[
  {
    "model": "app.endpoint",
    "pk": 1,
    "fields": {
      "hostname": "EP-9773",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "4.14.0"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 2,
    "fields": {
      "hostname": "EP-2488",
      "operating_system": "windows_10",
      "department": "Operations",
      "agent_version": "3.10.10"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 3,
    "fields": {
      "hostname": "EP-4551",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "0.11.13"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 4,
    "fields": {
      "hostname": "EP-8522",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "8.11.15"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 5,
    "fields": {
      "hostname": "EP-8604",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "5.12.11"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 6,
    "fields": {
      "hostname": "EP-9325",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "3.19.14"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 7,
    "fields": {
      "hostname": "EP-3383",
      "operating_system": "windows_10",
      "department": "Finance",
      "agent_version": "2.3.10"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 8,
    "fields": {
      "hostname": "EP-3132",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "7.16.16"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 9,
    "fields": {
      "hostname": "EP-0115",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "9.14.16"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 10,
    "fields": {
      "hostname": "EP-3198",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "0.1.15"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 11,
    "fields": {
      "hostname": "EP-1551",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "7.18.4"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 12,
    "fields": {
      "hostname": "EP-3197",
      "operating_system": "windows_server_2022",
      "department": "Operations",
      "agent_version": "2.8.12"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 13,
    "fields": {
      "hostname": "EP-5750",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "7.20.5"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 14,
    "fields": {
      "hostname": "EP-5055",
      "operating_system": "windows_server_2022",
      "department": "Sales",
      "agent_version": "1.16.9"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 15,
    "fields": {
      "hostname": "EP-9122",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "4.5.6"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 16,
    "fields": {
      "hostname": "EP-4422",
      "operating_system": "windows_10",
      "department": "Finance",
      "agent_version": "2.11.3"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 17,
    "fields": {
      "hostname": "EP-6451",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "8.10.19"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 18,
    "fields": {
      "hostname": "EP-5661",
      "operating_system": "windows_10",
      "department": "Support",
      "agent_version": "3.0.5"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 19,
    "fields": {
      "hostname": "EP-8904",
      "operating_system": "windows_10",
      "department": "Sales",
      "agent_version": "5.20.6"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 20,
    "fields": {
      "hostname": "EP-9842",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "9.14.5"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 21,
    "fields": {
      "hostname": "EP-5663",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "5.9.4"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 22,
    "fields": {
      "hostname": "EP-6111",
      "operating_system": "windows_11",
      "department": "Support",
      "agent_version": "8.6.19"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 23,
    "fields": {
      "hostname": "EP-8476",
      "operating_system": "windows_server_2022",
      "department": "Support",
      "agent_version": "1.2.8"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 24,
    "fields": {
      "hostname": "EP-3816",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "6.7.18"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 25,
    "fields": {
      "hostname": "EP-6756",
      "operating_system": "windows_10",
      "department": "Support",
      "agent_version": "1.18.20"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 26,
    "fields": {
      "hostname": "EP-4063",
      "operating_system": "windows_server_2022",
      "department": "Finance",
      "agent_version": "5.16.13"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 27,
    "fields": {
      "hostname": "EP-7962",
      "operating_system": "windows_11",
      "department": "Support",
      "agent_version": "0.11.14"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 28,
    "fields": {
      "hostname": "EP-3578",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "2.20.7"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 29,
    "fields": {
      "hostname": "EP-5311",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "1.2.18"
    }
  },
  {
    "model": "app.endpoint",
    "pk": 30,
    "fields": {
      "hostname": "EP-0194",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "2.10.12"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 1,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "msedge.exe",
      "child_process": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 2,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "chrome.exe",
      "child_process": "chrome.exe",
      "category": "browsing",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 3,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "winword.exe",
      "child_process": "splwow64.exe",
      "category": "office",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 4,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "excel.exe",
      "child_process": "excelcnv.exe",
      "category": "office",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 5,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "code.exe",
      "child_process": "node.exe",
      "category": "development",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 6,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "outlook.exe",
      "child_process": "olk.exe",
      "category": "email",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 7,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "teams.exe",
      "child_process": "teams.exe",
      "category": "collaboration",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 8,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "explorer.exe",
      "child_process": "notepad.exe",
      "category": "file_management",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 9,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "conhost.exe",
      "category": "shell",
      "detection_label": "none"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 10,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "winword.exe",
      "child_process": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 11,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "outlook.exe",
      "child_process": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 12,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "excel.exe",
      "child_process": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 13,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 14,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility"
    }
  },
  {
    "model": "app.launchchain",
    "pk": 15,
    "fields": {
      "catalogue": "chains-v1",
      "app_process": "powershell.exe",
      "child_process": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task"
    }
  },
  {
    "model": "app.session",
    "pk": 1,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Leda.Bergnaum99",
      "root_pid": 1223,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:50:16Z"
    }
  },
  {
    "model": "app.session",
    "pk": 2,
    "fields": {
      "endpoint": 16,
      "hostname": "EP-4422",
      "logon_user": "Floyd.Kerluke8",
      "root_pid": 9253,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T14:01:25Z"
    }
  },
  {
    "model": "app.session",
    "pk": 3,
    "fields": {
      "endpoint": 8,
      "hostname": "EP-3132",
      "logon_user": "Madaline_Koepp",
      "root_pid": 3588,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T09:39:24Z"
    }
  },
  {
    "model": "app.session",
    "pk": 4,
    "fields": {
      "endpoint": 10,
      "hostname": "EP-3198",
      "logon_user": "Raven.Rempel82",
      "root_pid": 9279,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T13:35:16Z"
    }
  },
  {
    "model": "app.session",
    "pk": 5,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Megane.Ryan58",
      "root_pid": 4092,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T13:52:52Z"
    }
  },
  {
    "model": "app.session",
    "pk": 6,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Bernhard.Legros",
      "root_pid": 2205,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T14:40:47Z"
    }
  },
  {
    "model": "app.session",
    "pk": 7,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Efren_Walsh",
      "root_pid": 777,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T12:04:44Z"
    }
  },
  {
    "model": "app.session",
    "pk": 8,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Roberto.Blanda",
      "root_pid": 8148,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T09:18:05Z"
    }
  },
  {
    "model": "app.session",
    "pk": 9,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Kelly_Wiegand",
      "root_pid": 5882,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T15:47:13Z"
    }
  },
  {
    "model": "app.session",
    "pk": 10,
    "fields": {
      "endpoint": 18,
      "hostname": "EP-5661",
      "logon_user": "Bertram.Langworth-Satterfield8",
      "root_pid": 6676,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T17:22:19Z"
    }
  },
  {
    "model": "app.session",
    "pk": 11,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Sierra.Grant",
      "root_pid": 2105,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T15:23:02Z"
    }
  },
  {
    "model": "app.session",
    "pk": 12,
    "fields": {
      "endpoint": 21,
      "hostname": "EP-5663",
      "logon_user": "Rusty_Considine",
      "root_pid": 4059,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T16:45:44Z"
    }
  },
  {
    "model": "app.session",
    "pk": 13,
    "fields": {
      "endpoint": 22,
      "hostname": "EP-6111",
      "logon_user": "Rashad.Lueilwitz",
      "root_pid": 6372,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T12:33:57Z"
    }
  },
  {
    "model": "app.session",
    "pk": 14,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Lawson.Ledner4",
      "root_pid": 5631,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:34:02Z"
    }
  },
  {
    "model": "app.session",
    "pk": 15,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Randal.McLaughlin",
      "root_pid": 1207,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T13:13:27Z"
    }
  },
  {
    "model": "app.session",
    "pk": 16,
    "fields": {
      "endpoint": 11,
      "hostname": "EP-1551",
      "logon_user": "Brionna.Fay",
      "root_pid": 5993,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T10:47:10Z"
    }
  },
  {
    "model": "app.session",
    "pk": 17,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Berry.Stehr70",
      "root_pid": 7447,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T17:20:33Z"
    }
  },
  {
    "model": "app.session",
    "pk": 18,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Wilhelm_Fisher",
      "root_pid": 5353,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T13:43:36Z"
    }
