All Apps and Add-ons

Using Sankey Diagram for Process Parent-Child Mapping

browncardigan
Path Finder

I've downloaded the Sankey Visualisation with the goal of mapping Windows 4688 Events in a way that gives a sort of "process tree" for parents and children processes. This works fine for small volumes of data, but is unusable where it comes to a busy workstation:

alt text

I started looking at filtering - ideally you'd be able to specify the process name, like "cmd.exe" and see all related parent and child processes for processes with that process name, however that implicitly excludes anything that doesn't have that process name - meaning you lose all parent and child processes that aren't also called "cmd.exe".

The only way I can see around this is to exclude by PID - this is a painful process at the best of times, as you've got to go through the diagram and write down each individual PID to exclude, before it removes enough events to be able to view in sufficient detail. Not to mention it's literally impossible if your starting point is a diagram as above.

Can anyone see a way around this? The logic would be "where process name = "blah", map out all child processes recursively". That doesn't seem to be possible here.

The search syntax I've been using (including process exclusion):

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| stats count(ProcessID) by parent child

Producing events like this which are mapped in the Sankey Diagram:

10028 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 8596 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 1
10052 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 10256 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 1

0 Karma

murchisd
New Member

I recently published app that might work for your situation. https://splunkbase.splunk.com/app/5721/

 

App just implements a pstree command. You can filter for trees with specific processes after calling the pstree command.

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| pstree child=child parent=parent | table tree
| search tree=*<pid process of interest>

This command generally handles a single host fine but there is a recursion limit in Splunk that sometimes causes command to fail.

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...