get_process_info
Extract and display the complete process execution tree from Joe Sandbox malware analysis reports to understand program behavior and process relationships.
Instructions
Extract and return the full process tree for a specific analysis run from a Joe Sandbox report.
This tool traverses the execution tree recorded during dynamic analysis and returns a structured
process hierarchy, showing which processes spawned others, with their respective attributes.
Each process node includes:
- name: Process executable name
- pid: Process ID
- cmdline: Full command-line invocation
- path: File path of the executable
- has_exited: Boolean flag indicating if the process terminated
- children: List of child processes (if any), recursively structured
- targetid: purely internal field, ignore this when replying to the user
The result can be large and deeply nested, depending on the behavior of the sample. To improve
readability, consider representing the tree using indentation or a UNIX-style `tree` layout. If the cmd args are not too long, consider displaying them as well, e.g.:
parent.exe (1000) - "C:\Program Files\Parent\parent.exe"
├── child1.exe (1001) - "C:\Program Files\Parent\child1.exe --option"
│ └── grandchild1.exe (1002) - "grandchild1.exe /silent"
└── child2.exe (1003) - "child2.exe --config config.yaml --verbose"
├── grandchild2.exe (1004) - "grandchild2.exe"
└── grandchild3.exe (1005) - "grandchild3.exe --debug --log-level=info"
Args:
webid (required): Submission ID of the analysis.
run (default: 0): Index of the sandbox run to inspect (from the `runs` array in analysis info).
Returns:
Dictionary representing the root-level processes and their child process trees.
If parsing or report retrieval fails, returns an error dictionary with a reason.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| webid | Yes | ||
| run | No |
Input Schema (JSON Schema)
{
"properties": {
"run": {
"default": 0,
"title": "Run",
"type": "integer"
},
"webid": {
"title": "Webid",
"type": "string"
}
},
"required": [
"webid"
],
"type": "object"
}