msticpy.transform.proc_tree_builder module

Process Tree Builder module for Process Tree Visualization.

msticpy.transform.proc_tree_builder.build_proc_tree(input_tree: DataFrame, max_depth: int = -1) → DataFrame

Build process tree paths.

Parameters:

input_tree (pd.DataFrame) – DataFrame containing process and parent key definitions
max_depth (int, optional) – Maximum depth to process the tree, by default -1 (no limit)

Returns:

DataFrame with ordered paths for each process.

Return type:

pd.DataFrame

msticpy.transform.proc_tree_builder.build_process_tree(procs: DataFrame, schema: ProcSchema | Dict[str, Any] | None = None, show_summary: bool = False, debug: bool = False, **kwargs) → DataFrame

Build process trees from the process events.

Parameters:

procs (pd.DataFrame) – Process events (Windows 4688 or Linux Auditd)
schema (Union[ProcSchema, Dict[str, Any]], optional) – The column schema to use, by default None. If supplied as a dict it must include definitions for the required fields in the ProcSchema class If None, then the schema is inferred
show_summary (bool) – Shows summary of the built tree, default is False.
debug (bool) – If True produces extra debugging output, by default False

Returns:

Process tree dataframe.

Return type:

pd.DataFrame