---
title: "Investigate processes"
slug: "investigate-processes"
updated: 2024-09-23T09:37:13Z
published: 2024-09-23T09:37:13Z
canonical: "docs.hunters.ai/investigate-processes"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate processes

Processes are one of the Entity types investigated by Hunters as part of its Lead creation and auto-investigtion stages.

![Processes in the lead](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Processes%20in%20the%20lead.png)

In many cyber incidents, identifying the origin and behavior of processes is critical for determining the root cause and extent of an attack. SOC analysts can use Hunters to gain a comprehensive and intuitive view of process relationships during security investigations by exploring the Hunters Process Tree.

Process Tree enables analysts to trace the lifecycle of processes in an alert and to explore their interactions within the operating system. By giving analysts a clear view of parent-child relationships and associated activities like network connections or file manipulations, this feature helps streamline the investigation process and reduces the time it takes to respond to security threats.

## View and explore process progression

### Process Tree preview

You can view a concentrated overview of the process you are exploring in the Lead details page by opening the lead and navigating to the process entity tab.

![Process tree overview in the lead](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Process%20tree%20overview%20in%20the%20lead.png)

### Full Process Tree

To explore further, click **Full Process Tree** to open a more extensive view providing you with a complete suite of information regarding the process. This includes detailed parent-child relationships that show how processes evolved over time, offering crucial insight into how malicious processes may have originated or propagated.

The Process Tree enables you to move up and down the process chain effortlessly by navigating to the parent process to identify the origin or potential cause of the current process or by drilling down into child processes by clicking the plus (+) sign to understand how a malicious action might have spawned additional threats.

![Process tree drilldown(1)](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Process%20tree%20drilldown(1).gif)

You can zoom in and out as needed or drag the process canvas to allow you to navigate within complex trees.

> [!NOTE]
> 💡Tip
> 
> To keep track during your investigation, look for the **Entry point** tag which marks the place you entered the Process Tree, meaning the process you initially investigated.
> 
> ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Entry point.png)

## Investigating process details and events

### Investigate process details

You can investigate a process further by selecting it from the process tree and examining the **Process details** panel, on the right side of the screen.

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Process details panel.png)

The Process details panel displays the time in which the Process event occurred, a link to related events (which will appear on the lower part of the screen), and the process Attributes.

### Show process events

You can dive into specific events and actions associated with a process, by selecting the process from the tree and examining the lower part of the screen.

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/Process events.png)

These events include:

- **Network Connections**: Connections initiated by the process, used to identify potential command-and-control or data exfiltration activity.
- **File System Activity**: System files created, deleted, or modified by the process, offering critical insight into potential data tampering or ransomware actions.
- **Process Activity**: Details of the processes related to the selected process.

An entity refers to any object or system that can be targeted by an attacker or that can participate in a security event. Entities can include devices, applications, networks, users, and data.

A lead refers to a potential security incident or threat that has been identified through security monitoring activities or other sources of security intelligence.

Attributes are fields attached to a lead that provide more information about the incident described in the lead. A lead can have many attributes such as "domain: hunters.ai", or "remote_ip: 10.0.0.1".