Process Down Action

Common Event Grammar › Operational Security Category › Process Activity Class › Process Down Action

Process Down Action

The Process Down action expresses information on the status of a stopped process. You can map events to the Process Stop action to recording the stopping action. If the event is just indicating that the status is down, then map to the Process Down action.

Information	Level
Source - User Information	Secondary
Source - Host Information	Tertiary
Source - Object Information	Tertiary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Tertiary
Dest - Host Information	Primary
Dest - Object Information	Primary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Primary
Result - Information	Primary

Result	event_result	event_severity
Failure	F	4