Class Process

Information about a process.

Inheritance

object

Process

Implements

IMessage<Process>

IEquatable<Process>

IDeepCloneable<Process>

IBufferMessage

IMessage

Inherited Members

object.GetHashCode()

object.GetType()

object.ToString()

Namespace: Google.Backstory

Assembly: Google.Backstory.dll

Syntax

public sealed class Process : IMessage<Process>, IEquatable<Process>, IDeepCloneable<Process>, IBufferMessage, IMessage

Constructors

Process()

Declaration

public Process()

Process(Process)

Declaration

public Process(Process other)

Parameters

Type	Name	Description
Process	other

Properties

AccessMask

A bit mask representing the level of access.

Declaration

public ulong AccessMask { get; set; }

Property Value

Type	Description
ulong

CommandLine

The command line command that created the process. This field can be used as an entity indicator for process entities.

Declaration

public string CommandLine { get; set; }

Property Value

Type	Description
string

CommandLineHistory

The command line history of the process.

Declaration

public RepeatedField<string> CommandLineHistory { get; }

Property Value

Type	Description
RepeatedField<string>

Egid

The effective group ID of the process.

Declaration

public string Egid { get; set; }

Property Value

Type	Description
string

Euid

The effective user ID of the process.

Declaration

public string Euid { get; set; }

Property Value

Type	Description
string

File

Information about the file in use by the process.

Declaration

public File File { get; set; }

Property Value

Type	Description
File

IntegrityLevelRid

The Microsoft Windows integrity level relative ID (RID) of the process.

Declaration

public ulong IntegrityLevelRid { get; set; }

Property Value

Type	Description
ulong

Ipv6

This is used to determine if the process is an IPv6 process.

Declaration

public bool Ipv6 { get; set; }

Property Value

Type	Description
bool

KernelDuration

The kernel time spent in the process.

Declaration

public Duration KernelDuration { get; set; }

Property Value

Type	Description
Duration

ParentPid

The ID of the parent process. Deprecated: use parent_process.pid instead.

Declaration

[Obsolete]
public string ParentPid { get; set; }

Property Value

Type	Description
string

ParentProcess

Information about the parent process.

Declaration

public Process ParentProcess { get; set; }

Property Value

Type	Description
Process

Pgid

The identifier that points to the process group ID leader.

Declaration

public string Pgid { get; set; }

Property Value

Type	Description
string

Pid

The process ID. This field can be used as an entity indicator for process entities.

Declaration

public string Pid { get; set; }

Property Value

Type	Description
string

ProductSpecificParentProcessId

A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.

Declaration

[Obsolete]
public string ProductSpecificParentProcessId { get; set; }

Property Value

Type	Description
string

ProductSpecificProcessId

A product specific process id.

Declaration

public string ProductSpecificProcessId { get; set; }

Property Value

Type	Description
string

RealDuration

The real time spent in the process. This is the sum of the kernel and user time.

Declaration

public Duration RealDuration { get; set; }

Property Value

Type	Description
Duration

Rgid

The real group ID of the process.

Declaration

public string Rgid { get; set; }

Property Value

Type	Description
string

Ruid

The real user ID of the process.

Declaration

public string Ruid { get; set; }

Property Value

Type	Description
string

SessionLeaderPid

The process ID of the session leader process.

Declaration

public string SessionLeaderPid { get; set; }

Property Value

Type	Description
string

State

The state of the process.

Declaration

public Process.Types.State State { get; set; }

Property Value

Type	Description
Process.Types.State

TokenElevationType

The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.

Declaration

public Process.Types.TokenElevationType TokenElevationType { get; set; }

Property Value

Type	Description
Process.Types.TokenElevationType

Tty

The teletype terminal which the command was executed within.

Declaration

public string Tty { get; set; }

Property Value

Type	Description
string

UserDuration

The user time spent in the process.

Declaration

public Duration UserDuration { get; set; }

Property Value

Type	Description
Duration