  },
  {
    "model": "app.session",
    "pk": 19,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Chelsea_Spinka-OReilly",
      "root_pid": 5838,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T19:42:29Z"
    }
  },
  {
    "model": "app.session",
    "pk": 20,
    "fields": {
      "endpoint": 12,
      "hostname": "EP-3197",
      "logon_user": "Antonina_Kihn",
      "root_pid": 2248,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T18:53:08Z"
    }
  },
  {
    "model": "app.session",
    "pk": 21,
    "fields": {
      "endpoint": 8,
      "hostname": "EP-3132",
      "logon_user": "Jayda.Gulgowski82",
      "root_pid": 1578,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T11:47:42Z"
    }
  },
  {
    "model": "app.session",
    "pk": 22,
    "fields": {
      "endpoint": 16,
      "hostname": "EP-4422",
      "logon_user": "Kaley_Langosh40",
      "root_pid": 3475,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T15:16:16Z"
    }
  },
  {
    "model": "app.session",
    "pk": 23,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Jan.Watsica50",
      "root_pid": 3826,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T09:46:14Z"
    }
  },
  {
    "model": "app.session",
    "pk": 24,
    "fields": {
      "endpoint": 11,
      "hostname": "EP-1551",
      "logon_user": "Christian.Ortiz97",
      "root_pid": 4927,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T17:05:37Z"
    }
  },
  {
    "model": "app.session",
    "pk": 25,
    "fields": {
      "endpoint": 2,
      "hostname": "EP-2488",
      "logon_user": "Gillian_Hoppe31",
      "root_pid": 3737,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T10:47:51Z"
    }
  },
  {
    "model": "app.session",
    "pk": 26,
    "fields": {
      "endpoint": 2,
      "hostname": "EP-2488",
      "logon_user": "Cloyd.Renner",
      "root_pid": 3041,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T14:53:11Z"
    }
  },
  {
    "model": "app.session",
    "pk": 27,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Alexander_Rippin95",
      "root_pid": 6515,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T12:19:48Z"
    }
  },
  {
    "model": "app.session",
    "pk": 28,
    "fields": {
      "endpoint": 29,
      "hostname": "EP-5311",
      "logon_user": "Nikko_Cormier-Schmeler36",
      "root_pid": 1782,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:00:55Z"
    }
  },
  {
    "model": "app.session",
    "pk": 29,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Lyle_Bergstrom",
      "root_pid": 4443,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T15:51:06Z"
    }
  },
  {
    "model": "app.session",
    "pk": 30,
    "fields": {
      "endpoint": 5,
      "hostname": "EP-8604",
      "logon_user": "Jaylin_Bradtke83",
      "root_pid": 5435,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T16:43:42Z"
    }
  },
  {
    "model": "app.session",
    "pk": 31,
    "fields": {
      "endpoint": 17,
      "hostname": "EP-6451",
      "logon_user": "Van_Wyman14",
      "root_pid": 9042,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T10:37:53Z"
    }
  },
  {
    "model": "app.session",
    "pk": 32,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Felipa_Feil51",
      "root_pid": 7143,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T19:05:27Z"
    }
  },
  {
    "model": "app.session",
    "pk": 33,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Leonard.Funk",
      "root_pid": 3235,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T08:57:48Z"
    }
  },
  {
    "model": "app.session",
    "pk": 34,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Casimer.Beahan",
      "root_pid": 9204,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T16:00:03Z"
    }
  },
  {
    "model": "app.session",
    "pk": 35,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Jerrell.Dare87",
      "root_pid": 5419,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T11:26:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 36,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Randy.Kunze86",
      "root_pid": 4428,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T16:55:52Z"
    }
  },
  {
    "model": "app.session",
    "pk": 37,
    "fields": {
      "endpoint": 2,
      "hostname": "EP-2488",
      "logon_user": "Taurean_Ortiz61",
      "root_pid": 2950,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T16:10:28Z"
    }
  },
  {
    "model": "app.session",
    "pk": 38,
    "fields": {
      "endpoint": 21,
      "hostname": "EP-5663",
      "logon_user": "Mozell.Williamson",
      "root_pid": 8575,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T07:37:27Z"
    }
  },
  {
    "model": "app.session",
    "pk": 39,
    "fields": {
      "endpoint": 12,
      "hostname": "EP-3197",
      "logon_user": "Leonardo.Kulas",
      "root_pid": 4269,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T10:44:09Z"
    }
  },
  {
    "model": "app.session",
    "pk": 40,
    "fields": {
      "endpoint": 18,
      "hostname": "EP-5661",
      "logon_user": "Ayana_Okuneva",
      "root_pid": 9039,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T13:26:06Z"
    }
  },
  {
    "model": "app.session",
    "pk": 41,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Ambrose_Johnston",
      "root_pid": 5450,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T05:39:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 42,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Shelly.Crist",
      "root_pid": 5987,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T13:32:39Z"
    }
  },
  {
    "model": "app.session",
    "pk": 43,
    "fields": {
      "endpoint": 5,
      "hostname": "EP-8604",
      "logon_user": "Felipe.Hayes87",
      "root_pid": 2202,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T16:38:58Z"
    }
  },
  {
    "model": "app.session",
    "pk": 44,
    "fields": {
      "endpoint": 6,
      "hostname": "EP-9325",
      "logon_user": "Roma.Cole",
      "root_pid": 2524,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T07:49:08Z"
    }
  },
  {
    "model": "app.session",
    "pk": 45,
    "fields": {
      "endpoint": 11,
      "hostname": "EP-1551",
      "logon_user": "Taylor.Prosacco",
      "root_pid": 8295,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T17:25:33Z"
    }
  },
  {
    "model": "app.session",
    "pk": 46,
    "fields": {
      "endpoint": 15,
      "hostname": "EP-9122",
      "logon_user": "Lauryn.Moore65",
      "root_pid": 1692,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T18:19:26Z"
    }
  },
  {
    "model": "app.session",
    "pk": 47,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Jarrett.Wiegand",
      "root_pid": 8438,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T16:03:21Z"
    }
  },
  {
    "model": "app.session",
    "pk": 48,
    "fields": {
      "endpoint": 10,
      "hostname": "EP-3198",
      "logon_user": "Aric.Altenwerth2",
      "root_pid": 1271,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T06:31:31Z"
    }
  },
  {
    "model": "app.session",
    "pk": 49,
    "fields": {
      "endpoint": 13,
      "hostname": "EP-5750",
      "logon_user": "Cierra_Franecki48",
      "root_pid": 7754,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T15:46:14Z"
    }
  },
  {
    "model": "app.session",
    "pk": 50,
    "fields": {
      "endpoint": 17,
      "hostname": "EP-6451",
      "logon_user": "Margarett.Russel",
      "root_pid": 2098,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T16:38:52Z"
    }
  },
  {
    "model": "app.session",
    "pk": 51,
    "fields": {
      "endpoint": 24,
      "hostname": "EP-3816",
      "logon_user": "Joesph_Kreiger9",
      "root_pid": 3525,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T10:18:42Z"
    }
  },
  {
    "model": "app.session",
    "pk": 52,
    "fields": {
      "endpoint": 28,
      "hostname": "EP-3578",
      "logon_user": "Lolita.Treutel73",
      "root_pid": 2323,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T17:20:07Z"
    }
  },
  {
    "model": "app.session",
    "pk": 53,
    "fields": {
      "endpoint": 23,
      "hostname": "EP-8476",
      "logon_user": "Roosevelt.Collins47",
      "root_pid": 5187,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T14:51:06Z"
    }
  },
  {
    "model": "app.session",
    "pk": 54,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Brook.Yost",
      "root_pid": 2990,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T14:15:22Z"
    }
  },
  {
    "model": "app.session",
    "pk": 55,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Adolf_Lakin15",
      "root_pid": 4258,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T10:27:15Z"
    }
  },
  {
    "model": "app.session",
    "pk": 56,
    "fields": {
      "endpoint": 30,
      "hostname": "EP-0194",
      "logon_user": "Uriel.Hansen",
      "root_pid": 2847,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T17:25:09Z"
    }
  },
  {
    "model": "app.session",
    "pk": 57,
    "fields": {
      "endpoint": 27,
      "hostname": "EP-7962",
      "logon_user": "Jeannette.OKeefe70",
      "root_pid": 8454,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T15:47:54Z"
    }
  },
  {
    "model": "app.session",
    "pk": 58,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Fred_Howell32",
      "root_pid": 5507,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T17:52:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 59,
    "fields": {
      "endpoint": 2,
      "hostname": "EP-2488",
      "logon_user": "Kameron.Kautzer",
      "root_pid": 3499,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T13:53:20Z"
    }
  },
  {
    "model": "app.session",
    "pk": 60,
    "fields": {
      "endpoint": 25,
      "hostname": "EP-6756",
      "logon_user": "Nicolas_Hammes",
      "root_pid": 1935,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T23:22:02Z"
    }
  },
  {
    "model": "app.session",
    "pk": 61,
    "fields": {
      "endpoint": 29,
      "hostname": "EP-5311",
      "logon_user": "Solon.Rohan47",
      "root_pid": 6985,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T08:45:10Z"
    }
  },
  {
    "model": "app.session",
    "pk": 62,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Myrna_Orn",
      "root_pid": 5166,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T13:42:42Z"
    }
  },
  {
    "model": "app.session",
    "pk": 63,
    "fields": {
      "endpoint": 20,
      "hostname": "EP-9842",
      "logon_user": "Mitchell.Glover-Kuhic",
      "root_pid": 6555,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T16:25:05Z"
    }
  },
  {
    "model": "app.session",
    "pk": 64,
    "fields": {
      "endpoint": 4,
      "hostname": "EP-8522",
      "logon_user": "Jacey_Nienow73",
      "root_pid": 2187,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T17:46:02Z"
    }
  },
  {
    "model": "app.session",
    "pk": 65,
    "fields": {
      "endpoint": 28,
      "hostname": "EP-3578",
      "logon_user": "Malachi.Tremblay12",
      "root_pid": 2048,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T11:49:50Z"
    }
  },
  {
    "model": "app.session",
    "pk": 66,
    "fields": {
      "endpoint": 25,
      "hostname": "EP-6756",
      "logon_user": "Cristopher.Ankunding",
      "root_pid": 2140,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T10:09:34Z"
    }
  },
  {
    "model": "app.session",
    "pk": 67,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Lionel_Bosco",
      "root_pid": 9805,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:54:10Z"
    }
  },
  {
    "model": "app.session",
    "pk": 68,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Andreane.Cartwright30",
      "root_pid": 3905,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T14:58:41Z"
    }
  },
  {
    "model": "app.session",
    "pk": 69,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Lelah.Okuneva",
