indicates whether or not Cortex XDR/XSIAM performed an HTTP proxy resolution to get these fields: action_external_hostname, action_external_port. If true, the hostname/port fields are taken from the HTTP packet data. Otherwise, they are taken from other protocols like DNS.
action_registry_data	STRING	Registry data being written to the specific key.
action_registry_file_path	STRING	Four operations: Load Save Restore Unload
action_registry_key_name	STRING	Registry key name being accessed.
action_registry_old_data	STRING	Registry data being replaced by a new value.
action_registry_old_key_name	STRING	Old registry key name that is being renamed.
action_registry_return_val	INTEGER	Return value from the registry operation.
action_registry_value_name	STRING	Registry value name being accessed.
action_registry_value_type	INTEGER	Regular types: REG_SZ (1) REG_EXPAND_SZ (2) REG_BINARY (3) REG_DWORD (4) REG_DWORD_BIG_ENDIAN (5) REG_LINK (6) REG_MULTI_SZ (7) REG_RESOURCE_LIST (8) REG_FULL_RESOURCE_DESCRIPTOR (9) REG_RESOURCE_REQUIREMENTS_LIST (10) REG_QWORD (11)
action_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_ip_int	INTEGER	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
action_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
action_remote_process_causality_id	STRING	Causality ID of the remote injected process.
action_remote_process_file_access_time	INTEGER	Access time of the file that created the process.
action_remote_process_image_command_line	STRING	Process command line - The command used to execute the process.
action_remote_process_image_extension	STRING	Process image extension - File extension.
action_remote_process_image_md5	STRING	MD5 of the binary.
action_remote_process_image_name	STRING	Image name of the remote injected process.
action_remote_process_image_path	STRING	Process image path - A string identifying the location of the execution.
action_remote_process_image_sha256	STRING	SHA256 of the binary.
action_remote_process_instance_id	STRING	Instance ID of the remote injected process.
action_remote_process_integrity_level	INTEGER	Integrity level of the remote injected process.
action_remote_process_is_causality_root	BOOLEAN	Indicates whether or not the remote process being injected into is a causality root.
action_remote_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the remote process
action_remote_process_signature_product	STRING	Signature product - The product family part of the signature.
action_remote_process_signature_status	INTEGER	Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5, where the MD5 is used as the hash algorithm. Unsupported = 6, which means the signature was not calculated. InvalidCVE2020_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601. Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.
action_remote_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
action_remote_process_thread_id	INTEGER	Target thread of remote execution.
action_remote_process_thread_start_address	STRING	Memory address of the thread being injected into a remote process.
action_remote_process_user_sid	STRING	Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.
action_remote_process_username	STRING	Name assigned to the action_process_user_sid field.
action_rpc_func_opnum	INTEGER	Integer identifying the function called.
action_rpc_interface_uuid	STRING	Universally Unique IDentifier (UUID) identifying the interface. An interface is only uniquely identified by the UUID + Major version + Minor version.
action_rpc_interface_version_major	INTEGER	Major version of the Remote Procedure Call (RPC) interface.
action_rpc_interface_version_minor	INTEGER	Minor version of the Remote Procedure Call (RPC) interface.
action_session_duration	INTEGER	Number of milliseconds (ms) since the session started.
action_syscall_etw_based	BOOLEAN	Indicates whether or not the system call based on Event Tracing for Windows (ETW) or on native hooking.
action_syscall_int_params	STRING	Action parameters where the value is an integer in the system call invocation.
action_syscall_stack_ptr	STRING	Stack pointer creating the captured syscall.
action_syscall_string_params	STRING	Action parameters where the value is a string in the system call invocation.
action_syscall_target_image_name	STRING	Base image name of the target process, such as lsass.exe.
action_syscall_target_image_path	STRING	Process image path - A string identifying the location of the execution.
action_syscall_target_instance_id	STRING	Instance ID of the target process, when one exists.
action_syscall_target_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the syscall target process
action_syscall_target_thread_id	INTEGER	Target thread ID of the captured syscall.
action_thread_thread_id	INTEGER	Thread ID creating the captured syscall.
action_total_download	INTEGER	Total number of payload bytes from the destination to the source so far.
action_total_upload	INTEGER	Total number of payload bytes from the source to the destination so far.
action_upload	INTEGER	Number of uploaded bytes in the last time window.
action_user_agent	STRING	The user agent used by an actor to perform an action.
