Use this section to create the rawProcessInfo.json, rawProcessWMIInfo.json and os.json files. These scripts run during introspection in Windows operating system-based virtual machine for collecting process details, OS details, and network details.

A sample rawProcessInfo.json file

Note:
  • You can use the Get-Process -IncludeUserName command and convert it into a JSON file to collect the process details.
  • The keys in the sample JSON file are important.
  • - can be anything specific for the process.
  • Change the bracket <> strings with proper values, where
    • <number> is of integer type
    • <text> is string type
    • <boolean> is true or false
    • <?> can be null too
  • { } bracket signifies specific objects

  • [ ] bracket signifies list and can have multiple similar objects.
[
    {
        "BasePriority":  <number>,
        "ExitCode":  <number>,
        "HasExited":  <boolean>,
        "ExitTime":  <time or null>,
        "Handle":  <number>,
        "SafeHandle":  {
                           "IsInvalid":  <boolean>,
                           "IsClosed":  <boolean>
                       },
        "HandleCount":  <number>,
        "Id": <number>,
        "MachineName":  <string>,
        "MainWindowHandle": <number>,
        "MainWindowTitle":  <string>,
        "MainModule":  {
                           "ModuleName":  <string>,
                           "FileName": <string>,
                           "BaseAddress": <number>,
                           "ModuleMemorySize":  <number>,
                           "EntryPointAddress": <number>,
                           "FileVersionInfo":  <string>,
                           "Site":  null,
                           "Container":  null
                       },
        "MaxWorkingSet":  <number>,
        "MinWorkingSet":  <number>,
        "Modules":  [
			<string>
],
        "NonpagedSystemMemorySize": <number>,
        "NonpagedSystemMemorySize64":  <number>,
        "PagedMemorySize":  <number>,
        "PagedMemorySize64":  <number>,
        "PagedSystemMemorySize":  <number>,
        "PagedSystemMemorySize64":  <number>,
        "PeakPagedMemorySize":  <number>,
        "PeakPagedMemorySize64":  <number>,
        "PeakWorkingSet":  <number>,
        "PeakWorkingSet64":  <number>,
        "PeakVirtualMemorySize":  <number>,
        "PeakVirtualMemorySize64":  <number>,
        "PriorityBoostEnabled":  <boolean>,
        "PriorityClass":  <number>,
        "PrivateMemorySize":  <number>,
        "PrivateMemorySize64":  <number>,
        "PrivilegedProcessorTime":  {
                                        "Ticks":  <number>,
                                        "Days":  <number>,
                                        "Hours":  <number>,
                                        "Milliseconds":  <number>,
                                        "Minutes":  <number>,
                                        "Seconds":  <number>,
                                        "TotalDays": <number>,
                                        "TotalHours": <number>,
                                        "TotalMilliseconds": <number>,
                                        "TotalMinutes":  <number>,
                                        "TotalSeconds":  <number>
                                    },
        "ProcessName":  <string>,
        "ProcessorAffinity":  <number>,
        "Responding":  <boolean>,
        "SessionId":  <number>,
        "StartInfo":  {
                          "Verb":  <number>,
