processes

Type: object

Information about running processes of a scanned system

 No Additional Properties

root pid
Type: integer

PID of the process

root bitness
Type: enum (of string)

Bitness of the process

Must be one of:

  • "invalid"
  • "64Bit"
  • "32Bit"

root executablePath
Type: string or null

Path to the executable file of the process, if it could be determined

root executableMD5

MD5 hexdigest of the executable file, if the file could be read

root executableMD5 oneOf item 0
Type: string
Must match regular expression: ^[a-f0-9]{32}$
root executableMD5 oneOf item 1
Type: null

root executableSHA256

SHA256 hexdigest of the executable file, if the file could be read

root executableSHA256 oneOf item 0
Type: string
Must match regular expression: ^[a-f0-9]{64}$
root executableSHA256 oneOf item 1
Type: null

root username
Type: string

Name of the user, which the process is executed under

root memorySegments
Type: array of object

Each item of this array must be:

root memorySegments memorySegments items
Type: object
No Additional Properties

root memorySegments memorySegments items parentBaseAddress
Type: integer

Address of the parent segment. This is equal to baseAddress if the segment is a root segment. Note, this value can get very large. make sure your parser uses an int64.

root memorySegments memorySegments items baseAddress
Type: integer

Address of this segment. Note, this value can get very large. make sure your parser uses an int64.

root memorySegments memorySegments items allocatedPermissions
Type: object

The permissions, this segment was initialized with

 No Additional Properties

root memorySegments memorySegments items allocatedPermissions read
Type: boolean

True, if readable

root memorySegments memorySegments items allocatedPermissions write
Type: boolean

True, if writable. If COW is true, this will be as well.

root memorySegments memorySegments items allocatedPermissions COW
Type: boolean

True, if the Copy-On-Write flag is set.

root memorySegments memorySegments items allocatedPermissions execute
Type: boolean

True, if executable

root memorySegments memorySegments items currentPermissions
Type: object

The permissions, this segment had during time of the scan

Same definition as allocatedPermissions

root memorySegments memorySegments items size
Type: integer

Size of the segment in bytes. Note, this value can get very large. make sure your parser uses an int64.

root memorySegments memorySegments items rss
Type: integer

The resident set size (RSS) of the segment in bytes. Only applicable on linux. Note, this value can get very large. make sure your parser uses an int64.

root memorySegments memorySegments items state
Type: enum (of string)

The state of the segment. Note that the state "reserve" is an approximation on linux; this will be set if the RSS is exactly zero.

Must be one of:

  • "commit"
  • "free"
  • "reserve"

root memorySegments memorySegments items type
Type: enum (of string)

The type of the memory segment

Must be one of:

  • "image"
  • "mapped"
  • "private"
  • "privateMapped"

root memorySegments memorySegments items mappedFile

root memorySegments memorySegments items mappedFile oneOf item 0
Type: object
No Additional Properties

root memorySegments memorySegments items mappedFile oneOf item 0 path
Type: string

The path of the mapped file

root memorySegments memorySegments items mappedFile oneOf item 0 md5
Type: string

MD5 hexdigest of the mapped file, if the file could be read

root memorySegments memorySegments items mappedFile oneOf item 0 sha256
Type: string

SHA256 hexdigest of the mapped file, if the file could be read
root memorySegments memorySegments items mappedFile oneOf item 1
Type: null