Forum Discussion

Dark_Knight666's avatar
Dark_Knight666
Icon for Silver I rankSilver I
2 months ago

Elastic Data Ingest: Demonstrate Your Skills

Hi, I'm a little confused as to where to look in order to answer Q6? Any help greatly appreciated!       
help & support
barney's avatar
barney
Icon for Bronze III rankBronze III
2 months ago

You've answered Q5, so you know the parent process id (ppid).  You just need to search for events that have that value as the process id (pid).

  • Dark_Knight666's avatar
    Dark_Knight666
    Icon for Silver I rankSilver I
    2 months ago

    So I've gone into the Process id (pid) and selected that particular value, expanded it but still can't find the process associated with the (pid)?