Devo SOAR - makeProcessIdsUnique

Makes process IDs unique for the source and destination columns that generate a new parent process ID and new child process ID avoiding collisions.

PathFromRoot operator does not have logic on what to do when there are collisions in the IDs; it goes on a first-come, first-serve basis.

Currently, pathFromRoot operator will produce for U and process one of the following paths:
U > B
V > B
B > G

From the above-mentioned paths, we need to pick one of them. makeProcessIdsUnique operator will pick the first path based on the specified ordering on the other hand pathFromRoot operator does not respect the ordering but, it picks the first one. Refer to the Example section below.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Make Process IDs Unique operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the table containing the data to run this operator on.
4. In the Partition by Column drop-down, enter or select a column name to partition by.
5. In the Order by Column drop-down, enter or select the column name to order within each partition.
6. In the Parent Process ID drop-down, enter or select the source column.
7. In the Child Process ID drop-down, enter or select the destination column.
8. Click Run to view the result.
9. Click Save to add the operator to the playbook.
10. Click Cancel to discard the operator form.

Usage Details

LQL Command

makeProcessIdsUnique(makeProcessIdsUniqueParentTable, $.partitionByColumn, $.orderByColumn, $.parentProcessId, $.childProcessId)

Parameters
Input Table: select the input table
Partition by Column: Partition by column name
Order by Column: Names of columns (comma separated string) to order table
Source: Name of the source column
Destination: Name of the destination column

Example

Let's assume that the input table contains the following connections from parent ID to a child ID.

Input table will contain the columns: partitionByColumn, orderByColumn, parentProcessId, childProcessId

makeProcessIdsUnique(makeProcessIdsUniqueParentTable, $.partitionByColumn, $.orderByColumn, $.parentProcessId, $.childProcessId)
  // This will create columns for partitionByColumn, orderByColumn, parentProcessId, childProcessId
  // you can pass new__parentProcessId and new__childProcessId to pathFromRoot operator

The output table will contain the following columns when you click Run in Easy Mode.

Output table will contain the columns: partitionByColumn, orderByColumn, parentProcessId, childProcessId, new_parentProcessId, new_childProcessId

scala LQL makeProcessIdsUnique(makeProcessIdsUniqueParentTable, $.partitionByColumn, $.orderByColumn, $.parentProcessId, $.childProcessId) // This will create columns for partitionByColumn, orderByColumn, parentProcessId, childProcessId, new__parentProcessId, new__childProcessId // you can pass new__parentProcessId and new__childProcessId to pathFromRoot operator