genian-edr-storyline

Reads the attack storyline of a threat as rows: parents, the started process, then each process's event groups and children.

genian-edr-storyline [profile=VALUE] threat-id=VALUE

profile=VALUE: Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
threat-id=VALUE: Required. Threat to read, the threat_id of genian-edr-threats

Output Fields

Field	Type	Name	Description
role	String	Role	e.g. parent. parent, start, child, file, registry, module or network.
depth	Integer	Depth	e.g. -1. 0 for the started process, negative for parents (-1 is the direct parent), positive for children.
proc_guid	String	Process GUID	e.g. 9C3E1A7F5B2D48E6A0F4C8B1D7E3925A6F0B12. GUID of the process the row is about.
parent_proc_guid	String	Parent GUID	e.g. 4A7D2E9C1F5B38A6E0D4C7B2F9A1E8360D5C27. GUID of the process above it; rebuilds the tree.
event_sub_type	String	Event sub type	e.g. ProcessStart. Event sub type of the row or group.
count	Integer	Count	e.g. 2095. Events in an event group.
hit_count	Integer	Hit count	e.g. 47. How many times the parent created this child.
direction	String	Direction	e.g. outgoing. outgoing, incoming or listening for a network group.
conn_count	Integer	Connections	e.g. 12. Connections of a network group.
process_count	Integer	Process events	e.g. 71. Process events of the process.
network_count	Integer	Network events	e.g. 23. Network events of the process.
file_count	Integer	File events	e.g. 2095. File events of the process.
registry_count	Integer	Registry events	e.g. 67. Registry events of the process.
module_count	Integer	Module events	e.g. 0. Module events of the process.
detected	List	Detected	e.g. [process, file]. Event types of the process that carry a detection.
event_time	Date	Event time	e.g. 2026-11-07 00:14:20. Time of the event the row shows.
proc_name	String	Process name	e.g. agent.exe. Name of the process.
proc_path	String	Process path	e.g. C:\Program Files\Vendor\Agent\agent.exe. Path of the process.
pid	Integer	PID	e.g. 12276. Process ID.
cmd_line	String	Command line	e.g. "C:\Program Files\Vendor\Agent\agent.exe" -p 1. Command line of the process.
proc_user_id	String	Process user	e.g. NT AUTHORITY\SYSTEM. Account the process runs as.
md5	String	MD5	e.g. 7b2e9c41d0a5f83e6c1b4d92a8f0e357. MD5 of the process or file.
file_name	String	File name	e.g. setup.exe. File of a file or module event.
file_path	String	File path	Path of the file
reg_key_path	String	Registry key	Key of a registry event
remote_ip	IP	Remote IP	e.g. 203.0.113.24. Remote address of a network event.
remote_port	Integer	Remote port	e.g. 443. Remote port of a network event.
dns_name	String	DNS name	e.g. update.example.com. Domain of the remote address.
detect_type	String	Detect type	e.g. XBA. Detect type when the event was detected.
tag	String	Tag	e.g. ServiceStart. Behavior tags of the event.
_time	Date	Time	e.g. 2026-11-07 00:14:20. Representative time of the row.