Investigating process IDs and host logs in Report Builder

Overview

This guide provides the steps for building process ID and host log reports, which you can review for helpful context when investigating various types of findings. Host logs reveal surrounding activity related to events you are investigating, and process ID logs indicate relationships between processes to help determine source attribution for suspicious or deleted activity.

Using Report Builder to investigate logs related to the process tree

Reference: See Using the Report Builder for more information about building reports.

After receiving a finding about a suspicious process parent, investigating the process tree via Report Builder can help you to verify the parent and the nature of the activity. While reviewing the report, look for the following information:

• Review the user associated with the different processes to determine if the user is authorized to perform the activity observed.
• Review the file paths of the processes to verify that the parent process is legitimate and expected.
• Review any commands associated with the processes for additional information on the actions performed by the process.

To investigate the full process tree related to this process execution, do the following:

1. Keeping your finding tab open, open another browser window and navigate to Reporting > Report Builder.
2. Set Time Range to include the time of the activity that you need to investigate.
3. In Data Sources, select Microsoft Windows or the relevant endpoint log type.
4. Click Edit Report and then click Add Filter.
5. Add the following report filters to narrow your logs to those for the impacted device where the process was logged:
   • Add a filter for the device in question.
     Example: devname - Equal - workstation1
   • Add a filter for the process IDs observed in the finding, adding the process IDs and parent process IDs so that you can see more of the process tree.
     Example: process_id - In - 123 456 789
6. Under Selected Columns, add columns to your report, such as those below, to see more information about the related processes in your results:
   • devname
   • device_address
   • domain
   • user
   • process_name
   • process_id
   • command
   • parent_process_name
   • parent_process_id
   • parent.cmdline
   • description
   • windows_event_id
7. Click Submit.

Building host log reports

To review logs and actions taken on a host device, do the following:

1. In the finding, locate the device’s name in the devname field, which you will use to filter your report in later steps.
2. Keeping your finding tab open, open another browser window and navigate to Reporting > Report Builder.
3. Set Time Range to include the time of the activity that you need to investigate.
4. Click Data Sources, and then select the relevant endpoint log types, such as Microsoft Windows and Blumira Agent Endpoint Logs.
   Tip: Select all log types to expand your query across all ingested logs.
5. Click Edit Report and then click Add Filter.
6. Add a filter to narrow the report to the logs containing the host’s name from the finding.
   Example:  devname - Contains - hostname.
7. Under Selected Columns, add columns to your report, such as those below, to see more information about the related processes in your results:
   • timestamp
   • user
   • command
   • description
   • device_address
   • devname
   • domain
   • windows_event_id
   • event_type
   • parent.cmdline
   • parent_process_id
   • parent_process_name
   • privileges
   • process_id
   • process_name
   • service_name
   • service_type
   • shipping_agent
   • subject_account_name
   • windows_log_source
   • type
   • shipping_agent
8. Click Submit.