Event Lineage and Process Tree🔗

This page explains how to investigate process activity using the Lineage and Process Tree views. These visualizations help you understand process relationships, follow parent-child execution chains, identify related detections and key activities, and navigate associated events during an investigation. Use the Lineage view for flexible exploration of process ancestry and descendants across time, or use the Process Tree view for a simplified top-down representation of a process and its related activity.

Process Trees in Preview mode.

The Process Tree view is currently only available to users opted into Preview mode.

Lineage View🔗

The Lineage tab in process and detection finding events displays a visual, interactive view of the process lineage. This view is meant for users who would like flexibility to navigate any part of the process tree. This allows the flexibility to move forwards and backwards in time as needed.

This view allows the user to view detections, related events, and key activities.

View a Lineage🔗

Access a lineage by opening a process or detection finding event details page. Events are visible in search results, cases, and from detection details pages.
From the event details, select the Lineage tab.
A graph displays the process you are viewing with any ancestry and child processes.

Note

Lineage displays only processes from the last 30 days; older processes are not shown. If the source process event itself is more than 30 days old, the Lineage tab is disabled.

Tip

Search for process and detection finding events in Query Editor with the following queries: FROM process and FROM detectionfinding.

Explore a Lineage🔗

The lineage graph may show the following information, when available:

Process creation date and time
An icon indicating a process is elevated
Process name
Orange highlighted icon indicating detections are associated with the process
Count of associated detections, key activities, or related events
The number of hidden child processes of a process
The time difference between two processes
An icon indicating a process is blocked
An icon indicating a process is the source event

Tip

Select the Legend tooltip at the top right of the graph to see the list of icons that may appear in the graph and their meanings.

Search a Lineage🔗

Enter a string in the search box to search the loaded event lineage. The search is applied against loaded lineage and supporting data using a contains search. Lineage process nodes with matching strings and supporting data are highlighted.

Use the buttons to load data for the Previous 3 Days or Next 3 Days. The search is automatically applied against new data as it loads.

Tip

Use the filter toggle to load only lineage objects with matching search results.

Matching key activity search results get highlighted.

See More Details of a Process🔗

See more details of a process in the following ways:

Hover over a process node to show basic details, the full image path, username with annotation if the user is an admin, and a link to open the event details in a new tab.

Hover Over a Process
Click a process node in the lineage to open the Info tab below the graph.

Open Info Tab

The Info tab shows process details and the command line. Take the following actions from the Info tab:
- Select the Process Name to open the event details in a new tab.
- Select the Magnifying Glass next to a field to perform a pivot search based on that field.

Tip

To resize, use the handle above the tabs below the graph.

See Key Activities🔗

The Key Activities tab below the graph shows any key activities associated with the selected process node that were generated by Sophos Endpoint Agents.

Note

The Key Activities tab only shows if you have Sophos Agents in your environment.

View the Key Activities tab in two ways:

Select the Key Activities link below a process node in the graph.
Alternatively, select a process node in the graph and then select the Key Activities tab.

Key activities are surfaced from Sophos Agents, which capture endpoint events that have security value. These are snapshots of processes performing actions that could be indicators of compromise, are potentially suspicious, and require elevation inside of the process lineage.

Key activities comprise the following:

Event type: The event as surfaced by the underlying detection event triggered on the endpoint.
Activity value: Key data surfaced from the event.
Raw Data: The entire raw data object. Click View Raw Data to see this in a drawer.

Key Activity Raw Data

See Child Processes🔗

The Child Processes tab below the graph shows child process events of the selected process node. View the Child Processes tab in two ways:

Select a count of child processes from the graph.
Alternatively, select a process node in the graph and then select the Child Processes tab.

Select a Process Name to open the event details in a new tab.

Show Child Processes in the Lineage🔗

You can add these child processes to the lineage graph to help investigate threats.

To add a single process, click the Eye icon from the Actions column. Click the icon again to hide the process.
To add multiple processes, use the checkboxes at the left to select the desired processes and click Add to Graph. Use the checkboxes and click Remove from Graph to hide the processes.

See Associated Detections🔗

The Detections tab below the graph shows any detections generated from the selected process node. View the Detections tab in two ways:

Select a count of detections below a process node in the graph.
Alternatively, select a process node in the graph and then select the Detections tab.

Select a Detection Title to open the details in a drawer without losing your place in the lineage graph.

The Related Events tab below the graph shows any related, correlated events associated with the selected process node. Correlation occurs using an algorithm that searches any events in the data lake for your tenant that have matching process identifiers. In other words, they were surfaced from the same process.

This helps you understand the event by examining other related event types captured in your environment.

Related events are labeled by type with a count in the graph beneath the process node. Supported related event types are as follows:

DNS (dnsquery)
File Mod (filemod)
HTTP (http)
Netflow (netflow)
Registry (registry)
Script Block (scriptblock)

All other event types are categorized as Other.

View the Related Events tab in two ways:

Select a Related Events link below a process node in the graph.
Alternatively, select a process node in the graph and then select the Related Events tab.

Click Next 3 Days to expand your search for related events in three-day increments past the default window of 24 hours after process creation.

Copy the Lineage🔗

To copy the displayed lineage graph as a text-based process tree of nodes to your clipboard, click Copy from the top right of the graph. You can enhance a case by using this copied tree in the notes.

Process Tree View 🔗

The Process Tree view is a top-down view of the process lineage for users who want a rapid visualization of the parent process, as well as all its children and siblings. Top level process attributes, such as image path, command line, and username, are clearly visible in each node.

It's designed for speed and quick viewing. Key data objects, related detections, and key activities are linked when present.

View a Process Tree🔗

To view a process tree:

Access a process by opening a process or detection finding event details page. Events are visible in search results, cases, and from detection details pages.
From the event details, select the Lineage tab.
From the Lineage tab, select the Process Tree sub-tab.
The visualization displays the full process tree including siblings and children.

Expand Process Tree Nodes🔗

To expand a process tree node:

Click on a node to expand.

The node expands to show its children, if present.
Click the node to collapse and hide the children.

Tip

Click the Reset to Default option to return the process tree to its original state.

Search a Process Tree🔗

The Process Tree view also contains a search feature. Identify nodes that contain a search string using the Find in Process Tree text box.

When detections are correlated with a process node, the detection is viewable in an expanded node.

For users licensed with Sophos Endpoint Agent, key activities are also visible in the process node.

View related detections and key activities

Tip

Click on the detection link to open in a new tab.