Linux Users

The attributes that Linux uses to identify user information.

• Extension: linux

Attributes

group

• Type: group
• Requirement: recommended

The group under which this process is running.

auid

• Type: integer_t
• Requirement: optional

The audit user assigned at login by the audit subsystem.

egid

• Type: integer_t
• Requirement: optional

The effective group under which this process is running.

euid

• Type: integer_t
• Requirement: optional

The effective user under which this process is running.

Available In

• account_change
• admin_group_query
• airborne_broadcast_activity
• api_activity
• application_error
• application_lifecycle
• application_security_posture_finding
• authentication
• authorize_session
• base_event
• cloud_resources_inventory_info
• compliance_finding
• config_state
• data_security_finding
• datastore_activity
• detection_finding
• device_config_state_change
• dhcp_activity
• dns_activity
• drone_flights_activity
• email_activity
• email_file_activity
• email_url_activity
• entity_management
• event_log_actvity
• evidence_info
• file_activity
• file_hosting
• file_query
• file_remediation_activity
• folder_query
• ftp_activity
• group_management
• http_activity
• iam_analysis_finding
• incident_finding
• inventory_info
• job_query
• kernel_activity
• kernel_extension_activity
• kernel_object_query
• memory_activity
• module_activity
• module_query
• network_activity
• network_connection_query
• network_file_activity
• network_remediation_activity
• networks_query
• ntp_activity
• osint_inventory_info
• patch_state
• peripheral_activity
• peripheral_device_query
• process_activity
• process_query
• process_remediation_activity
• rdp_activity
• remediation_activity
• scan_activity
• scheduled_job_activity
• script_activity
• security_finding
• service_query
• session_query
• smb_activity
• software_info
• ssh_activity
• startup_item_query
• tunnel_activity
• user_access
• user_inventory
• user_query
• vulnerability_finding
• web_resource_access_activity
• web_resources_activity
• win/prefetch_query
• win/registry_key_activity
• win/registry_key_query
• win/registry_value_activity
• win/registry_value_query
• win/windows_resource_activity
• win/windows_service_activity