process resource type

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Contains stateful information about the process related to the alert.

Properties

Property	Type	Description
accountName	String	User account identifier (user account context the process ran under) for example, AccountName, SID, and so on.
commandLine	String	The full process invocation commandline including all parameters.
createdDateTime	DateTimeOffset	Time at which the process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
fileHash	fileHash	Complex type containing file hashes (cryptographic and location-sensitive).
integrityLevel	processIntegrityLevel	The integrity level of the process. Possible values are: unknown, untrusted, low, medium, high, system.
isElevated	Boolean	True if the process is elevated.
name	String	The name of the process' Image file.
parentProcessCreatedDateTime	DateTimeOffset	DateTime at which the parent process was started. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
parentProcessId	Int32	The Process ID (PID) of the parent process.
parentProcessName	String	The name of the image file of the parent process.
path	String	Full path, including filename.
processId	Int32	The Process ID (PID) of the process.

JSON representation

The following JSON representation shows the resource type.

{
  "accountName": "String",
  "commandLine": "String",
  "createdDateTime": "String (timestamp)",
  "fileHash": {"@odata.type": "microsoft.graph.fileHash"},
  "integrityLevel": "@odata.type: microsoft.graph.processIntegrityLevel",
  "isElevated": true,
  "name": "String",
  "parentProcessCreatedDateTime": "String (timestamp)",
  "parentProcessId": 1024,
  "parentProcessName": "String",
  "path": "String",
  "processId": 1024
}