Clarify Property Definitions on Process Object about cti-stix2 HOT 8 CLOSED

So I think the biggest issue here is that the name property is duplicative with respect to binary_ref.name . Given that the "name" of a process tends to almost always be the filename of the binary, I would suggest that we deprecate name.

from cti-stix2.

As far as command_line, I would suggest updating the description from the existing:

"Specifies the full command line used in executing the process, including the process name (depending on the operating system)."

To the new version:

"Specifies the full command line used in executing the process, including the process name (which may be specified individually via the binary_ref.name property) and any arguments."

from cti-stix2.

FYI, this is what Osquery has for these properties:

name | TEXT | The process path or shorthand argv[0]
path | TEXT | Path to executed binary
cmdline | TEXT | Complete argv

from cti-stix2.

I've had this same question, definitely agree with fixing this for 2.1.

from cti-stix2.

There are plenty of cases where a process name doesn't align with the binary filepath. For example, in *nix, where you have one binary with a number of different executable symlinks pointing to it and the binary alters its behavior based on how it's called (i.e., argv[0].) Similarly, in Windows™ where you have a callable DLL (with a main() function) with symbolic links as in the previous example.

from cti-stix2.

@treyka interesting. I ran an experiment on this on my MacBook, and it least in OS X it looks like the name of the symlink is captured in the command-line (CMD) but not the name of the process.

ikirillov@foo-PC:~$ top
58548  iBooks     

ikirillov@foo-PC:~$ ps -p 58548
  PID TTY           TIME CMD
58548 ttys010    0:01.00 ./iBooks-foo

from cti-stix2.

@jordan2175 it looks like we've already made these changes to the Process SCO (name has been deprecated, the description for command_line has been updated, etc.), so there's nothing else that needs to be done here.

from cti-stix2.

Looks like this was done some time back. Closing.

from cti-stix2.