The window showing information about Process started events contains the following details:
Click the link to display information about the TAA (IOA) rule. If the rule was provided by Kaspersky experts, it contains information about the triggered MITRE technique as well as recommendations for reacting to the event.
The field is displayed if a TAA (IOA) rule was triggered when the event was created.
If the event was logged in the event database by Kaspersky Endpoint Agent for Linux, the Process started section also displays the Command field for the command that was used to run the process.
If the event was logged in the event database by Kaspersky Endpoint Agent for Linux, the Details section also includes the following fields:
If the event was logged in the event database by Kaspersky Endpoint Agent for Linux, the Parent process section also displays the Command field for the command that was used to run the parent process.
If the event was logged in the event database by Kaspersky Endpoint Agent for Linux, the System info section also displays the Logon from remote host field for the name of host from which the remote logon was performed.
Clicking the link with the file name or file path opens a list in which you can select one of the following actions:
In the information about the event that Kaspersky Endpoint Agent for Linux records in the event database, you can click the links with the file name or file path to open a list in which you can select one of the following actions:
Clicking the link with the host name opens a list in which you can select one of the following actions:
In the information about the event that Kaspersky Endpoint Agent for Linux records in the event database, you can click the link with the host name to open a list in which you can select one of the following actions:
Clicking the MD5 link opens a list in which you can select one of the following actions:
Clicking the SHA256 link opens a list in which you can select one of the following actions: