fo:[ProcessTerminate]Sub

enario.cpp(1653)] Delete scenario(0x7f1fa401eb10), scenario id:A246ADC2-6919-AAAB-96F1-83DF0FC01B2A_910634_/usr/bin/ps, map size:5, set size:4 00816052 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910638,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de52e17ab06fps -p 910576 -o,ExitCode0,OpTime = 1792476361684[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816053 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910638, size: 1 00816054 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa419b0c0), scenario id:A246ADC9-3C88-0D66-96F1-83FED8BAFB6F_910638_/usr/bin/ps, map size:4, set size:3 00816055 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910639,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de52f17ab070ps -p 910576 -o,ExitCode0,OpTime = 1792476361714[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816056 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910639, size: 1 00816057 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa4137ba0), scenario id:A246ADD3-B162-8142-96F1-83A7F67A40DB_910639_/usr/bin/ps, map size:3, set size:2 00816058 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910648,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de53817ab070ps -p 910573 -o,ExitCode0,OpTime = 1792476361787[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816059 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910648, size: 1 00816060 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa419e070), scenario id:A246AD2B-FA76-8C9D-96F1-8463CAD60E8C_910648_/usr/bin/ps, map size:2, set size:1 00816061 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910653,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de53d17ab070ps -p 910573 -o,ExitCode0,OpTime = 1792476361828[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816062 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910653, size: 1 00816063 [2026-10-20 14:36:02] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa42b6010), scenario id:A246AD05-7E5D-208B-96F1-844F76DD109A_910653_/usr/bin/ps, map size:1, set size:0 00816076 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910877,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910851 -o comm=,ObjectCreateTime = 1792478220000,ObjectGuid = 0de61d17ab1e5ps -p 910851 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910851 -o comm=,OpTime = 1792476421498, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816077 [2026-10-20 14:37:01] [PID:3841663] [ERROR] [sfedbd] [util.cpp(976)] fopen failed 00816078 [2026-10-20 14:37:01] [PID:3841663] [ERROR] [sfedbd] [trigger.cpp(409)] QueryFileTime faield.File Path: 00816079 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816080 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910877:/usr/bin/ps 00816081 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa42afa30), ScenarioID:A246FE0A-FDE9-0F42-96F0-C0B7D1DB256B_910877_/usr/bin/ps, pid:910877, image:/usr/bin/ps, map size:1, set size:1, bEnableTimeout:0, no timeout scenario size:0 00816082 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910878,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910851 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de61e17ab1e6ps -p 910851 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910851 -o ppid=,OpTime = 1792476421546, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816083 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816084 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910878:/usr/bin/ps 00816085 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa418f9e0), ScenarioID:A246FE1E-58A7-AE25-96F0-C069193D08B4_910878_/usr/bin/ps, pid:910878, image:/usr/bin/ps, map size:2, set size:2, bEnableTimeout:0, no timeout scenario size:0 00816087 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910883,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910847 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de62317ab1e6ps -p 910847 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910847 -o ppid=,OpTime = 1792476421614, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816088 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816089 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910883:/usr/bin/ps 00816090 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa414eb00), ScenarioID:A246FE21-81FC-AA78-96F0-C0559FC95471_910883_/usr/bin/ps, pid:910883, image:/usr/bin/ps, map size:3, set size:3, bEnableTimeout:0, no timeout scenario size:0 00816091 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910884,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910847 -o comm=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de62417ab1e6ps -p 910847 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910847 -o comm=,OpTime = 1792476421640, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816092 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816093 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910884:/usr/bin/ps 00816094 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa41420e0), ScenarioID:A246FE3A-8DBC-1AFD-96F0-C3B4CA3EB56C_910884_/usr/bin/ps, pid:910884, image:/usr/bin/ps, map size:4, set size:4, bEnableTimeout:0, no timeout scenario size:0 00816095 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910875,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de61b17ab1e5ps -p 910851 -o,ExitCode0,OpTime = 1792476421493[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816096 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910877,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de61d17ab1e5ps -p 910851 -o,ExitCode0,OpTime = 1792476421540[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816097 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910877, size: 1 00816098 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa42afa30), scenario id:A246FE0A-FDE9-0F42-96F0-C0B7D1DB256B_910877_/usr/bin/ps, map size:4, set size:3 00816099 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910878,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de61e17ab1e6ps -p 910851 -o,ExitCode0,OpTime = 1792476421569[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816100 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910878, size: 1 00816101 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa418f9e0), scenario id:A246FE1E-58A7-AE25-96F0-C069193D08B4_910878_/usr/bin/ps, map size:3, set size:2 00816102 