> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/os-actor.md).
# OS Actor
The OS actor is the process identified by the operation system as the process that performed the action.
| Field Name | Data Type | Description |
| ------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| os\_actor\_causality\_id | STRING | the causality chain identifier of the Operating System actor |
| os\_actor\_effective\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| os\_actor\_effective\_username | STRING | the username which launched the Operating System actor process |
| os\_actor\_is\_injected\_thread | BOOLEAN | Indicates whether or not the thread is injected to the operating system actor process. |
| os\_actor\_primary\_user\_sid | STRING | Win: Primary user token of the executed binary.
Unix: Effective UID of the executed binary.
|
| os\_actor\_primary\_username | STRING | Name assigned to the user\_sid. |
| os\_actor\_process\_auth\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| os\_actor\_process\_causality\_id | STRING | the causality chain identifier of the Operating System actor process |
| os\_actor\_process\_command\_line | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_command\_line\_indices | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_device\_info | RECORD | Info about the device (volume + HW) from which this process started. including name, class guid, class name, bus type, volume guid, mount point, file system, drive type, vendor id, product id, and serial number. |
| os\_actor\_process\_execution\_time | INTEGER | the execution timestamp |
| os\_actor\_process\_file\_access\_time | INTEGER | Access time of the file that created the process |
| os\_actor\_process\_file\_create\_time | INTEGER | Creation time of the file that created the process. |
| os\_actor\_process\_file\_mod\_time | INTEGER | Modification time of the file that created the process. |
| os\_actor\_process\_file\_size | INTEGER | Size of the file involved in the process in bytes. |
| os\_actor\_process\_image\_command\_line | STRING | Process command line - The command used to execute the process. |
| os\_actor\_process\_image\_extension | STRING | Process image extension - File extension. |
| os\_actor\_process\_image\_md5 | STRING | MD5 of the binary. |
| os\_actor\_process\_image\_name | STRING | the process image name on the disk |
| os\_actor\_process\_image\_path | STRING | Process image path - A string identifying the location of the execution. |
| os\_actor\_process\_image\_sha256 | STRING | SHA256 of the binary. |
| os\_actor\_process\_instance\_id | STRING | Process instance identifier. |
| os\_actor\_process\_integrity\_level | INTEGER | the integrity level of the process (INTEGER) |
| os\_actor\_process\_is\_64bit | BOOLEAN | Indicates whether or not the process is compiled for 64 bit. |
| os\_actor\_process\_is\_native | BOOLEAN | Indicates whether or not this process is a "native process". On a 32 bit machine the value will be always true, on 64 bit machine it will be true if the process is 64 bit. |
| os\_actor\_process\_is\_replay | BOOLEAN | Indicates whether or not the process event data is replayed or not.
replayed means that the agent sent the data after the action occured for example after a reboot
|
| os\_actor\_process\_is\_special | INTEGER | Indicates special system processes:
RegularProcess = 0
KernelProcess = 1
AppContainerProcess = 2
NonWin32SubsystemProcess = 3
|
| os\_actor\_process\_logon\_id | STRING | Windows: LUID (uint64) representing the token of the process. |
| os\_actor\_process\_os\_pid | INTEGER | The Operating System (OS) Process Identifier (PID) of the operating system actor process |
| os\_actor\_process\_session\_id | INTEGER | Windows: Session ID of the process. |
| os\_actor\_process\_signature\_is\_embedded | BOOLEAN | Indicates whether or not the signature is embedded inside the Program Executable (PE) or part of an external catalog file. |
| os\_actor\_process\_signature\_product | STRING | Signature product - The product family part of the signature. |
| os\_actor\_process\_signature\_status | INTEGER | Signature status of the process:
Signed = 1
SignedInvalid = 2
Unsigned = 3
FailedToObtain = 4
WeakHash = 5, where the MD5 is used as the hash algorithm.
Unsupported = 6, which means the signature was not calculated.
InvalidCVE2020\_0601 = 7, which means the executable is malicious and is trying to exploit the windows vulnerability CVE2020-0601.
Deleted = 8, which means that the file was deleted by the time the agent tried to calculate the signature.
|
| os\_actor\_process\_signature\_vendor | STRING | Signature vendor - The vendor part of the signature. |
| os\_actor\_remote\_host | STRING | Relevant when the actor is a remote actor and the host was resolved successfully. |
| os\_actor\_remote\_ip | STRING | Relevant when the actor is a remote actor, where the type is not local and the IP was resolved successfully. |
| os\_actor\_remote\_port | INTEGER | Relevant when the actor is a remote actor, where the type is RemoteRpcTcp. |
| os\_actor\_session\_id | INTEGER | session id of the actor process |
| os\_actor\_thread\_thread\_id | INTEGER | thread id of the thread in the process which made the action |
| os\_actor\_type | INTEGER | Enum describing actor type:
Local = 1. The actor is a local process
RemoteRpcNamedPipe = 2. The actor is remote RPC over a named-pipe/SMB connection
RemoteRpcHttp = 3. The actor is remote RPC a remote HTTP connection
RemoteRpcTcp = 4. The actor is remote RPC over a TCP connection
RemoteFileSmb = 5. The actor is a remote file operation over SMB
|
| os\_actor\_container\_info | RECORD | Container information for the process. |
| os\_actor\_process\_ns\_pid | | |
| os\_actor\_ns\_user\_sid | | |
| os\_actor\_process\_container\_id | | |
| os\_actor\_process\_image\_auth\_sha1 | STRING | Process image SHA-1 authenticode. |
| os\_actor\_process\_image\_auth\_sha2 | STRING | Process image SHA-2 authenticode. |
| os\_actor\_process\_last\_writer\_actor | STRING | Cortex instance ID of the last process that has written the os actor process image. |
| os\_actor\_rpc\_func\_opnum | INTEGER | MS-RPC function operation identitifer. |
| os\_actor\_rpc\_interface\_version\_major | INTEGER | MS-RPC interface major version. |
| os\_actor\_rpc\_interface\_version\_minor | INTEGER | MS-RPC interface minor version. |
| os\_actor\_rpc\_protocol | STRING | MS-RPC protocol type. |
| os\_actor\_rpc\_interface\_uuid | STRING | MS-RPC interface unique identifier. |
| os\_actor\_process\_static\_analysis\_score | DEPRECATED | |
| os\_actor\_process\_file\_original\_name | STRING | Original file name of the casuality actor image based on the file information metadata. |
| os\_actor\_process\_file\_internal\_name | STRING | Internal name of the casuality actor image based on the file information metadata. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/xql-schema-reference/xdr-data-fields-by-actor/os-actor.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.