Skip to content

Commit b412bfe

Browse files
authored
additional process callstack fields (#435)
* add missing process.parent.thread.Ext.call_stack fields * add generated file
1 parent b551419 commit b412bfe

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

custom_documentation/doc/endpoint/process/windows/windows_process_create.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@ This event is generated when a process is created.
107107
| process.parent.name |
108108
| process.parent.pid |
109109
| process.parent.thread.Ext.call_stack.symbol_info |
110+
| process.parent.thread.Ext.call_stack.protection |
111+
| process.parent.thread.Ext.call_stack.callsite_leading_bytes |
112+
| process.parent.thread.Ext.call_stack.callsite_trailing_bytes |
110113
| process.parent.thread.Ext.call_stack_contains_unbacked |
111114
| process.parent.thread.Ext.call_stack_summary |
112115
| process.pe.imphash |

custom_documentation/src/endpoint/data_stream/process/windows/windows_process_create.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,9 @@ fields:
112112
- process.parent.name
113113
- process.parent.pid
114114
- process.parent.thread.Ext.call_stack.symbol_info
115+
- process.parent.thread.Ext.call_stack.protection
116+
- process.parent.thread.Ext.call_stack.callsite_leading_bytes
117+
- process.parent.thread.Ext.call_stack.callsite_trailing_bytes
115118
- process.parent.thread.Ext.call_stack_contains_unbacked
116119
- process.parent.thread.Ext.call_stack_summary
117120
- process.pe.imphash

0 commit comments

Comments
 (0)