      "root_pid": 807,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T09:36:41Z"
    }
  },
  {
    "model": "app.session",
    "pk": 70,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Vince.Johns",
      "root_pid": 9033,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T10:57:01Z"
    }
  },
  {
    "model": "app.session",
    "pk": 71,
    "fields": {
      "endpoint": 2,
      "hostname": "EP-2488",
      "logon_user": "Jules_Hettinger56",
      "root_pid": 9165,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:21:00Z"
    }
  },
  {
    "model": "app.session",
    "pk": 72,
    "fields": {
      "endpoint": 23,
      "hostname": "EP-8476",
      "logon_user": "Name_Walter57",
      "root_pid": 9273,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T10:53:20Z"
    }
  },
  {
    "model": "app.session",
    "pk": 73,
    "fields": {
      "endpoint": 15,
      "hostname": "EP-9122",
      "logon_user": "Mae_Jones",
      "root_pid": 2342,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T15:02:44Z"
    }
  },
  {
    "model": "app.session",
    "pk": 74,
    "fields": {
      "endpoint": 8,
      "hostname": "EP-3132",
      "logon_user": "Emerald.Stehr7",
      "root_pid": 8020,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T13:21:33Z"
    }
  },
  {
    "model": "app.session",
    "pk": 75,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Palma_Schuppe",
      "root_pid": 799,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T11:12:44Z"
    }
  },
  {
    "model": "app.session",
    "pk": 76,
    "fields": {
      "endpoint": 17,
      "hostname": "EP-6451",
      "logon_user": "Ellis.Parker",
      "root_pid": 7760,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T11:04:29Z"
    }
  },
  {
    "model": "app.session",
    "pk": 77,
    "fields": {
      "endpoint": 11,
      "hostname": "EP-1551",
      "logon_user": "Idell.Mitchell",
      "root_pid": 6081,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T10:34:42Z"
    }
  },
  {
    "model": "app.session",
    "pk": 78,
    "fields": {
      "endpoint": 28,
      "hostname": "EP-3578",
      "logon_user": "Charlene_MacGyver",
      "root_pid": 4336,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T13:09:16Z"
    }
  },
  {
    "model": "app.session",
    "pk": 79,
    "fields": {
      "endpoint": 24,
      "hostname": "EP-3816",
      "logon_user": "Chelsea.Rath9",
      "root_pid": 1688,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T14:01:46Z"
    }
  },
  {
    "model": "app.session",
    "pk": 80,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Johnpaul.Feil",
      "root_pid": 5566,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T13:56:21Z"
    }
  },
  {
    "model": "app.session",
    "pk": 81,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Lewis.Torp",
      "root_pid": 1248,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T16:50:43Z"
    }
  },
  {
    "model": "app.session",
    "pk": 82,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Kristian.Fadel",
      "root_pid": 3087,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T14:45:58Z"
    }
  },
  {
    "model": "app.session",
    "pk": 83,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Meda.Dibbert50",
      "root_pid": 8003,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T09:20:21Z"
    }
  },
  {
    "model": "app.session",
    "pk": 84,
    "fields": {
      "endpoint": 29,
      "hostname": "EP-5311",
      "logon_user": "Summer_Bartell64",
      "root_pid": 6330,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T10:38:51Z"
    }
  },
  {
    "model": "app.session",
    "pk": 85,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Filiberto_Abbott",
      "root_pid": 7128,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T15:15:37Z"
    }
  },
  {
    "model": "app.session",
    "pk": 86,
    "fields": {
      "endpoint": 24,
      "hostname": "EP-3816",
      "logon_user": "Darryl.Kuhlman",
      "root_pid": 4959,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T10:03:06Z"
    }
  },
  {
    "model": "app.session",
    "pk": 87,
    "fields": {
      "endpoint": 8,
      "hostname": "EP-3132",
      "logon_user": "Lelah_Raynor10",
      "root_pid": 9087,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T14:51:53Z"
    }
  },
  {
    "model": "app.session",
    "pk": 88,
    "fields": {
      "endpoint": 27,
      "hostname": "EP-7962",
      "logon_user": "Isabelle_Kub",
      "root_pid": 4101,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T09:28:50Z"
    }
  },
  {
    "model": "app.session",
    "pk": 89,
    "fields": {
      "endpoint": 18,
      "hostname": "EP-5661",
      "logon_user": "Sonia.Stamm60",
      "root_pid": 7044,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T14:54:34Z"
    }
  },
  {
    "model": "app.session",
    "pk": 90,
    "fields": {
      "endpoint": 14,
      "hostname": "EP-5055",
      "logon_user": "Anjali.Moore67",
      "root_pid": 5514,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T08:40:22Z"
    }
  },
  {
    "model": "app.session",
    "pk": 91,
    "fields": {
      "endpoint": 19,
      "hostname": "EP-8904",
      "logon_user": "Stanton.Grady49",
      "root_pid": 7689,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T09:45:51Z"
    }
  },
  {
    "model": "app.session",
    "pk": 92,
    "fields": {
      "endpoint": 29,
      "hostname": "EP-5311",
      "logon_user": "Mark.Hegmann84",
      "root_pid": 7465,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T17:05:06Z"
    }
  },
  {
    "model": "app.session",
    "pk": 93,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Christina_Kunze55",
      "root_pid": 9342,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T13:37:29Z"
    }
  },
  {
    "model": "app.session",
    "pk": 94,
    "fields": {
      "endpoint": 4,
      "hostname": "EP-8522",
      "logon_user": "Guillermo.Brakus",
      "root_pid": 8955,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T07:05:56Z"
    }
  },
  {
    "model": "app.session",
    "pk": 95,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Pete.Bednar",
      "root_pid": 9803,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T20:13:45Z"
    }
  },
  {
    "model": "app.session",
    "pk": 96,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Marielle.Leuschke",
      "root_pid": 9109,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T07:52:01Z"
    }
  },
  {
    "model": "app.session",
    "pk": 97,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Shea_Deckow35",
      "root_pid": 3764,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T15:43:48Z"
    }
  },
  {
    "model": "app.session",
    "pk": 98,
    "fields": {
      "endpoint": 17,
      "hostname": "EP-6451",
      "logon_user": "Katrina.Dach21",
      "root_pid": 8504,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T16:11:44Z"
    }
  },
  {
    "model": "app.session",
    "pk": 99,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Zackary.Dickinson53",
      "root_pid": 8717,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T21:39:40Z"
    }
  },
  {
    "model": "app.session",
    "pk": 100,
    "fields": {
      "endpoint": 13,
      "hostname": "EP-5750",
      "logon_user": "Denis_Kunde98",
      "root_pid": 4103,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T15:13:20Z"
    }
  },
  {
    "model": "app.session",
    "pk": 101,
    "fields": {
      "endpoint": 25,
      "hostname": "EP-6756",
      "logon_user": "Garry_Nicolas",
      "root_pid": 7446,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T12:55:46Z"
    }
  },
  {
    "model": "app.session",
    "pk": 102,
    "fields": {
      "endpoint": 6,
      "hostname": "EP-9325",
      "logon_user": "Jo.Wilderman68",
      "root_pid": 2779,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:45:52Z"
    }
  },
  {
    "model": "app.session",
    "pk": 103,
    "fields": {
      "endpoint": 13,
      "hostname": "EP-5750",
      "logon_user": "Newell_Rippin71",
      "root_pid": 3347,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T15:29:21Z"
    }
  },
  {
    "model": "app.session",
    "pk": 104,
    "fields": {
      "endpoint": 21,
      "hostname": "EP-5663",
      "logon_user": "Florence.Hackett5",
      "root_pid": 7548,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T10:32:09Z"
    }
  },
  {
    "model": "app.session",
    "pk": 105,
    "fields": {
      "endpoint": 18,
      "hostname": "EP-5661",
      "logon_user": "Gavin.Windler",
      "root_pid": 9411,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T10:34:49Z"
    }
  },
  {
    "model": "app.session",
    "pk": 106,
    "fields": {
      "endpoint": 12,
      "hostname": "EP-3197",
      "logon_user": "Junior.Haley31",
      "root_pid": 8968,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T13:43:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 107,
    "fields": {
      "endpoint": 11,
      "hostname": "EP-1551",
      "logon_user": "Nellie_Senger",
      "root_pid": 7525,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T11:50:39Z"
    }
  },
  {
    "model": "app.session",
    "pk": 108,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Fern.Boehm92",
      "root_pid": 9857,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T18:52:32Z"
    }
  },
  {
    "model": "app.session",
    "pk": 109,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Vicki.Glover23",
      "root_pid": 9809,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T13:09:52Z"
    }
  },
  {
    "model": "app.session",
    "pk": 110,
    "fields": {
      "endpoint": 5,
      "hostname": "EP-8604",
      "logon_user": "Brenna.Huels79",
      "root_pid": 4857,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T11:41:38Z"
    }
  },
  {
    "model": "app.session",
    "pk": 111,
    "fields": {
      "endpoint": 25,
      "hostname": "EP-6756",
      "logon_user": "Estell_Conroy",
      "root_pid": 4893,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T10:16:51Z"
    }
  },
  {
    "model": "app.session",
    "pk": 112,
    "fields": {
      "endpoint": 3,
      "hostname": "EP-4551",
      "logon_user": "Hubert_Bergnaum",
      "root_pid": 8684,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T15:28:27Z"
    }
  },
  {
    "model": "app.session",
    "pk": 113,
    "fields": {
      "endpoint": 22,
      "hostname": "EP-6111",
      "logon_user": "Kris.Roob60",
      "root_pid": 4002,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T11:05:51Z"
    }
  },
  {
    "model": "app.session",
    "pk": 114,
    "fields": {
      "endpoint": 26,
      "hostname": "EP-4063",
      "logon_user": "Kathy_Beahan54",
      "root_pid": 1599,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T15:46:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 115,
    "fields": {
      "endpoint": 28,
      "hostname": "EP-3578",
      "logon_user": "Antonia_Stamm13",
      "root_pid": 6071,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T13:24:36Z"
    }
  },
  {
    "model": "app.session",
    "pk": 116,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Herminio.Cummings26",
      "root_pid": 1596,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T10:34:41Z"
    }
  },
  {
    "model": "app.session",
    "pk": 117,
    "fields": {
      "endpoint": 25,
      "hostname": "EP-6756",
      "logon_user": "Roberta_Wintheiser8",
      "root_pid": 6672,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T18:57:04Z"
    }
  },
  {
    "model": "app.session",
    "pk": 118,
    "fields": {
      "endpoint": 18,
      "hostname": "EP-5661",
      "logon_user": "Fletcher_Zulauf",
      "root_pid": 4211,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T15:40:57Z"
    }
  },
  {
    "model": "app.session",
    "pk": 119,
    "fields": {
      "endpoint": 21,
      "hostname": "EP-5663",
      "logon_user": "Kacie_Quitzon",
      "root_pid": 6808,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T19:29:09Z"
    }