                          "Arguments":  <number>,
                          "CreateNoWindow":  <boolean>,
                          "EnvironmentVariables":  <string>,
                          "Environment": “[<key1>, <value>] [<key2>,<value>]",
                          "RedirectStandardInput": <boolean>,
                          "RedirectStandardOutput": <boolean>,
                          "RedirectStandardError": <boolean>,
                          "StandardErrorEncoding": <string>,
                          "StandardOutputEncoding": <string>,
                          "UseShellExecute":  <boolean>,
                          "Verbs":  <string>,
                          "UserName":  <string>,
                          "Password":  <string>,
                          "PasswordInClearText":  <string>,
                          "Domain":  <string>,
                          "LoadUserProfile":  <boolean>,
                          "FileName": <string>,
                          "WorkingDirectory": <string>,
                          "ErrorDialog": <boolean>,
                          "ErrorDialogParentHandle":  <number>,
                          "WindowStyle": <number>
                      },
        "StartTime":  <string>,
        "SynchronizingObject":  null,
        "Threads":  [
				<string1>,
				<string2>
         		],
        "TotalProcessorTime":  {
                                   "Ticks": <number>,
                                   "Days":  <number>,
                                   "Hours":  <number>,
                                   "Milliseconds":  <number>,
                                   "Minutes":  <number>,
                                   "Seconds":  <number>,
                                   "TotalDays": <number>,
                                   "TotalHours": <number>,
                                   "TotalMilliseconds": <number>,
                                   "TotalMinutes": <number>,
                                   "TotalSeconds": <number>
                               },
        "UserProcessorTime":  {
                                  "Ticks": <number>,
                                  "Days": <number>,
                                  "Hours": <number>,
                                  "Milliseconds": <number>,
                                  "Minutes": <number>,
                                  "Seconds": <number>,
                                  "TotalDays": <number>,
                                  "TotalHours": <number>,
                                  "TotalMilliseconds": <number>,
                                  "TotalMinutes": <number>,
                                  "TotalSeconds": <number>
                              },
        "VirtualMemorySize":  <number>,
        "VirtualMemorySize64":  <number>,
        "EnableRaisingEvents": <boolean>,
        "StandardInput":  null,
        "StandardOutput":  null,
        "StandardError":  null,
        "WorkingSet": <number>,
        "WorkingSet64": <number>,
        "Site":  null,
        "Container":  null,
        "UserName": <string>,
        "Name":  "inetinfo",
        "SI": <number>,
        "Handles": <number>,
        "VM":  <number>,
        "WS":  <number>,
        "PM":  <number>,
        "NPM":  <number>,
        "Path": <string>,
        "Company": <string>,
        "CPU": <number>,
        "FileVersion": <string>,
        "ProductVersion": <string>,
        "Description": <string>,
        "Product": <string>,
        "__NounName": <string>
    },
    {
    ...
    }
]