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910883,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de62317ab1e6ps -p 910847 -o,ExitCode0,OpTime = 1792476421635[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816103 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910883, size: 1 00816104 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa414eb00), scenario id:A246FE21-81FC-AA78-96F0-C0559FC95471_910883_/usr/bin/ps, map size:2, set size:1 00816105 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(519)] Event info:[ProcessTerminate]SubjectPid = 910884,SubjectTid = 0,SubjectImage = /usr/bin/ps,SubjectCmd = /usr/bin/ps ,SubjectCreateTime = 0,SubjectGuid = 0de62417ab1e6ps -p 910847 -o,ExitCode0,OpTime = 1792476421664[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816106 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1556)] Remove processs related scenarios, pid: 910884, size: 1 00816107 [2026-10-20 14:37:01] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1653)] Delete scenario(0x7f1fa41420e0), scenario id:A246FE3A-8DBC-1AFD-96F0-C3B4CA3EB56C_910884_/usr/bin/ps, map size:1, set size:0 00816110 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910889,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910839 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de62917ab1e7ps -p 910839 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910839 -o ppid=,OpTime = 1792476421745, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816111 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816112 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910889:/usr/bin/ps 00816113 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa41420e0), ScenarioID:A246FED2-A65F-B8B9-96F0-C3DA51042938_910889_/usr/bin/ps, pid:910889, image:/usr/bin/ps, map size:1, set size:1, bEnableTimeout:0, no timeout scenario size:0 00816114 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910894,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910839 -o comm=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de62e17ab1e7ps -p 910839 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910839 -o comm=,OpTime = 1792476421785, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816115 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816116 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910894:/usr/bin/ps 00816117 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa414eb00), ScenarioID:A246FEE5-228C-A86A-96F0-C33431B22613_910894_/usr/bin/ps, pid:910894, image:/usr/bin/ps, map size:2, set size:2, bEnableTimeout:0, no timeout scenario size:0 00816118 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910905,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910837 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de63917ab1e8ps -p 910837 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910837 -o ppid=,OpTime = 1792476421850, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816119 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816120 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910905:/usr/bin/ps 00816121 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa418f9e0), ScenarioID:A246FE82-8055-D06E-96F0-C37809DD69F7_910905_/usr/bin/ps, pid:910905, image:/usr/bin/ps, map size:3, set size:3, bEnableTimeout:0, no timeout scenario size:0 00816122 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910906,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910837 -o comm=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de63a17ab1e8ps -p 910837 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910837 -o comm=,OpTime = 1792476421902, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816123 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816124 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910906:/usr/bin/ps 00816125 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa42afa30), ScenarioID:A246FE90-9E63-7645-96F0-C296C8BC7394_910906_/usr/bin/ps, pid:910906, image:/usr/bin/ps, map size:4, set size:4, bEnableTimeout:0, no timeout scenario size:0 00816126 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910910,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910835 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de63e17ab1e8ps -p 910835 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910835 -o ppid=,OpTime = 1792476421963, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816127 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816128 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910910:/usr/bin/ps 00816129 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa414fd70), ScenarioID:A246FEAF-4FD7-6710-96F0-C2DD1E7AD889_910910_/usr/bin/ps, pid:910910, image:/usr/bin/ps, map size:5, set size:5, bEnableTimeout:0, no timeout scenario size:0 00816130 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910911,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910835 -o comm=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de63f17ab1e8ps -p 910835 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateTime = 0,Signature = ,SignStatus = 0,Replay = false,DecodedObjectCmd = ps -p 910835 -o comm=,OpTime = 1792476421990, FileSrcType = 0, FileHideFlag = 0, IconSpoofFlag = 0[docker]ContainerInitPid = 0,Containerid = host,Repository = ,ImageId = ,ContainerName = ,Privileged = 0,LoginName = ,SshIp = ,ImageName = 00816131 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(423)] ProcessCreate subject(parent process) match black, will create scenario 910873: 00816132 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(475)] ProcessCreate object(child process) match black, will create scenario 910911:/usr/bin/ps 00816133 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [scenario.cpp(1186)] Create new scenario(0x7f1fa41a5200), ScenarioID:A246FEB2-A2A5-2B54-96F0-C2F5CCDB1FDD_910911_/usr/bin/ps, pid:910911, image:/usr/bin/ps, map size:6, set size:6, bEnableTimeout:0, no timeout scenario size:0 00816134 [2026-10-20 14:37:03] [PID:3841663] [INFO] [sfedbd] [h1_processor.cpp(318)] Event info:[ProcessCreate]SubjectPid = 910873,SubjectTid = 0,SubjectImage = ,SubjectCmd = ,SubjectCreateTime = 9223372036854775808,SubjectGuid = 1de61995a2208,SubjectPermission = 0,ObjectPid = 910915,ObjectTid = 0,ObjectImage = /usr/bin/ps,ObjectCmd = ps -p 910833 -o ppid=,ObjectCreateTime = 1792478221000,ObjectGuid = 0de64317ab1e9ps -p 910833 -o,ObjectPermission = 755,CurrentDir = /root,ModifyTime = 0,CreateT