  },
  {
    "model": "app.session",
    "pk": 120,
    "fields": {
      "endpoint": 9,
      "hostname": "EP-0115",
      "logon_user": "Billy_Cartwright88",
      "root_pid": 5090,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T15:39:46Z"
    }
  },
  {
    "model": "app.session",
    "pk": 121,
    "fields": {
      "endpoint": 5,
      "hostname": "EP-8604",
      "logon_user": "Heath_Adams",
      "root_pid": 6355,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T13:09:08Z"
    }
  },
  {
    "model": "app.session",
    "pk": 122,
    "fields": {
      "endpoint": 17,
      "hostname": "EP-6451",
      "logon_user": "Tami.Ritchie79",
      "root_pid": 6690,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T12:51:30Z"
    }
  },
  {
    "model": "app.session",
    "pk": 123,
    "fields": {
      "endpoint": 4,
      "hostname": "EP-8522",
      "logon_user": "Osborne.Schuster",
      "root_pid": 9605,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10T14:09:48Z"
    }
  },
  {
    "model": "app.session",
    "pk": 124,
    "fields": {
      "endpoint": 7,
      "hostname": "EP-3383",
      "logon_user": "Margarete_Von49",
      "root_pid": 3310,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T08:55:54Z"
    }
  },
  {
    "model": "app.session",
    "pk": 125,
    "fields": {
      "endpoint": 10,
      "hostname": "EP-3198",
      "logon_user": "Sim_Schimmel62",
      "root_pid": 6716,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T12:54:49Z"
    }
  },
  {
    "model": "app.session",
    "pk": 126,
    "fields": {
      "endpoint": 12,
      "hostname": "EP-3197",
      "logon_user": "Lacy_Stehr16",
      "root_pid": 9993,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T14:00:45Z"
    }
  },
  {
    "model": "app.session",
    "pk": 127,
    "fields": {
      "endpoint": 22,
      "hostname": "EP-6111",
      "logon_user": "Sonia_Cormier7",
      "root_pid": 1504,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T09:36:38Z"
    }
  },
  {
    "model": "app.session",
    "pk": 128,
    "fields": {
      "endpoint": 10,
      "hostname": "EP-3198",
      "logon_user": "Gardner_Hagenes85",
      "root_pid": 3770,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09T11:34:32Z"
    }
  },
  {
    "model": "app.session",
    "pk": 129,
    "fields": {
      "endpoint": 1,
      "hostname": "EP-9773",
      "logon_user": "Corbin_Kassulke",
      "root_pid": 5131,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08T18:51:47Z"
    }
  },
  {
    "model": "app.session",
    "pk": 130,
    "fields": {
      "endpoint": 8,
      "hostname": "EP-3132",
      "logon_user": "Rashad.Shields",
      "root_pid": 6080,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12T10:07:23Z"
    }
  },
  {
    "model": "app.session",
    "pk": 131,
    "fields": {
      "endpoint": 3,
      "hostname": "EP-4551",
      "logon_user": "Gunner_Mayer16",
      "root_pid": 807,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T15:46:39Z"
    }
  },
  {
    "model": "app.session",
    "pk": 132,
    "fields": {
      "endpoint": 5,
      "hostname": "EP-8604",
      "logon_user": "Lorna.Cummerata71",
      "root_pid": 9527,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11T11:55:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 1,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 59762,
      "integrity_level": "medium",
      "started_at": "2025-09-10T11:50:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 2,
    "fields": {
      "session": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 36180,
      "integrity_level": "medium",
      "started_at": "2025-09-11T08:15:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 3,
    "fields": {
      "session": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43396,
      "integrity_level": "medium",
      "started_at": "2025-09-12T11:22:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 4,
    "fields": {
      "session": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13733,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:41:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 5,
    "fields": {
      "session": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 4607,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:51:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 6,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26184,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:14:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 7,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 41495,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:30:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 8,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27161,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:47:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 9,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51181,
      "integrity_level": "medium",
      "started_at": "2025-09-12T11:03:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 10,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 39319,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:07:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 11,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25035,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:12:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 12,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 52296,
      "integrity_level": "medium",
      "started_at": "2025-09-11T14:10:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 13,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 63035,
      "integrity_level": "low",
      "started_at": "2025-09-08T16:27:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 14,
    "fields": {
      "session": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45424,
      "integrity_level": "high",
      "started_at": "2025-09-08T12:01:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 15,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 32021,
      "integrity_level": "low",
      "started_at": "2025-09-08T17:36:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 16,
    "fields": {
      "session": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 16776,
      "integrity_level": "low",
      "started_at": "2025-09-12T12:29:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 17,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45058,
      "integrity_level": "low",
      "started_at": "2025-09-08T06:55:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 18,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 39435,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:09:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 19,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 44084,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:45:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 20,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31578,
      "integrity_level": "medium",
      "started_at": "2025-09-11T08:58:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 21,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33716,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:59:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 22,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 5433,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:07:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 23,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21327,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:16:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 24,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45339,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:11:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 25,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 8704,
      "integrity_level": "medium",
      "started_at": "2025-09-09T18:50:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 26,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28134,
      "integrity_level": "medium",
      "started_at": "2025-09-12T17:43:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 27,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 31659,
      "integrity_level": "low",
      "started_at": "2025-09-12T19:53:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 28,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 55377,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:10:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 29,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 10195,
      "integrity_level": "low",
      "started_at": "2025-09-10T13:25:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 30,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 52146,
      "integrity_level": "medium",
      "started_at": "2025-09-11T11:45:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 31,
    "fields": {
      "session": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14661,
      "integrity_level": "low",
      "started_at": "2025-09-09T13:00:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 32,
    "fields": {
      "session": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6449,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:37:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 33,
    "fields": {
      "session": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6437,
      "integrity_level": "high",
      "started_at": "2025-09-08T15:40:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 34,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 23104,
      "integrity_level": "low",
      "started_at": "2025-09-08T20:12:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 35,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 59744,
      "integrity_level": "low",
      "started_at": "2025-09-11T11:57:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 36,
    "fields": {
      "session": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 26578,
      "integrity_level": "medium",
      "started_at": "2025-09-08T10:18:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 37,
    "fields": {
      "session": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64176,
      "integrity_level": "medium",
      "started_at": "2025-09-09T12:31:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 38,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52701,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:48:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 39,
    "fields": {
      "session": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 41614,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:57:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 40,
    "fields": {
      "session": 126,
      "endpoint_id": 12,
      "parent_pid": 9993,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 24267,
      "integrity_level": "medium",
      "started_at": "2025-09-12T14:13:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 41,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37138,
      "integrity_level": "low",
      "started_at": "2025-09-09T17:53:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 42,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43487,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:24:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 43,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 57823,
      "integrity_level": "high",
      "started_at": "2025-09-11T16:36:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 44,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34278,
      "integrity_level": "medium",
      "started_at": "2025-09-08T14:09:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 45,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 10542,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:28:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 46,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61930,
