Cortex XDR Process Lineage Observation

Shadows VMB@Vemorian_Mort

•updated Jul 29, 2026•7•1•44

This rule monitors and retrieves process lineage information, including child process execution, parent process context, and grandparent process hierarchy for a specific host. It extracts process execution details such as image names and command lines to provide visibility into process trees for forensic investigation and behavior analysis.