Opaque process with services

[henk_stobbe]

Hello,

Can anybody explain below, I have a opaque process with services? It seems out of the box,

KR Henk

[ChadTurner · Accepted solution]

Hey @Henk S. So the image you posted shows that you have 6 processes that are reaching out to that 16 services in the middle. Under that it should show the list of hosts that those 14 services reside on. Going out of those 14 services we can see that they are reaching out to a single process.

If you click on each segment of the image it will drill you down into those process and services.

[henk_stobbe]

Hi Chat,

It is really just 1 process offering 14 web services, looking at a specific services they all show the name convention:

"Servicename A" on "Processname"

"Servicename B" on "Processname"

"Servicename C" on "Processname"

and so on...

KR Henk

[ChadTurner]

Being that they are listed as "Other" im going to assume there are multiple Types of Services. So yes, there are 14 services within that other category, in which 6 processes access.

[MostafaHussein · Accepted solution]

@henk_stobbe 

you can use auto tagging to target them using entity selector as the following statement

type(SERVICE),agentTechnologyType("N/A"),fromRelationship.runsOn(type(PROCESS_GROUP),fromRelationship.runsOn(type(HOST)))

the 2nd part of fromRelationship is to ensure that external service is not included as the external service doesn't has relationship with process running on host and in the same time it's technology is N/A as same as the opaque service