action_user_is_local_session	BOOLEAN	Indicates whether or not the user log in from a remote computer or locally.
action_user_status	INTEGER	Agent user status change event. Enum mapping: 1 - logon 2 - logoff 3 - locked / screen saver on 4 - unlocked / screen saver off 5 - Reconnect 6 - Disconnect
action_user_status_sid	STRING	Security identifier (SID) of the user.
action_username	STRING	Name of the user.
action_local_nat_port	INTEGER	Source NAT port.
action_remote_nat_port	INTEGER	Destination NAT port.
action_local_nat_ip	STRING	Source NAT IP address.
action_remote_nat_ip	STRING	Destination NAT IP address.
action_nat	BOOLEAN	Indicates whether or not the connection is NAT.
action_rpc_items	RECORD	EAL remote procedure call (RPC) data items.
action_category_of_app_id	STRING	App-ID category.
action_sub_category_of_app_id	STRING	App-ID sub category.
action_app_id_risk	INTEGER	App-ID risk
action_location	RECORD	Geolocation information of the source IP.
action_as_data	RECORD	ASN data from the source of the network activity.
action_evtlog_normalized_user	RECORD	A normalized user for the event log event.
action_direction_confidence	INTEGER
action_evtlog_int_fields	RECORD
action_file_pe_info	RECORD	Only valid according to collection policy. Usually, enabled on some write-file events. The field is not aptly named since it sometimes contains info on non-PE files as well.
action_file_last_writer_actor	STRING	Instance ID of the actor that wrote the file.
action_file_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_file_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_file_reparse_count	INTEGER	Only valid for sub_type = 1/2 (create_new/open), which provides the reparse count if the file was open through a reparse point.
action_file_pipe_impersonation_integrity_level	INTEGER	When the event type is impersonate_pipe, this field contains the integrity level of the token that is used for the impersonation.
action_file_operation_flags	INTEGER	The specified flags for the file operation.
action_file_is_anonymous	BOOLEAN	Indicates whether or not the file was created without an accesible path from the filesystem (open(..., O_TMPFILE), memfd_create).
action_module_last_writer_actor	STRING	Instance ID of the actor that wrote the file for the module.
action_module_code_integrity	INTEGER	The value of ci!g_CiOptions when the driver is loaded.
action_module_boot_code_integrity	INTEGER	The value of ci!g_CiOptions at boot time.
action_module_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_module_system_properties	INTEGER	Addition properties of the DLL.
action_module_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_module_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_local_port	INTEGER	Source port
action_network_icmp_data	RECORD	Only valid for event_sub_type = 18. ICMP packet data.
action_network_creation_time_original	INTEGER
action_network_is_loopback	BOOLEAN	Valid for stream_connect, datagram_connect, raw_data, outbound_icmp and stream_statistics. Indicates whether or not both sides of a connection are on the same host. Always false for mac and linux.
action_socket_type	INTEGER	0 : Unknown type 1 : Stream 2 : Datagram 3 : Raw
action_process_pe_load_info	RECORD	Windows: Information about the loaded PE image.
action_process_token	RECORD	Security context of the process.
action_process_privileges	INTEGER	String representing a 64-bit integer. These are the enabled special privileges that the process is running with.
action_process_fds	RECORD	Unix: FD information about 'stdin', 'stdout', and 'stderr'.
action_process_is_container_root	BOOLEAN	Linux: True for the process that creates the container.
action_process_container_info
action_process_ns_pid	INTEGER	The PID of the new process in the relevant Linux namespace.
action_process_ns_user_sid	STRING	Linux-only: Effective UID of the executed binary in the relevant Linux namespace.
action_process_ns_user_real_sid	STRING	Linux-only: Real UID of the executed binary in the relevant Linux namespace.
action_process_is_remote_session_root
action_process_remote_session_port
action_process_local_session_ip
action_process_local_session_port
action_process_static_analysis_score	INTEGER	Static analysis score of executed binary. Scale of 0-1, where 0 is definitely benign, and 1 is definitely malware.
action_process_container_id	STRING	Linux: The ID of the container in which this process is running.
action_process_user_real_sid	STRING	Unix-only: Real UID of the executed binary.
action_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_process_file_access_time	INTEGER	Access time of the file that created the process.
action_process_cwd	STRING	Working directory from which the process was executed.
action_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64 bit.
