Method IsSurrogateProcess

pkg/event/event_windows.go:285–287

IsSurrogateProcess indicates if the process creation event parent id differs from the real process parent identifier.

()

// IsSurrogateProcess indicates if the process creation event parent id
// differs from the real process parent identifier.
func (e *Event) IsSurrogateProcess() bool {
	return e.IsCreateProcess() && e.Params.MustGetUint32(params.ProcessParentID) != e.Params.MustGetUint32(params.ProcessRealParentID)
}

// RundownKey calculates the rundown event hash. The hash is
// used to determine if the rundown event was already processed.