> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-action-actor.md).
# DST Action Actor
The DST Action actor is the receiving process for actions performed remotely from one host to another.
| Field Name | Data Type | Description |
| -------------------------------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| dst\_actor\_causality\_id | STRING | Causality ID of the destination actor. |
| dst\_actor\_effective\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| dst\_actor\_effective\_username | STRING | Name assigned to the 'actor\_effective\_user\_sid'. |
| dst\_actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not this destination actor's thread is an injected thread. |
| dst\_actor\_os\_process\_instance\_id | STRING | Cortex XDR/XSIAM unique identifier for the destination operating system's actor process. |
| dst\_actor\_primary\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective unique identifier (UID) of the executed binary.
|
| dst\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| dst\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_actor\_process\_causality\_id | STRING | Causality ID of the destination actor process. |
| dst\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| dst\_actor\_process\_execution\_time | INTEGER | Destination actor process execution time in epoch time. |
| dst\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the destination actor process. |
| dst\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| dst\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| dst\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| dst\_actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| dst\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| dst\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| dst\_actor\_process\_image\_name | STRING | File name of the 'dst\_actor\_process\_image\_path'. |
| dst\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| dst\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| dst\_actor\_process\_instance\_id | STRING | Process instance ID. |
| dst\_actor\_process\_integrity\_level | INTEGER | Process integrity level. |
| dst\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64-bit. |
| dst\_actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32-bit machine the value is always true, and on a 64-bit machine the value is true, if the process is 64-bit. |
| dst\_actor\_process\_is\_replay | BOOLEAN | A boolean value that specifies whether the Agent was alive during the execution of the process. |
| dst\_actor\_process\_is\_special | INTEGER | Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3
|
| dst\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the destination actor process |
| dst\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| dst\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| dst\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| dst\_actor\_process\_signature\_status | INTEGER | Signature status of the process: Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5. Means that MD5 is used as the hash algorithm.
Unsupported = 6. This means signature was not calculated.
InvalidCVE2020\_0601 = 7. This means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601
Deleted = 8. Means that the file was deleted by the time the agent tried to calculate signature.
|
| dst\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| dst\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| dst\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| dst\_actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| dst\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| dst\_actor\_thread\_thread\_id | INTEGER | An identifier of the operating system (OS) thread responsible for the event. |
| dst\_actor\_type | INTEGER | The type of actor: Local = 1. The actor is a local process.
RemoteRpcNamedPipe = 2. The actor is a Remote Procedure Call (RPC) over a named-pipe/SMB connection.
RemoteRpcHttp = 3. The actor is a Remote Procedure Call (RPC) over a remote HTTP connection.
RemoteRpcTcp = 4. The actor is a Remote Procedure Call (RPC) over a TCP connection.
RemoteFileSmb = 5. The actor is a remote file operation over SMB.
|
| dst\_actor\_primary\_normalized\_user | RECORD | A normalized user for the destination actor. |
| dst\_actor\_effective\_normalized\_user | RECORD | A normalized user for the destination actor. |
| dst\_actor\_container\_info | RECORD | Container information for the destination process. |
| dst\_actor\_process\_ns\_pid | | |
| dst\_actor\_ns\_user\_sid | | |
| dst\_actor\_process\_container\_id | STRING | Container ID that is running this destination process. |
| dst\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| dst\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| dst\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| dst\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| dst\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| dst\_actor\_local\_ip | | |
| dst\_actor\_local\_port | | |
| dst\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| dst\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| dst\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the actor process image. |
| dst\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| dst\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| dst\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-action-actor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.