Currently, the process object in has a nested parent_process object typed as a Process. This creates two issues
Modeling "grandparent" processes is a bit unclear and leads to additional mapping - in a Detection Finding context mapping a Crowdstrike Alert of grandparent_details.cmdline would be normalized as evidences.[0].process.parent_process.parent_process.cmd_line. This level of nesting is hard to grok unless the end user (analyst, det. engineer, etc.) was familiar with the concept.
It creates a possible recursion issue where you can have multiple chains of process.parent_process.parent_process.
In the short term, it would be easier to have a new Object of grandparent_process added. This avoids an extra level of nesting to avoid mistakes with mapping and analysis, and accommodates Crowdstrike Alerts, Detects, Falcon Data Replicator events (several dozen in fact), and Defender XDR/Advanced Hunting tables such as DeviceFileInfo and DeviceProcessInfo.
Longer term, it would make sense to have dedicated parent_process and grandparent_process objects that do not have any recursion present. I have never seen a tool with great_grandparent_process and Evidences[] already supports multiple entries as it is for this type of modeling.
Currently, the
processobject in has a nestedparent_processobject typed as a Process. This creates two issuesgrandparent_details.cmdlinewould be normalized asevidences.[0].process.parent_process.parent_process.cmd_line. This level of nesting is hard to grok unless the end user (analyst, det. engineer, etc.) was familiar with the concept.process.parent_process.parent_process.In the short term, it would be easier to have a new Object of
grandparent_processadded. This avoids an extra level of nesting to avoid mistakes with mapping and analysis, and accommodates Crowdstrike Alerts, Detects, Falcon Data Replicator events (several dozen in fact), and Defender XDR/Advanced Hunting tables such asDeviceFileInfoandDeviceProcessInfo.Longer term, it would make sense to have dedicated
parent_processandgrandparent_processobjects that do not have any recursion present. I have never seen a tool withgreat_grandparent_processand Evidences[] already supports multiple entries as it is for this type of modeling.