Update getting-started-linux-tutorial.rst : Rearrange linux.pstree plugin description

Moved plugin output example above the feature explanation for better flow and clarity.  
Simplified the description while retaining key points about process hierarchy and anomaly detection.
This commit is contained in:
Jaeyou PARK
2025-06-23 15:37:35 +09:00
committed by GitHub
parent 0f33734f3b
commit 3892237955
@@ -133,9 +133,7 @@ This detailed view allows investigators to correlate user privileges, startup ti
linux.pstree
~~~~~~~~~~~~
This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes.
It is especially useful for identifying unusual or suspicious process structures, such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution.
This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes.
.. code-block:: shell-session
@@ -155,7 +153,10 @@ It is especially useful for identifying unusual or suspicious process structures
**** 0x8ca671210000 1608 1608 1507 gnome-session-b
***** 0x8ca66fba42c0 1765 1765 1608 ssh-agent
The tree view can help identify anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships.
It helps identify unusual or suspicious process structures such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution.
The tree view is particularly useful for spotting anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships.
linux.bash