A sample rawProcessWMIInfo.json file

Note: The rawProcessWMIInfo.json file must be under the same working directory, which contains more details about the running processes. You can use the Get-WmiObject -Class Win32_Process command in powershell and convert it into the JSON file before saving it to collect the process details.
[
    {
        "Scope":  {
                      "IsConnected":  <boolean>,
                      "Options":  "<text>",
                      "Path":  "<text>"
                  },
        "Path":  {
                     "Path":  "<text>",
                     "RelativePath":  "<text>",
                     "Server":  "<text>",
                     "NamespacePath":  "<text>",
                     "ClassName":  "<text>",
                     "IsClass":  <boolean>,
                     "IsInstance":  <boolean>,
                     "IsSingleton":  <boolean>
                 },
        "Options":  {
                        "UseAmendedQualifiers":  <boolean>,
                        "Context":  "",
                        "Timeout":  "<text>"
                    },
        "ClassPath":  {
                          "Path":  "<text>",
                          "RelativePath":  "<text>",
                          "Server":  "<text>",
                          "NamespacePath":  "<text>",
                          "ClassName":  "<text>",
                          "IsClass":  <boolean>,
                          "IsInstance":  <boolean>,
                          "IsSingleton":  <boolean>
                      },
        "Properties":  [
                           "<text>"
                       ],
        "SystemProperties":  [
                                 "<text>"
                             ],
        "Qualifiers":  [
                           "<text>"
                       ],
        "Site":  null,
        "Container":  null,
        "PSComputerName": "<text>",
        "ProcessName":  "<text>",
        "Handles":  <number>,
        "VM":  <number>,
        "WS":  <number>,
        "__GENUS":  <number>,
        "__CLASS":  "<text>",
        "__SUPERCLASS":  "<text>",
        "__DYNASTY":  "<text>",
        "__RELPATH":  "<text>",
        "__PROPERTY_COUNT":  <number>,
        "__DERIVATION":  [
                             "<text>"
                         ],
        "__SERVER":  "<text>",
        "__NAMESPACE":  "<text>",
        "__PATH":  "<text>",
        "Caption":  "<text>",
        "CommandLine":  null,
        "CreationClassName":  "<text>",
        "CreationDate":  "<text>",
        "CSCreationClassName":  "<text>",
        "CSName":  "<text>",
        "Description":  "<text>",
        "ExecutablePath":  null,
        "ExecutionState":  null,
        "Handle":  "<number>",
        "HandleCount":  <number>,
        "InstallDate":  null,
        "KernelModeTime":  <number>,
        "MaximumWorkingSetSize":  null,
        "MinimumWorkingSetSize":  null,
        "Name":  "<text>",
        "OSCreationClassName":  "<text>",
        "OSName":  "<text>",
        "OtherOperationCount":  <number>,
        "OtherTransferCount":  <number>,
        "PageFaults":  <number>,
        "PageFileUsage":  <number>,
        "ParentProcessId":  <number>,
        "PeakPageFileUsage":  <number>,
        "PeakVirtualSize":  <number>,
        "PeakWorkingSetSize":  <number>,
        "Priority":  <number>,
        "PrivatePageCount":  <number>,
        "ProcessId":  <number>,
        "QuotaNonPagedPoolUsage":  <number>,
        "QuotaPagedPoolUsage":  <number>,
        "QuotaPeakNonPagedPoolUsage":  <number>,
        "QuotaPeakPagedPoolUsage":  <number>,
        "ReadOperationCount":  <number>,
        "ReadTransferCount":  <number>,
        "SessionId":  <number>,
        "Status":  null,
        "TerminationDate":  null,
        "ThreadCount":  <number>,
        "UserModeTime":  <number>,
        "VirtualSize":  <number>,
        "WindowsVersion":  "<text>",
        "WorkingSetSize":  <number>,
        "WriteOperationCount":  <number>,
        "WriteTransferCount":  <number>
    }
]

A sample os.json file

Note:
  • The os.json file must be under the same working directory, which will have appliance operating system specific details. You can use the (Get-WmiObject -class Win32_OperatingSystem).Caption command in powershell.
  • The keys in the sample JSON are important.
  • -- can be anything specific to the operating system. For example: For Windows 2016 Server, <text> can be Microsoft Windows Server 2016 Standard.
{
    "network_detailed": [], 
    "interfaces": [
        "------"
    ], 
    "ipv6": [ 
        "-:----::----:----:----:----"
    ], 
    "ipv4": [
        "---.---.---.---"
    ], 
    "mac_address": {
        "---": "--:--:--:--:--:--"
    }, 
    "os_info": "--------------------------------------"

A sample socketsOutFile.txt file

The socketsOutFile.txt file must be under the same working directory, which contains all sockets related information. You can use the (netstat -bano | Out-String) -replace '(?m)^ (TCP|UDP)', '$1' -replace '\r?\n\s+([^\[])', "`t`$1" -replace '\r?\n\s+\[', "`t[" command in powershell.

Active Connections	Proto  Local Address          Foreign Address        State           PID
TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4	Can not obtain ownership information
TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       736	RpcSs	[svchost.exe]
...
Note:
  • To view logs under task, save logs into iris-agent.log file under the same working directory.
  • CPDA must run using the init powershell script, which accepts following arguments:
    • -osOutFile os.json
    • -processOutFile rawProcessInfo.json
    • -socketsOutFile socketsOutFile.txt
      Example:
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 
      C:\Windows\Temp\irisAgent\WindowsCollector.ps1 -osOutFile os.json 
      -processOutFile rawProcessInfo.json -socketsOutFile socketsOutFile.txt
  • CPDA must update rawProcessInfo.json, os.json and socketsOutFile.txt so that it can be read as part of the introspection task.
  • You can save the CPDA files in a .ZIP file and Add a Custom CPDA Configuration.