Using Sankey Diagram for Process Parent-Child Mapping

[browncardigan]

I've downloaded the Sankey Visualisation with the goal of mapping Windows 4688 Events in a way that gives a sort of "process tree" for parents and children processes. This works fine for small volumes of data, but is unusable where it comes to a busy workstation:

I started looking at filtering - ideally you'd be able to specify the process name, like "cmd.exe" and see all related parent and child processes for processes with that process name, however that implicitly excludes anything that doesn't have that process name - meaning you lose all parent and child processes that aren't also called "cmd.exe".

The only way I can see around this is to exclude by PID - this is a painful process at the best of times, as you've got to go through the diagram and write down each individual PID to exclude, before it removes enough events to be able to view in sufficient detail. Not to mention it's literally impossible if your starting point is a diagram as above.

Can anyone see a way around this? The logic would be "where process name = "blah", map out all child processes recursively". That doesn't seem to be possible here.

The search syntax I've been using (including process exclusion):

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| stats count(ProcessID) by parent child

Producing events like this which are mapped in the Sankey Diagram:

10028 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 8596 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 1
10052 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 10256 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 1

[murchisd]

I recently published app that might work for your situation. https://splunkbase.splunk.com/app/5721/

App just implements a pstree command. You can filter for trees with specific processes after calling the pstree command.

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| pstree child=child parent=parent
| table tree
| search tree=*<pid process of interest>

This command generally handles a single host fine but there is a recursion limit in Splunk that sometimes causes command to fail.

[to4kawa]

https://answers.splunk.com/answers/818570/recursively-join-events-on-child-to-parent-fields.html#ans...

It's hard.