Issue #112: Select windows processes by user name and domain

src/main/connector/system/WindowsProcess/WindowsProcess.yaml

@@ -1,86 +1,155 @@
-extends:
-- ../System/System
-connector:
-  displayName: Windows - Processes (WMI)
-  platforms: Any Windows system
-  reliesOn: WMI
-  information: Monitors essential performance metrics of any Windows system through WMI, following OpenTelemetry semantic conventions.
-  detection:
-    appliesTo:
-    - windows
-    disableAutoDetection: true
-    criteria:
-    - type: wmi
-      namespace: root\CIMv2
-      query: SELECT Name FROM Win32_OperatingSystem
-    tags: [ system, windows ]
-  variables:
-    matchName:
-      description: Regular expression pattern to match process names for monitoring.
-      defaultValue: .* 
-    matchCommand:
-      description: Regular expression pattern to match process command lines for monitoring.
-      defaultValue: .*
-monitors:
-  process:
-    simple:
-      sources:
-        processQuery:
-          # 1 ProcessId;Name;ParentProcessId;ExecutablePath;ThreadCount;
-          # 6 PageFaults;ReadOperationCount;ReadTransferCount;
-          # 9 WriteOperationCount;WriteTransferCount;CommandLine;
-          # 12 WorkingSetSize;VirtualSize;KernelModeTime;UserModeTime;HandleCount
-          type: wmi
-          namespace: root\CIMv2
-          query: | 
-            SELECT
-            ProcessId,
-            Name,
-            ParentProcessId,
-            ThreadCount,
-            PageFaults,
-            ReadOperationCount,
-            ReadTransferCount,
-            WriteOperationCount,
-            WriteTransferCount,
-            CommandLine,
-            WorkingSetSize,
-            VirtualSize,
-            KernelModeTime,
-            UserModeTime,
-            HandleCount
-            FROM Win32_Process
-          computes:
-          - type: keepOnlyMatchingLines
-            column: 2
-            regExp: ${var::matchName}
-          - type: keepOnlyMatchingLines
-            column: 10
-            regExp: ${var::matchCommand}
-          - type: add
-            column: 13
-            value: $14
-          - type: divide
-            column: 13 #  unit = 100-nanosecond intervals
-            value: 10000000 # divide by 10000000 to get a result in seconds
-      mapping:
-        source: ${source::processQuery}
-        attributes:
-          id: $1 # The process id is the monitor id
-          process.id: $1
-          process.name: $2
-          process.parent.id: $3
-          process.match.name: ${var::matchName}
-          process.match.command: ${var::matchCommand}
-        metrics:
-          process.thread.count: $4 # integer
-          process.paging.faults: $5 # integer
-          process.disk.operations{disk.io.direction="read"}: $6 # integer
-          process.disk.operations{disk.io.direction="write"}: $8 # integer
-          process.disk.io{disk.io.direction="read"}: $7 # bytes
-          process.disk.io{disk.io.direction="write"}: $9 # bytes
-          process.memory.usage: $11 # bytes
-          process.memory.virtual: $12 # bytes
-          process.cpu.time: $13 # seconds
-          process.cpu.utilization: rate($13) # ratio
+extends:
+- ../System/System
+connector:
+  displayName: Windows - Processes (WMI)
+  platforms: Any Windows system
+  reliesOn: WMI
+  information: Monitors essential performance metrics of any Windows system through WMI, following OpenTelemetry semantic conventions.
+  detection:
+    appliesTo:
+    - windows
+    disableAutoDetection: true
+    criteria:
+    - type: wmi
+      namespace: root\CIMv2
+      query: SELECT Name FROM Win32_OperatingSystem
+    tags: [ system, windows ]
+  variables:
+    matchName:
+      description: Regular expression pattern to match process names for monitoring.
+      defaultValue: .* 
+    matchCommand:
+      description: Regular expression pattern to match process command lines for monitoring.
+      defaultValue: .*
+    matchDomain:
+      description: Regular expression pattern to match domain names for monitoring.
+      defaultValue: .*
+    matchUser:
+      description: Regular expression pattern to match user names for monitoring.
