> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-causality-actor.md).
# DST Causality Actor
The DST Causality actor is the process identified by the operation system on the remote host as the process that performed an action that was responsible for the entire chain of execution.
| Field Name | Data Type | Description |
| ------------------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| dst\_causality\_actor\_causality\_id | STRING | Causality chain identifier. |
| dst\_causality\_actor\_effective\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| dst\_causality\_actor\_effective\_username | STRING | Source effective username. |
| dst\_causality\_actor\_primary\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| dst\_causality\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| dst\_causality\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_causality\_actor\_process\_causality\_id | STRING | Process causality chain identifier |
| dst\_causality\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| dst\_causality\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| dst\_causality\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| dst\_causality\_actor\_process\_execution\_time | INTEGER | Process execution time. |
| dst\_causality\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the process. |
| dst\_causality\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| dst\_causality\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| dst\_causality\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| dst\_causality\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| dst\_causality\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| dst\_causality\_actor\_process\_image\_name | STRING | Process image name. |
| dst\_causality\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| dst\_causality\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| dst\_causality\_actor\_process\_instance\_id | STRING | Process instance identifier. |
| dst\_causality\_actor\_process\_integrity\_level | INTEGER | Process integrity level. |
| dst\_causality\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is 64-bit. |
| dst\_causality\_actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32-bit machine, the value is always true, and on 64-bit machine, the value is true, if the process is 64-bit. |
| dst\_causality\_actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the agent is alive during the execution of the process. |
| dst\_causality\_actor\_process\_is\_special | INTEGER | Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3
|
| dst\_causality\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| dst\_causality\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the destination causality actor process |
| dst\_causality\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| dst\_causality\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| dst\_causality\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| dst\_causality\_actor\_process\_signature\_status | INTEGER | Process Signature Status: Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, which means that MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means the file was deleted by the time the agent tried to calculate the signature.
|
| dst\_causality\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| dst\_causality\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| dst\_causality\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| dst\_causality\_actor\_remote\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcNamedPipe. |
| dst\_causality\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| dst\_causality\_actor\_remote\_port\_pipe\_name | STRING | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| dst\_causality\_actor\_session\_id | INTEGER | Session ID of the actor process. |
| dst\_causality\_actor\_type | INTEGER | Type of Causality Actor: Local = 1. The actor is a local process.
RemoteRpcNamedPipe = 2. The actor is a remote procedure call (RPC) over a named-pipe/SMB connection.
RemoteRpcHttp = 3. The actor is a remote procedure call (RPC) over a remote HTTP connection.
RemoteRpcTcp = 4. The actor is a remote procedure call (RPC) over a TCP connection.
RemoteFileSmb = 5. The actor is a remote file operation over a SMB.
|
| dst\_causality\_actor\_container\_info | RECORD | Container information for the process. |
| dst\_causality\_actor\_process\_ns\_pid | | |
| dst\_causality\_actor\_ns\_user\_sid | | |
| dst\_causality\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| dst\_causality\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| dst\_causality\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| dst\_causality\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| dst\_causality\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| dst\_causality\_actor\_local\_ip | | |
| dst\_causality\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the causality actor process image. |
| dst\_causality\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| dst\_causality\_actor\_local\_port | | |
| dst\_causality\_actor\_process\_container\_id | | |
| dst\_causality\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-2 authenticode. |
| dst\_causality\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-1 authenticode. |
| dst\_causality\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| dst\_causality\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/dst-causality-actor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.