      "integrity_level": "low",
      "started_at": "2025-09-12T21:05:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 47,
    "fields": {
      "session": 52,
      "endpoint_id": 28,
      "parent_pid": 2323,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26066,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:34:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 48,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6832,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:53:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 49,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44112,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:49:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 50,
    "fields": {
      "session": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4770,
      "integrity_level": "low",
      "started_at": "2025-09-11T18:03:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 51,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 9327,
      "integrity_level": "medium",
      "started_at": "2025-09-09T19:48:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 52,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 34765,
      "integrity_level": "low",
      "started_at": "2025-09-11T20:58:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 53,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62824,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:16:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 54,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14883,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:02:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 55,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 31902,
      "integrity_level": "low",
      "started_at": "2025-09-11T18:27:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 56,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 61151,
      "integrity_level": "high",
      "started_at": "2025-09-08T07:59:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 57,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 7006,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:44:43Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 58,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47835,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:18:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 59,
    "fields": {
      "session": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 53339,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:30:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 60,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 20713,
      "integrity_level": "medium",
      "started_at": "2025-09-08T21:13:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 61,
    "fields": {
      "session": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 62437,
      "integrity_level": "medium",
      "started_at": "2025-09-12T16:39:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 62,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 13633,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:25:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 63,
    "fields": {
      "session": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24941,
      "integrity_level": "medium",
      "started_at": "2025-09-10T21:01:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 64,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 27918,
      "integrity_level": "low",
      "started_at": "2025-09-09T13:37:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 65,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32057,
      "integrity_level": "medium",
      "started_at": "2025-09-11T22:23:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 66,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47490,
      "integrity_level": "low",
      "started_at": "2025-09-11T23:31:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 67,
    "fields": {
      "session": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44935,
      "integrity_level": "medium",
      "started_at": "2025-09-09T16:45:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 68,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28650,
      "integrity_level": "high",
      "started_at": "2025-09-10T17:45:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 69,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 34591,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:37:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 70,
    "fields": {
      "session": 32,
      "endpoint_id": 20,
      "parent_pid": 7143,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7497,
      "integrity_level": "low",
      "started_at": "2025-09-12T20:22:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 71,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20163,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:23:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 72,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15433,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:39:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 73,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47384,
      "integrity_level": "low",
      "started_at": "2025-09-08T16:19:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 74,
    "fields": {
      "session": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 39720,
      "integrity_level": "medium",
      "started_at": "2025-09-12T10:42:43Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 75,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13860,
      "integrity_level": "low",
      "started_at": "2025-09-08T11:17:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 76,
    "fields": {
      "session": 42,
      "endpoint_id": 20,
      "parent_pid": 5987,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 27802,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:38:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 77,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64195,
      "integrity_level": "low",
      "started_at": "2025-09-08T09:18:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 78,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 6027,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:59:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 79,
    "fields": {
      "session": 124,
      "endpoint_id": 7,
      "parent_pid": 3310,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32308,
      "integrity_level": "medium",
      "started_at": "2025-09-09T09:46:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 80,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5293,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:07:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 81,
    "fields": {
      "session": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 60792,
      "integrity_level": "medium",
      "started_at": "2025-09-09T10:47:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 82,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 46471,
      "integrity_level": "low",
      "started_at": "2025-09-10T11:40:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 83,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 25522,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:34:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 84,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27434,
      "integrity_level": "medium",
      "started_at": "2025-09-12T17:46:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 85,
    "fields": {
      "session": 12,
      "endpoint_id": 21,
      "parent_pid": 4059,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 1264,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:08:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 86,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 13878,
      "integrity_level": "medium",
      "started_at": "2025-09-10T17:02:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 87,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 42358,
      "integrity_level": "high",
      "started_at": "2025-09-08T15:17:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 88,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 9701,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:45:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 89,
    "fields": {
      "session": 6,
      "endpoint_id": 19,
      "parent_pid": 2205,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 7169,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:30:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 90,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62491,
      "integrity_level": "medium",
      "started_at": "2025-09-10T11:56:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 91,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24205,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:02:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 92,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49989,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:12:28Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 93,
    "fields": {
      "session": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20325,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:04:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 94,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23005,
      "integrity_level": "medium",
      "started_at": "2025-09-12T00:51:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 95,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6543,
      "integrity_level": "low",
      "started_at": "2025-09-10T17:49:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 96,
    "fields": {
      "session": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 53626,
      "integrity_level": "medium",
      "started_at": "2025-09-08T11:18:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 97,
    "fields": {
      "session": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 10964,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:33:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 98,
    "fields": {
      "session": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41939,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:18:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 99,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20374,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:48:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 100,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 54664,
      "integrity_level": "high",
      "started_at": "2025-09-08T14:12:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 101,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20280,
      "integrity_level": "low",
      "started_at": "2025-09-10T14:52:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 102,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16232,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:21:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 103,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37100,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:35:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 104,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53814,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:38:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 105,
    "fields": {
      "session": 92,
      "endpoint_id": 29,
      "parent_pid": 7465,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39442,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:08:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 106,
    "fields": {
      "session": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11209,
      "integrity_level": "high",
      "started_at": "2025-09-12T17:12:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 107,
