DST Action Actor

The DST Action actor is the receiving process for actions performed remotely from one host to another.

Field Name	Data Type	Description
dst_actor_causality_id	STRING	Causality ID of the destination actor.
dst_actor_effective_user_sid	STRING	Win: Primary user token of the executed binary. Unix: Effective UID of the executed binary.
dst_actor_effective_username	STRING	Name assigned to the 'actor_effective_user_sid'.
dst_actor_is_injected_thread	BOOLEAN	Indicates whether or not this destination actor's thread is an injected thread.
dst_actor_os_process_instance_id	STRING	Cortex XDR/XSIAM unique identifier for the destination operating system's actor process.
dst_actor_primary_user_sid	STRING	Win: Primary user token of the executed binary. Unix: Effective unique identifier (UID) of the executed binary.
dst_actor_primary_username	STRING	Name assigned to the user_sid.
dst_actor_process_auth_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_actor_process_causality_id	STRING	Causality ID of the destination actor process.
dst_actor_process_command_line	STRING	Process command line - The command used to execute the process.
dst_actor_process_command_line_indices	STRING	Process command line - The command used to execute the process.
dst_actor_process_device_info	RECORD	Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number.
dst_actor_process_execution_time	INTEGER	Destination actor process execution time in epoch time.
dst_actor_process_file_access_time	INTEGER	Access time of the file that created the destination actor process.
dst_actor_process_file_create_time	INTEGER	Creation time of the file that created the process.
dst_actor_process_file_mod_time	INTEGER	Modification time of the file that created the process.
dst_actor_process_file_size	INTEGER	Size of the file involved in the process in bytes.
dst_actor_process_image_command_line	STRING	Process command line - The command used to execute the process.
dst_actor_process_image_extension	STRING	Process image extension - File extension.
dst_actor_process_image_md5	STRING	MD5 of the binary.
dst_actor_process_image_name	STRING	File name of the 'dst_actor_process_image_path'.
dst_actor_process_image_path	STRING	Process image path - A string identifying the location of the execution.
dst_actor_process_image_sha256	STRING	SHA256 of the binary.
dst_actor_process_instance_id	STRING	Process instance ID.
dst_actor_process_integrity_level	INTEGER	Process integrity level.
dst_actor_process_is_64bit	BOOLEAN	Indicates whether or not the process is 64-bit.
dst_actor_process_is_native	BOOLEAN	Indicates whether or not this process is a "native process". On a 32-bit machine the value is always true, and on a 64-bit machine the value is true, if the process is 64-bit.
dst_actor_process_is_replay	BOOLEAN	A boolean value that specifies whether the Agent was alive during the execution of the process.
dst_actor_process_is_special	INTEGER	Indicates special system processes: RegularProcess = 0 KernelProcess = 1 AppContainerProcess = 2 NonWin32SubsystemProcess = 3
dst_actor_process_logon_id	STRING	Windows: LUID (uint64) representing the token of the process.
dst_actor_process_os_pid	INTEGER	The Operating System (OS) Process Identifier (PID) of the destination actor process
dst_actor_process_session_id	INTEGER	Windows: Session ID of the process.
dst_actor_process_signature_is_embedded	BOOLEAN	Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file.
dst_actor_process_signature_product	STRING	Signature product - The product family part of the signature.
dst_actor_process_signature_status	INTEGER	Signature status of the process: Signed = 1 SignedInvalid = 2 Unsigned = 3 FailedToObtain = 4 WeakHash = 5. Means that MD5 is used as the hash algorithm. Unsupported = 6. This means signature was not calculated. InvalidCVE2020_0601 = 7. This means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601 Deleted = 8. Means that the file was deleted by the time the agent tried to calculate signature.
dst_actor_process_signature_vendor	STRING	Signature vendor - The vendor part of the signature.
dst_actor_remote_host	STRING	Relevant when the actor is a remote actor and the host was resolved successfully.
dst_actor_remote_ip	STRING	Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully.
dst_actor_remote_pipe_name	STRING	Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe.
dst_actor_remote_port	INTEGER	Relevant when the actor is a remote actor, where the type is RemoteRpcTcp.
dst_actor_thread_thread_id	INTEGER	An identifier of the operating system (OS) thread responsible for the event.
dst_actor_type	INTEGER	The type of actor: Local = 1. The actor is a local process. RemoteRpcNamedPipe = 2. The actor is a Remote Procedure Call (RPC) over a named-pipe/SMB connection. RemoteRpcHttp = 3. The actor is a Remote Procedure Call (RPC) over a remote HTTP connection. RemoteRpcTcp = 4. The actor is a Remote Procedure Call (RPC) over a TCP connection. RemoteFileSmb = 5. The actor is a remote file operation over SMB.
dst_actor_primary_normalized_user	RECORD	A normalized user for the destination actor.
dst_actor_effective_normalized_user	RECORD	A normalized user for the destination actor.
dst_actor_container_info	RECORD	Container information for the destination process.
dst_actor_process_ns_pid
dst_actor_ns_user_sid
dst_actor_process_container_id	STRING	Container ID that is running this destination process.
dst_actor_rpc_interface_uuid	STRING	MS-RPC interface unique identifier.
dst_actor_rpc_func_opnum	INTEGER	MS-RPC function operation identitifer.
dst_actor_rpc_interface_version_major	INTEGER	MS-RPC interface major version.
dst_actor_rpc_interface_version_minor	INTEGER	MS-RPC interface minor version.
dst_actor_rpc_protocol	STRING	MS-RPC protocol type.
dst_actor_local_ip
dst_actor_local_port
dst_actor_process_image_auth_sha2	STRING	Process image SHA-2 authenticode.
dst_actor_process_image_auth_sha1	STRING	Process image SHA-1 authenticode.
dst_actor_process_last_writer_actor	STRING	Cortex instance ID of the last process that has written the actor process image.
dst_actor_process_static_analysis_score	DEPRECATED
dst_actor_process_file_original_name	STRING	Original file name of the casuality actor image based on the file information metadata.
dst_actor_process_file_internal_name	STRING	Internal name of the casuality actor image based on the file information metadata.