BETH Dataset

timestamp Timestamp	processid ProcessId	parentprocessid ParentProcessId	userid UserId	processname ProcessName	hostname HostName	eventid EventId	eventname EventName	argsnum ArgsNum	returnvalue ReturnValue	args Args
124.95282	383	1	101	systemd-resolve	ip-10-100-1-186	41	socket	3	15	[{'name': 'domain', 'type': 'int', 'value': 'AF_UNIX'}, {'name': 'type', 'type': 'const char*', 'value': 'SOCK_DGRAM\|SOCK_CLOEXEC'}, {'name': 'protocol', 'type': 'int', 'value': 0}]
124.953139	380	1	100	systemd-network	ip-10-100-1-186	41	socket	3	15	[{'name': 'domain', 'type': 'int', 'value': 'AF_UNIX'}, {'name': 'type', 'type': 'const char*', 'value': 'SOCK_DGRAM\|SOCK_CLOEXEC'}, {'name': 'protocol', 'type': 'int', 'value': 0}]
124.953424	1			systemd	ip-10-100-1-186	1005	security_file_open	4		[{'name': 'pathname', 'type': 'const char*', 'value': '/proc/380/cgroup'}, {'name': 'flags', 'type': 'unsigned int', 'value': 'O_RDONLY\|O_LARGEFILE'}, {'name': 'dev', 'type': 'dev_t', 'value': 5}, {'name': 'inode', 'type': 'unsigned long', 'value': 39551}]
124.953464	1			systemd	ip-10-100-1-186	257	openat	4	17	[{'name': 'dirfd', 'type': 'int', 'value': -100}, {'name': 'pathname', 'type': 'const char*', 'value': '/proc/380/cgroup'}, {'name': 'flags', 'type': 'unsigned int', 'value': 'O_RDONLY\|O_CLOEXEC'}, {'name': 'mode', 'type': 'int', 'value': 3981397796}]
124.953494	1			systemd	ip-10-100-1-186	5	fstat	2		[{'name': 'fd', 'type': 'int', 'value': 17}, {'name': 'statbuf', 'type': 'struct stat*', 'value': '0x7FFC81912E90'}]
124.953618	1			systemd	ip-10-100-1-186	3	close	1		[{'name': 'fd', 'type': 'int', 'value': 17}]
124.954024	1			systemd	ip-10-100-1-186	1005	security_file_open	4		[{'name': 'pathname', 'type': 'const char*', 'value': '/proc/383/cgroup'}, {'name': 'flags', 'type': 'unsigned int', 'value': 'O_RDONLY\|O_LARGEFILE'}, {'name': 'dev', 'type': 'dev_t', 'value': 5}, {'name': 'inode', 'type': 'unsigned long', 'value': 39553}]
124.954061	1			systemd	ip-10-100-1-186	257	openat	4	17	[{'name': 'dirfd', 'type': 'int', 'value': -100}, {'name': 'pathname', 'type': 'const char*', 'value': '/proc/383/cgroup'}, {'name': 'flags', 'type': 'unsigned int', 'value': 'O_RDONLY\|O_CLOEXEC'}, {'name': 'mode', 'type': 'int', 'value': 3981397796}]
124.954086	1			systemd	ip-10-100-1-186	5	fstat	2		[{'name': 'fd', 'type': 'int', 'value': 17}, {'name': 'statbuf', 'type': 'struct stat*', 'value': '0x7FFC81912E90'}]
124.954218	1			systemd	ip-10-100-1-186	3	close	1		[{'name': 'fd', 'type': 'int', 'value': 17}]


CREATE TABLE labelled_2021may_ip_10_100_1_186 (
  "timestamp" DOUBLE,
  "processid" BIGINT,
  "parentprocessid" BIGINT,
  "userid" BIGINT,
  "processname" VARCHAR,
  "hostname" VARCHAR,
  "eventid" BIGINT,
  "eventname" VARCHAR,
  "argsnum" BIGINT,
  "returnvalue" BIGINT,
  "args" VARCHAR,
  "sus" BIGINT,
  "evil" BIGINT
);