Given data of chain events find the path (chain of processes) from root to the current event.

Let us say that we have following chain of events:

parent_process	child_process
A	B
B	C
C	D
A	E
B	F

which looks as follow:

Graph

and for each row we want to get chain sequence all the way from root, example, as follow:

parent_process	child_process	lhub_path
A	B	A->B
B	C	A->B->C
C	D	A->B->C->D
A	E	A->E
B	F	A->B->F

also add additional information such as what is the depth of the step (distance from root process), and is it leaf step (final process)

Operator Usage in Easy Mode

Click + on the parent node.
Enter the Path from Root operator in the search field and select the operator from the Results to open the operator form.
In the Table drop-down, enter or select the table to which the operator is applied.
In the Source Attribute drop-down, enter or select the list of columns that define the source.
In the Dest Attribute drop-down, enter or select the list of columns that define the destination.
Optional. In the Max Depth, click Add More to add the maximum depth of the graph. You can click to add more to define the maximum depth of the graph.
Click Run to view the result.
Click Save to add the operator to the playbook.
Click Cancel to discard the operator form.

Usage Details

```scala LQL Command pathFromRoot(table, sourceAttributes, destAttributes, maxDepth) // table: input table to apply the operator // sourceAttributes: list of column names that specify the source e.g. ["computerName", "sourceProcessID", "sourceProcessName"] // destAttributes: list of column names that specify the dest e.g. ["computerName", "destProcessID", "dstProcessName"] // maxDepth: optional parameter to help to reduce computation time, if you know in advance approximate maxDepth of the tree, the set the value and it will compute up to that level, otherwise it might run into loops and compute forever.

## Example

**Input**  
table

&lt;style&gt;
  th {
    border: 1px solid #cccccc;
    background-color: #eeeeee;
    padding: 8px 5px 8px 5px;
    text-align: left
  }
&lt;/style&gt;
&lt;div&gt;&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;parent_process&lt;/th&gt;
&lt;th&gt;child_process&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;&lt;td&gt;A&lt;/td&gt;&lt;td&gt;B&lt;/td&gt;&lt;/tr&gt;
  &lt;tr&gt;&lt;td&gt;B&lt;/td&gt;&lt;td&gt;C&lt;/td&gt;&lt;/tr&gt;
  &lt;tr&gt;&lt;td&gt;C&lt;/td&gt;&lt;td&gt;D&lt;/td&gt;&lt;/tr&gt;
  &lt;tr&gt;&lt;td&gt;A&lt;/td&gt;&lt;td&gt;E&lt;/td&gt;&lt;/tr&gt;
  &lt;tr&gt;&lt;td&gt;B&lt;/td&gt;&lt;td&gt;F&lt;/td&gt;&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/tr&gt;
&lt;/table&gt;&lt;/div&gt;

LQL command
``` {sql}
pathFromRoot(table, ["partent_process"], ["child_process"])

Output

parent_process	child_process	lhub_path	lhub_isLeaf	lhub_level	lhub_root
A	B	A=>B	0	1	A
B	C	A=>B=>C	0	2	A
C	D	A=>B=>C=>D	1	3	A
A	E	A=>E	1	1	A
B	F	A=>B=>F	1	2	A

Browser not supported