Linux processes have the concept of effective and saved IDs for user (euid, suid) and group (sgid and egid).

We should consider adding support for these values to the process field set.

Discussion points:

• Should we also add support for file suid & sgid?
• I'm not sure if Windows has similar semantics at its disposal.
  • If so, we should consider them as well.
  • If not, I think there's still value in standardizing how this metadata is handled in posix environments

See also

• [Auditbeat] Add user information to processes beats#9963