Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for AdditionalFields

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_2",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_2.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixAttachedTerminal": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixAttachedTerminal": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixAttachedTerminal`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixAttachedTerminal`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixAttachedTerminal": "VALUE_2",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixAttachedTerminal": "VALUE_2",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixAttachedTerminal`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixAttachedTerminal`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_7.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixAttachedTerminal": "VALUE_2",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixAttachedTerminal": "VALUE_2",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_2",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_2",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixAttachedTerminal`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixAttachedTerminal`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixAttachedTerminal": "VALUE_2",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixAttachedTerminal`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DesktopName": "VALUE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.DesktopName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreatedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessCurrentWorkingDirectory": "VALUE_1",
  "ProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixFileGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "ProcessPosixFilePermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "ProcessPosixFileUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "ProcessPosixProcessGroupId": 1,
  "ProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessCurrentWorkingDirectory`	string
`$.ProcessPosixEffectiveGroup`	object
`$.ProcessPosixEffectiveGroup.Name`	string
`$.ProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.ProcessPosixEffectiveUser`	object
`$.ProcessPosixEffectiveUser.DomainName`	string
`$.ProcessPosixEffectiveUser.LogonId`	integer
`$.ProcessPosixEffectiveUser.Name`	string
`$.ProcessPosixEffectiveUser.PosixUserId`	integer
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.ProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixFileGroupOwner`	object
`$.ProcessPosixFileGroupOwner.Name`	string
`$.ProcessPosixFileGroupOwner.PosixGroupId`	integer
`$.ProcessPosixFilePermissions`	array
`$.ProcessPosixFilePermissions[]`	string
`$.ProcessPosixFileUserOwner`	object
`$.ProcessPosixFileUserOwner.DomainName`	string
`$.ProcessPosixFileUserOwner.LogonId`	integer
`$.ProcessPosixFileUserOwner.Name`	string
`$.ProcessPosixFileUserOwner.PosixUserId`	integer
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup`	object
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.Name`	string
`$.ProcessPosixFileUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.ProcessPosixProcessGroupId`	integer
`$.ProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

DeviceProcessEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Process creation and related events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
CreatedProcessSessionId	Windows session ID of the created process	Int64
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessLogonId	Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.	Int64
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessSignatureStatus	Information about the signature status of the process (image file) that initiated the event	String
InitiatingProcessSignerType	Type of file signer of the process (image file) that initiated the event	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsProcessRemoteSession	Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
ProcessCommandLine	Command line used to create the new process	String
ProcessCreationTime	Date and time the process was created	DateTime
ProcessId	Process ID (PID) of the newly created process	Int64
ProcessIntegrityLevel	Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources.	String
ProcessRemoteSessionDeviceName	Device name of the remote device from which the created process’s RDP session was initiated	String
ProcessRemoteSessionIP	IP address of the remote device from which the created process’s RDP session was initiated	String
ProcessTokenElevation	Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)	String
ProcessUniqueId	Unique identifier of the process; this is equal to the Process Start Key in Windows devices	String
ProcessVersionInfoCompanyName	Company name from the version information of the newly created process	String
ProcessVersionInfoFileDescription	Description from the version information of the newly created process	String
ProcessVersionInfoInternalFileName	Internal file name from the version information of the newly created process	String
ProcessVersionInfoOriginalFileName	Original file name from the version information of the newly created process	String
ProcessVersionInfoProductName	Product name from the version information of the newly created process	String
ProcessVersionInfoProductVersion	Product version from the version information of the newly created process	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
OpenProcess	The OpenProcess function was called indicating an attempt to open a handle to a local process and potentially manipulate that process.
ProcessCreated	A process was launched on the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

DeviceProcessEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Process creation and related events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
CreatedProcessSessionId	Windows session ID of the created process	Int64
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessLogonId	Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.	Int64
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessSignatureStatus	Information about the signature status of the process (image file) that initiated the event	String
InitiatingProcessSignerType	Type of file signer of the process (image file) that initiated the event	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsProcessRemoteSession	Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
ProcessCommandLine	Command line used to create the new process	String
ProcessCreationTime	Date and time the process was created	DateTime
ProcessId	Process ID (PID) of the newly created process	Int64
ProcessIntegrityLevel	Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources.	String
ProcessRemoteSessionDeviceName	Device name of the remote device from which the created process’s RDP session was initiated	String
ProcessRemoteSessionIP	IP address of the remote device from which the created process’s RDP session was initiated	String
ProcessTokenElevation	Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)	String
ProcessUniqueId	Unique identifier of the process; this is equal to the Process Start Key in Windows devices	String
ProcessVersionInfoCompanyName	Company name from the version information of the newly created process	String
ProcessVersionInfoFileDescription	Description from the version information of the newly created process	String
ProcessVersionInfoInternalFileName	Internal file name from the version information of the newly created process	String
ProcessVersionInfoOriginalFileName	Original file name from the version information of the newly created process	String
ProcessVersionInfoProductName	Product name from the version information of the newly created process	String
ProcessVersionInfoProductVersion	Product version from the version information of the newly created process	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
OpenProcess	The OpenProcess function was called indicating an attempt to open a handle to a local process and potentially manipulate that process.
ProcessCreated	A process was launched on the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking