laurel icon indicating copy to clipboard operation
laurel copied to clipboard

Generalize PARENT_INFO for context info about other processes

Open hillu opened this issue 2 years ago • 0 comments

Process information should not only be included for SYSCALL.ppid but also for

  • OBJ_PID.opid
  • SYSCALL.pid, not duplicating exe and comm, only including the generating messge id
  • pid as part of other records

It would make sense to expand on the idea that enriched values just use the capitalized name of the original name. So, the translation of opid=1234 should just be stored in the OBJ_PID line and be translated to

"OPID": {
    "exe":"/bin/bash",
    "comm":"bash",
    "ppid": 1201,
    "id":"1663542662.123748:45232"
}

hillu avatar Sep 18 '22 23:09 hillu