Command line args and a new process entity ID

[Babar_Qayyum]

Dear All,

Will changing the command line arguments result in the generation of a new process entity ID? OR

What are some other potential factors that could lead to the generation of new entity IDs for the IIS processes?

Regards,

Babar Qayyum

[sujit_k_singh]

Hi @Babar_Qayyum 

It depends on your detection rules command line changes don't automatically create a new process entity ID, but they can if a rule is keyed off "Command line" or "Command line – single argument" (matches each arg individually).

To confirm for your process: check OneAgent logs right after process start they show exactly which items fed into the process group ID calculation.

Thanks,

Sujit