    "fields": {
      "session": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22672,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:27:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 108,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25979,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:36:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 109,
    "fields": {
      "session": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 47511,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:04:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 110,
    "fields": {
      "session": 44,
      "endpoint_id": 6,
      "parent_pid": 2524,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5764,
      "integrity_level": "medium",
      "started_at": "2025-09-12T09:03:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 111,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24998,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:46:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 112,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 14943,
      "integrity_level": "medium",
      "started_at": "2025-09-10T11:57:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 113,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32416,
      "integrity_level": "high",
      "started_at": "2025-09-08T16:36:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 114,
    "fields": {
      "session": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58166,
      "integrity_level": "high",
      "started_at": "2025-09-12T17:45:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 115,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63965,
      "integrity_level": "high",
      "started_at": "2025-09-10T13:17:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 116,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54176,
      "integrity_level": "high",
      "started_at": "2025-09-12T18:35:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 117,
    "fields": {
      "session": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 23533,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:27:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 118,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 1891,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:25:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 119,
    "fields": {
      "session": 32,
      "endpoint_id": 20,
      "parent_pid": 7143,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 46524,
      "integrity_level": "high",
      "started_at": "2025-09-12T21:37:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 120,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29798,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:15:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 121,
    "fields": {
      "session": 35,
      "endpoint_id": 26,
      "parent_pid": 5419,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54076,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:15:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 122,
    "fields": {
      "session": 117,
      "endpoint_id": 25,
      "parent_pid": 6672,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 13399,
      "integrity_level": "low",
      "started_at": "2025-09-12T20:16:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 123,
    "fields": {
      "session": 11,
      "endpoint_id": 7,
      "parent_pid": 2105,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17270,
      "integrity_level": "medium",
      "started_at": "2025-09-12T16:04:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 124,
    "fields": {
      "session": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 35872,
      "integrity_level": "high",
      "started_at": "2025-09-11T08:42:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 125,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 54123,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:19:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 126,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63920,
      "integrity_level": "medium",
      "started_at": "2025-09-08T21:33:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 127,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54190,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:22:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 128,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40436,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:19:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 129,
    "fields": {
      "session": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8473,
      "integrity_level": "high",
      "started_at": "2025-09-09T13:02:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 130,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62677,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:57:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 131,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 21536,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:16:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 132,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54687,
      "integrity_level": "medium",
      "started_at": "2025-09-08T09:34:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 133,
    "fields": {
      "session": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58185,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:44:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 134,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16981,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:09:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 135,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 16644,
      "integrity_level": "low",
      "started_at": "2025-09-12T17:04:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 136,
    "fields": {
      "session": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45127,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:04:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 137,
    "fields": {
      "session": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14030,
      "integrity_level": "medium",
      "started_at": "2025-09-10T23:52:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 138,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21859,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:26:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 139,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13534,
      "integrity_level": "medium",
      "started_at": "2025-09-11T13:44:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 140,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 54066,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:51:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 141,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 29579,
      "integrity_level": "medium",
      "started_at": "2025-09-11T13:47:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 142,
    "fields": {
      "session": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53142,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:33:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 143,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14475,
      "integrity_level": "high",
      "started_at": "2025-09-08T18:52:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 144,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 57322,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:38:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 145,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 11876,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:23:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 146,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25240,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:45:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 147,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28944,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:02:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 148,
    "fields": {
      "session": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 54781,
      "integrity_level": "low",
      "started_at": "2025-09-08T15:42:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 149,
    "fields": {
      "session": 85,
      "endpoint_id": 9,
      "parent_pid": 7128,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41988,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:05:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 150,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35093,
      "integrity_level": "medium",
      "started_at": "2025-09-12T12:34:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 151,
    "fields": {
      "session": 66,
      "endpoint_id": 25,
      "parent_pid": 2140,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45079,
      "integrity_level": "low",
      "started_at": "2025-09-08T11:10:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 152,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31558,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:05:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 153,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61558,
      "integrity_level": "medium",
      "started_at": "2025-09-08T21:42:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 154,
    "fields": {
      "session": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57288,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:07:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 155,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1398,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:41:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 156,
    "fields": {
      "session": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8336,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:16:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 157,
    "fields": {
      "session": 127,
      "endpoint_id": 22,
      "parent_pid": 1504,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 10269,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:08:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 158,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 11402,
      "integrity_level": "low",
      "started_at": "2025-09-10T17:24:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 159,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44836,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:26:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 160,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 46776,
      "integrity_level": "medium",
      "started_at": "2025-09-09T12:10:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 161,
    "fields": {
      "session": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 38072,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:46:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 162,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 4295,
      "integrity_level": "low",
      "started_at": "2025-09-11T13:33:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 163,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49369,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:35:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 164,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44115,
      "integrity_level": "medium",
      "started_at": "2025-09-09T18:19:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 165,
    "fields": {
      "session": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24591,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:05:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 166,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 14994,
      "integrity_level": "medium",
