The payload is a key-value dictionary with the following keys.
Key | Notes |
|---|---|
type |
|
data | Dictionary of attributes associated to the event. |
The following table maps the keys in the data dictionary to the fields that are described in the Grid Area of the Process Tracker home page or describes the value directly, if it is not available within the grid.
data.key | Notes |
|---|---|
agent_id | Grid Area.Agent ID |
alerted_at | Grid Area.Alerted At |
args | Grid Area.Args |
attributes | Grid Area.Attributes |
created_at | Tiem when the event was consumed by the server module. |
enrichment_requested_at | Time when the event was posted to the Enricher Module. |
enrichment_status | Grid Area.Enrichment Status |
event_at | Grid Area.Event At |
file_created_at | Grid Area.Creation Time |
file_last_accessed_at | Grid Area.Last Accessed Time |
file_last_modified_at | Grid Area.Modified Time |
file_size | Grid Area.File Size (bytes) |
group | Grid Area.Group |
hostname | Grid Area.Hostname |
id | Grid Area.Index |
is_prelinked | Grid Area.Is Prelinked |
is_signed | Grid Area.Is Signed |
last_status_change_time | Grid Area.Last Status Change Time |
md5 | Grid Area.MD5 |
owner | Grid Area.Owner |
parent_path | Grid Area.Parent Path |
parent_pid | Grid Area.Parent PID |
pid | Grid Area.PID |
process_file_cert | Grid Area.Process File Cert |
process_file_exists | Grid Area.Process File Exists |
process_path | Grid Area.Process Path |
signature_verified | Grid Area.Signature Verified |
started_at | Grid Area.Start Time |
type | Grid Area.Type |
updated_at | Timestamp of last update to this event |
user | Grid Area.User |
uuid | Unique ID for the event. This can be used to tie events and update_events together. |