action_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_process_peb	STRING	Windows: The address of the PEB of the process.
action_process_peb32	STRING	Windows: The address of the PEB32 of the process. Only non-zero if this is a WOW64 process.
action_process_image_auth_sha1	RECORD	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_image_auth_sha2	STRING	SHA256 of the binary's Authenticode, which is the part of a PE used when signing.
action_process_last_writer_actor	STRING	Instance ID of the actor that wrote the file for this process.
action_process_script	STRING	When the executable is an interpreter, the script that it is executing.
action_process_script_device_info	RECORD	Info about the device (volume + HW) from which this script was executed.
action_process_environment_variables	MAP	Envrionment variables that were sent on the process execution.
action_remote_process_file_info	RECORD	Metadata from the EXE file of the process.
action_remote_process_file_create_time	INTEGER	Creation time of the file that created the process.
action_remote_process_file_mod_time	INTEGER	Modification time of the file that created the process.
action_remote_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the PE or part of an external catalog file.
action_remote_process_is_special	INTEGER	Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3
action_remote_process_is_replay	BOOLEAN	Indicates whether or not the agent was alive during the execution of the process.
action_remote_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64 bit.
action_remote_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on a 64-bit machine, the value is true when the process is 64-bit.
action_remote_process_file_size	INTEGER	Size of the file of the process in bytes.
action_remote_process_image_auth_sha1	STRING	SHA1 of the binary's Authenticode, which is the part of a PE used when signing.
action_remote_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
action_remote_process_last_writer_actor	STRING	The instance ID of the last writer that changed the file of the process.
action_user_session_id	INTEGER	Windows: Session ID of the process.
action_mount_device_info	RECORD	Info about the device (volume + HW).
action_rpc_func_exception_code	INTEGER	If an exception occurred during this remote procedure call (RPC), the exception code is provided. Otherwise, the value is 0.
action_rpc_interface_name	STRING	Description of the remote procedure call (RPC) interface, taken from the IDL file.
action_rpc_func_str_call_fields	RECORD	Parameters where the keys are the names of the argument in the function call. The values are the values of the parameters. Values are strings. For instance, if we have a remote procedure call (RPC) to CreateService(ServiceName, ServiceType), we will get something like { "ServiceName": "MyServiceName1", "ServiceType": "3"}.
action_rpc_func_name	STRING	Function name taken from the IDL file.
action_rpc_func_int_call_fields	RECORD	Same as the field action_rpc_func_str_call_fields, but the values are integers. Since the values are in a uint64_t format, they are still serialized as strings.
action_device_usb_vendor_name
action_device_usb_product_name
action_device_usb_interface_class	INTEGER
action_device_usb_interface_sub_class	INTEGER
action_thread_start_address	INTEGER	Start address of the thread function, which is serialized as a string as it can be a true 64-bit address.
action_thread_parent_pid	INTEGER	Windows: Same as the actor info.
action_thread_parent_tid	INTEGER	Windows: Same as the actor info.
action_thread_parent_iid	STRING	Windows: Same as the actor info.
action_thread_child_pid	INTEGER
action_thread_child_tid	INTEGER
action_thread_child_iid	STRING
action_thread_stack_base	STRING	Windows: Base of the stack.
action_thread_stack_limit	STRING	Windows: Limit of the stack.
action_thread_teb	STRING	Windows: Address of the TEB of the thread.
action_process_handle_is_kernel	BOOLEAN	Indicates whether or not a handle is used by the kernel.
action_process_handle_granted_access	INTEGER	Access rights that were granted when opening the handle.
action_process_handle_opened_process_pid	INTEGER	PID of the process opened.
action_process_handle_opened_process_iid	STRING	IID of the process opened.
address_mapping	RECORD	symbol_name: Name of the suspicious function. image_path: Path of the image containing the function or image injected to. index: By default, set to 1. In Syscall events, points to a function parameter number.
action_ns_flags	INTEGER	Unshare: Flags raw value. Setns: nstype raw value.
action_ns_path	STRING	Setns-only: Path to the namespace file descriptor.
action_time_change_clock_diff_ms	INTEGER	Difference in milliseconds from previous system time.
action_trace_flags	INTEGER	Flags that were sent to the ptrace function.
action_trace_ret	INTEGER	Return value of the ptrace function.
action_trace_request_id	INTEGER	Request ID of the ptrace function.