      "started_at": "2025-09-09T18:31:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 167,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 5361,
      "integrity_level": "medium",
      "started_at": "2025-09-10T20:00:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 168,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17830,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:31:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 169,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60234,
      "integrity_level": "high",
      "started_at": "2025-09-11T15:27:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 170,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41453,
      "integrity_level": "high",
      "started_at": "2025-09-08T13:29:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 171,
    "fields": {
      "session": 36,
      "endpoint_id": 20,
      "parent_pid": 4428,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30005,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:27:26Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 172,
    "fields": {
      "session": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 44074,
      "integrity_level": "low",
      "started_at": "2025-09-11T12:39:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 173,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49561,
      "integrity_level": "low",
      "started_at": "2025-09-10T13:47:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 174,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18938,
      "integrity_level": "low",
      "started_at": "2025-09-09T19:38:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 175,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45523,
      "integrity_level": "medium",
      "started_at": "2025-09-12T19:14:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 176,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33369,
      "integrity_level": "medium",
      "started_at": "2025-09-12T21:27:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 177,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 52969,
      "integrity_level": "low",
      "started_at": "2025-09-08T15:14:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 178,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 53009,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:07:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 179,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41425,
      "integrity_level": "medium",
      "started_at": "2025-09-12T21:57:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 180,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 22062,
      "integrity_level": "medium",
      "started_at": "2025-09-12T13:41:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 181,
    "fields": {
      "session": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 40256,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:10:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 182,
    "fields": {
      "session": 33,
      "endpoint_id": 26,
      "parent_pid": 3235,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61073,
      "integrity_level": "medium",
      "started_at": "2025-09-08T10:13:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 183,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57760,
      "integrity_level": "medium",
      "started_at": "2025-09-11T20:06:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 184,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 34069,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:58:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 185,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43534,
      "integrity_level": "low",
      "started_at": "2025-09-09T15:30:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 186,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38818,
      "integrity_level": "medium",
      "started_at": "2025-09-09T20:10:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 187,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 56528,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:05:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 188,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55862,
      "integrity_level": "medium",
      "started_at": "2025-09-11T20:27:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 189,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26077,
      "integrity_level": "medium",
      "started_at": "2025-09-10T20:09:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 190,
    "fields": {
      "session": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 31025,
      "integrity_level": "medium",
      "started_at": "2025-09-11T00:00:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 191,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 7221,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:45:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 192,
    "fields": {
      "session": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3940,
      "integrity_level": "high",
      "started_at": "2025-09-09T14:27:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 193,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 20177,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:41:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 194,
    "fields": {
      "session": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 29813,
      "integrity_level": "low",
      "started_at": "2025-09-12T10:58:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 195,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54269,
      "integrity_level": "high",
      "started_at": "2025-09-12T18:21:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 196,
    "fields": {
      "session": 54,
      "endpoint_id": 7,
      "parent_pid": 2990,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 40860,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:34:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 197,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39816,
      "integrity_level": "low",
      "started_at": "2025-09-09T15:56:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 198,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 48079,
      "integrity_level": "medium",
      "started_at": "2025-09-10T21:29:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 199,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31843,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:32:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 200,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 6928,
      "integrity_level": "high",
      "started_at": "2025-09-10T14:38:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 201,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 63883,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:30:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 202,
    "fields": {
      "session": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 43291,
      "integrity_level": "medium",
      "started_at": "2025-09-08T11:43:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 203,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 16739,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:57:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 204,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 15665,
      "integrity_level": "low",
      "started_at": "2025-09-08T10:49:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 205,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50897,
      "integrity_level": "high",
      "started_at": "2025-09-08T18:28:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 206,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18564,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:20:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 207,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 12954,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:25:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 208,
    "fields": {
      "session": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56449,
      "integrity_level": "high",
      "started_at": "2025-09-11T16:17:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 209,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 32252,
      "integrity_level": "medium",
      "started_at": "2025-09-11T13:58:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 210,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28766,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:29:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 211,
    "fields": {
      "session": 90,
      "endpoint_id": 14,
      "parent_pid": 5514,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 5420,
      "integrity_level": "medium",
      "started_at": "2025-09-11T09:30:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 212,
    "fields": {
      "session": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61892,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:41:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 213,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37867,
      "integrity_level": "medium",
      "started_at": "2025-09-08T22:25:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 214,
    "fields": {
      "session": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 22372,
      "integrity_level": "medium",
      "started_at": "2025-09-08T11:53:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 215,
    "fields": {
      "session": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 39630,
      "integrity_level": "low",
      "started_at": "2025-09-09T12:09:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 216,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 4540,
      "integrity_level": "medium",
      "started_at": "2025-09-08T23:44:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 217,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61419,
      "integrity_level": "low",
      "started_at": "2025-09-10T17:42:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 218,
    "fields": {
      "session": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 61225,
      "integrity_level": "high",
      "started_at": "2025-09-08T12:15:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 219,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30347,
      "integrity_level": "medium",
      "started_at": "2025-09-09T20:17:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 220,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 23413,
      "integrity_level": "high",
      "started_at": "2025-09-10T12:01:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 221,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36353,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:43:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 222,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 28924,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:25:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 223,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 13972,
      "integrity_level": "medium",
      "started_at": "2025-09-11T11:11:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 224,
    "fields": {
      "session": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 61478,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:55:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 225,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60709,
      "integrity_level": "high",
      "started_at": "2025-09-09T11:44:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 226,
    "fields": {
      "session": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28834,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:33:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 227,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 48805,