+      defaultValue: .*
+monitors:
+  process:
+    simple:
+      sources:
+        processQuery:
+          # 1 ProcessId;Name;ParentProcessId;ExecutablePath;ThreadCount;
+          # 6 PageFaults;ReadOperationCount;ReadTransferCount;
+          # 9 WriteOperationCount;WriteTransferCount;CommandLine;
+          # 12 WorkingSetSize;VirtualSize;KernelModeTime;UserModeTime;HandleCount
+          type: wmi
+          namespace: root\CIMv2
+          query: | 
+            SELECT
+            ProcessId,
+            Name,
+            ParentProcessId,
+            ThreadCount,
+            PageFaults,
+            ReadOperationCount,
+            ReadTransferCount,
+            WriteOperationCount,
+            WriteTransferCount,
+            CommandLine,
+            WorkingSetSize,
+            VirtualSize,
+            KernelModeTime,
+            UserModeTime,
+            HandleCount,
+            SessionId,
+            __PATH
+            FROM Win32_Process
+          computes:
+          - type: keepOnlyMatchingLines
+            column: 2
+            regExp: ${var::matchName}
+          - type: keepOnlyMatchingLines
+            column: 10
+            regExp: ${var::matchCommand}
+          - type: add
+            column: 13
+            value: $14
+          - type: divide
+            column: 13 #  unit = 100-nanosecond intervals
+            value: 10000000 # divide by 10000000 to get a result in seconds
+        sessionProcessQuery:
+          type: wmi
+          namespace: root\CIMv2
+          query: |
+            SELECT
+            Dependent,
+            Antecedent
+            FROM Win32_SessionProcess
+        joinedProcessAndSessionProcess:
+          type: tableJoin
+          leftTable: ${source::processQuery}
+          rightTable: ${source::sessionProcessQuery}
+          leftKeyColumn: 17
+          rightKeyColumn: 1
+          isWbemKey: true
+        logonSessionQuery:
+          type: wmi
+          namespace: root\CIMv2
+          query: |
+            SELECT
+            __PATH
+            FROM Win32_LogonSession
+        joinedLogonSessionAndSessionProcess:
+          type: tableJoin
+          leftTable: ${source::joinedProcessAndSessionProcess}
+          rightTable:  ${source::logonSessionQuery}
+          leftKeyColumn: 19
+          rightKeyColumn: 1
+          isWbemKey: true
+        loggedOnUserQuery:
+          type: wmi
+          namespace: root\CIMv2
+          query: |
+            SELECT
+            Antecedent,
+            Dependent
+            FROM Win32_LoggedOnUser 
+        joinedLogonSessionAndLoggedOnUser:
+          type: tableJoin
+          leftTable: ${source::joinedLogonSessionAndSessionProcess}
+          rightTable: ${source::loggedOnUserQuery}
+          leftKeyColumn: 19
+          rightKeyColumn: 2
+          isWbemKey: true
+          computes:
+          - type: duplicateColumn
+            column: 21
+          - type: extractPropertyFromWbemPath
+            column: 21
+            property: Domain
+          - type: extractPropertyFromWbemPath
+            column: 22
+            property: Name
+          - type: keepOnlyMatchingLines
+            column: 21
+            regExp: ${var::matchDomain}
+          - type: keepOnlyMatchingLines
+            column: 22
+            regExp: ${var::matchUser}
+      mapping:
+        source: ${source::processQuery}
+        attributes:
+          id: $1 # The process id is the monitor id
+          process.id: $1
+          process.name: $2
+          process.parent.id: $3
+          process.match.name: ${var::matchName}
+          process.match.command: ${var::matchCommand}
+          process.match.domain: ${var::matchDomain}
+          process.match.user: ${var::matchUser}
+        metrics:
+          process.thread.count: $4 # integer
+          process.paging.faults: $5 # integer
+          process.disk.operations{disk.io.direction="read"}: $6 # integer
+          process.disk.operations{disk.io.direction="write"}: $8 # integer
+          process.disk.io{disk.io.direction="read"}: $7 # bytes
+          process.disk.io{disk.io.direction="write"}: $9 # bytes
+          process.memory.usage: $11 # bytes
+          process.memory.virtual: $12 # bytes
+          process.cpu.time: $13 # seconds
+          process.cpu.utilization: rate($13) # ratio
           process.handle.count: $15 # integer