> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/actor-actor.md).
# Actor Actor
The Actor actor is the process that performed the action.
| Field Name | Data Type | Description |
| --------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| actor\_causality\_id | STRING | Will match 'causality\_actor\_causality\_id' in the causality owner actor fields. |
| actor\_effective\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| actor\_effective\_username | STRING | Name assigned to 'actor\_effective\_user\_sid'.
Win: Includes the domain.
|
| actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not a user can connect to the USB port that the device is connected to. |
| actor\_os\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the operating system's actor process. |
| actor\_primary\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| actor\_process\_causality\_id | STRING | Cortex XDR/XSIAM unique causality ID for the actor casuality chain. |
| actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| actor\_process\_execution\_time | INTEGER | Timestamp of the execution in epoch time. |
| actor\_process\_file\_access\_time | INTEGER | Creation time of the file that created the actor process. |
| actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| actor\_process\_image\_name | STRING | File name of the actor\_process\_image\_path. |
| actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| actor\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier of the actor process. |
| actor\_process\_integrity\_level | INTEGER | Integrity level of the process. |
| actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is a 64-bit process. |
| actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process a "native process". |
| actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the agent was alive during the execution of the process. |
| actor\_process\_is\_special | INTEGER | Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3
|
| actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the actor process. |
| actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature embedded inside the Program Executable (PE) or part of an external catalog file. |
| actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| actor\_process\_signature\_status | INTEGER | Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.
|
| actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| actor\_thread\_thread\_id | INTEGER | An identifier of the OS thread which is responsible for the event. |
| actor\_type | INTEGER | Enum describing actor type:
Local = 1, where the actor is a local process.
RemoteRpcNamedPipe = 2, where the actor is a remote procedure call (RPC) over a named-pipe/SMB connection.
RemoteRpcHttp = 3, where the actor is a remote procedure call (RPC) over a remote HTTP connection.
RemoteRpcTcp = 4, where the actor is a remote procedure call (RPC) over a TCP connection.
RemoteFileSmb = 5, where the actor is a remote file operation over SMB.
|
| actor\_primary\_normalized\_user | RECORD | A normalized user for the actor. |
| actor\_effective\_normalized\_user | RECORD | Normalized user information. |
| actor\_container\_info | RECORD | Container information for the process. |
| actor\_process\_ns\_pid | | |
| actor\_ns\_user\_sid | | |
| actor\_process\_container\_id | | |
| actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| actor\_local\_ip | STRING | Source IP of the network activity. |
| actor\_local\_port | INTEGER | Source port for the network activity |
| actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the actor process image. |
| actor\_process\_static\_analysis\_score | DEPRECATED | |
| actor\_process\_file\_original\_name | STRING | Original file name of the actor image based on the file information metadata. |
| actor\_process\_file\_internal\_name | STRING | Internal name of the actor image based on the file information metadata. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/actor-actor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.