> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/causality-actor.md).
# Causality Actor
The Causality actor—also referred to as the causality group owner (CGO)—is the parent process in the execution chain that the Cortex XDR/XSIAM agent identified as being responsible for initiating the process tree.
| Field Name | Data Type | Description |
| -------------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| causality\_actor\_causality\_id | STRING | Causality ID of the causality actor. |
| causality\_actor\_effective\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| causality\_actor\_effective\_username | STRING | Source effective username. |
| causality\_actor\_primary\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| causality\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| causality\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| causality\_actor\_process\_causality\_id | STRING | Causality ID of the causality actor process. |
| causality\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| causality\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| causality\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| causality\_actor\_process\_execution\_time | INTEGER | Causality actor process execution time in epoch time. |
| causality\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the process. |
| causality\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| causality\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| causality\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| causality\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| causality\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| causality\_actor\_process\_image\_name | STRING | File name of the 'causality\_actor\_process\_image\_path'. |
| causality\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| causality\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| causality\_actor\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the causality actor process. |
| causality\_actor\_process\_integrity\_level | INTEGER | Process integrity level. |
| causality\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64-bit. |
| causality\_actor\_process\_is\_native | BOOLEAN | Indicates whether this process is a "native process". On a 32-bit machine the value is always true; on a 64-bit machine, it is true, if the process is a 64-bit process. |
| causality\_actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the Agent was alive during the execution of the process. |
| causality\_actor\_process\_is\_special | INTEGER | Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3
|
| causality\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| causality\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the causality actor process |
| causality\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| causality\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| causality\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| causality\_actor\_process\_signature\_status | INTEGER | Signature status of the process: Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, which means that MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.
|
| causality\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| causality\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| causality\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| causality\_actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| causality\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| causality\_actor\_remote\_port\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| causality\_actor\_session\_id | INTEGER | Sesion ID |
| causality\_actor\_type | INTEGER | Local = 1. The actor is a local process
RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection.
RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection.
RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection.
RemoteFileSmb = 5. The actor is a remote file operation over SMB.
|
| causality\_actor\_primary\_normalized\_user | RECORD | Normalized user information. |
| causality\_actor\_container\_info | RECORD | The container information for the process. |
| causality\_actor\_process\_ns\_pid | | |
| causality\_actor\_ns\_user\_sid | | |
| causality\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| causality\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| causality\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| causality\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| causality\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| causality\_actor\_local\_ip | | |
| causality\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the causality actor process image. |
| causality\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| causality\_actor\_local\_port | | |
| causality\_actor\_process\_container\_id | | |
| causality\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-2 authenticode. |
| causality\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-1 authenticode. |
| causality\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| causality\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/causality-actor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.