Process Trees
Process Event Trees in Secureworks® Taegis™ XDR help you see the events around the impact event of an alert. Explore the process events that occurred within a specified time around the impact event. Capabilities of the process trees include the ability to select processes to add to a new or an existing investigation, pivot searching off of the host ID, the ability to search for related events, and a view into if the process and user have elevated privileges.
Event Process Trees
Use the arrows to the left of the rows to expand and hide parts of the process tree. Use the arrows to the right of a row to expand individual processes. If the user or process has elevated privileges, a red icon appears in the associated column.
Note
All event process data associated to a host that has been impacted by an alert is kept available in the process trees view for 30 days after the impact event. After that, a pruned version of the tree is kept available indefinitely that displays only the direct ancestors and descendants of the impact event.
View an Alert’s Process Tree ⫘
Note
You must select a tenant to display related events in process trees.
To view process trees related to an alert:
-
Select the alert you want to view event processes for.
-
Commandline data is displayed in the Process Data section.
Process Data on Alert Details Page
-
To view events related to the alert, open the Events tab. Open a process event to view its details, including the process tree.
-
Run searches for related events by selecting the event type in the Related Events section.
Process Tree Details and Related Events
Tip
Copy the process tree as text to paste elsewhere by selecting Copy above the process tree.
Pivot Search by the Username ⫘
View the asset details and alerts related to the username associated with the impact event.
-
View the process tree and expand a part of the tree.
-
Select the magnifying glass
next to the username. -
A pivot search for the username appears, with related alerts, events, and agents.
Alerts Related to the Username
Related Events for Other Processes in the Tree ⫘
See Related Alerts and Events Timeline View for information on how to view other alerts and events related to the current Process Event.
Process Event Details Panel ⫘
The Process Event Details Panel includes the following data, if available:
- Command Line
- Create Time
- Host (Click the eyeball icon next to the Host ID to display a list of alerts related to the selected event.)
- Image Path
- Parent Process ID
- Process ID
- Tenant
- User