      "integrity_level": "low",
      "started_at": "2025-09-08T12:13:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 228,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 55636,
      "integrity_level": "low",
      "started_at": "2025-09-10T14:34:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 229,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27407,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:06:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 230,
    "fields": {
      "session": 91,
      "endpoint_id": 19,
      "parent_pid": 7689,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 40314,
      "integrity_level": "high",
      "started_at": "2025-09-12T10:35:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 231,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 54292,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:57:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 232,
    "fields": {
      "session": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32167,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:34:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 233,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 46600,
      "integrity_level": "medium",
      "started_at": "2025-09-13T00:14:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 234,
    "fields": {
      "session": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62469,
      "integrity_level": "low",
      "started_at": "2025-09-09T13:48:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 235,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34266,
      "integrity_level": "low",
      "started_at": "2025-09-10T14:04:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 236,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 19597,
      "integrity_level": "low",
      "started_at": "2025-09-11T20:36:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 237,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14924,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:39:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 238,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23200,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:16:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 239,
    "fields": {
      "session": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3544,
      "integrity_level": "high",
      "started_at": "2025-09-08T12:31:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 240,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32551,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:33:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 241,
    "fields": {
      "session": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32223,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:08:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 242,
    "fields": {
      "session": 119,
      "endpoint_id": 21,
      "parent_pid": 6808,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27221,
      "integrity_level": "low",
      "started_at": "2025-09-10T20:58:28Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 243,
    "fields": {
      "session": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12920,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:47:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 244,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 60267,
      "integrity_level": "high",
      "started_at": "2025-09-10T17:39:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 245,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 35064,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:44:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 246,
    "fields": {
      "session": 33,
      "endpoint_id": 26,
      "parent_pid": 3235,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5696,
      "integrity_level": "medium",
      "started_at": "2025-09-08T11:17:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 247,
    "fields": {
      "session": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 49419,
      "integrity_level": "medium",
      "started_at": "2025-09-10T10:39:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 248,
    "fields": {
      "session": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60865,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:41:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 249,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 2629,
      "integrity_level": "low",
      "started_at": "2025-09-10T18:02:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 250,
    "fields": {
      "session": 8,
      "endpoint_id": 14,
      "parent_pid": 8148,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35738,
      "integrity_level": "medium",
      "started_at": "2025-09-09T09:25:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 251,
    "fields": {
      "session": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56178,
      "integrity_level": "medium",
      "started_at": "2025-09-11T13:44:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 252,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 47675,
      "integrity_level": "low",
      "started_at": "2025-09-10T18:40:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 253,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 55668,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:40:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 254,
    "fields": {
      "session": 89,
      "endpoint_id": 18,
      "parent_pid": 7044,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56120,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:44:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 255,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 23623,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:19:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 256,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 6303,
      "integrity_level": "medium",
      "started_at": "2025-09-10T17:54:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 257,
    "fields": {
      "session": 45,
      "endpoint_id": 11,
      "parent_pid": 8295,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17170,
      "integrity_level": "medium",
      "started_at": "2025-09-12T17:31:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 258,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 22176,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:18:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 259,
    "fields": {
      "session": 28,
      "endpoint_id": 29,
      "parent_pid": 1782,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 1192,
      "integrity_level": "high",
      "started_at": "2025-09-10T12:04:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 260,
    "fields": {
      "session": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12286,
      "integrity_level": "low",
      "started_at": "2025-09-08T13:48:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 261,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8522,
      "integrity_level": "high",
      "started_at": "2025-09-11T15:08:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 262,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3605,
      "integrity_level": "medium",
      "started_at": "2025-09-09T18:36:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 263,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 62432,
      "integrity_level": "high",
      "started_at": "2025-09-12T19:44:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 264,
    "fields": {
      "session": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 6071,
      "integrity_level": "medium",
      "started_at": "2025-09-11T14:53:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 265,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 932,
      "integrity_level": "medium",
      "started_at": "2025-09-11T11:36:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 266,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56419,
      "integrity_level": "low",
      "started_at": "2025-09-11T14:56:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 267,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 37820,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:11:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 268,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 1833,
      "integrity_level": "medium",
      "started_at": "2025-09-10T20:31:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 269,
    "fields": {
      "session": 28,
      "endpoint_id": 29,
      "parent_pid": 1782,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45000,
      "integrity_level": "low",
      "started_at": "2025-09-10T12:15:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 270,
    "fields": {
      "session": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 58553,
      "integrity_level": "medium",
      "started_at": "2025-09-09T01:03:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 271,
    "fields": {
      "session": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 54078,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:58:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 272,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47307,
      "integrity_level": "high",
      "started_at": "2025-09-09T18:40:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 273,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 56921,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:26:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 274,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 8488,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:28:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 275,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50379,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:31:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 276,
    "fields": {
      "session": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 15988,
      "integrity_level": "low",
      "started_at": "2025-09-10T11:53:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 277,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 47062,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:33:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 278,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 46939,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:52:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 279,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15100,
      "integrity_level": "low",
      "started_at": "2025-09-11T16:06:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 280,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42237,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:04:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 281,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44118,
      "integrity_level": "medium",
      "started_at": "2025-09-11T15:17:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 282,
    "fields": {
      "session": 104,
      "endpoint_id": 21,
      "parent_pid": 7548,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25431,
      "integrity_level": "medium",
      "started_at": "2025-09-09T10:53:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 283,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 31200,
      "integrity_level": "medium",
      "started_at": "2025-09-09T12:46:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 284,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25670,
      "integrity_level": "medium",
      "started_at": "2025-09-08T10:19:26Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 285,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64241,
      "integrity_level": "medium",
      "started_at": "2025-09-12T14:24:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 286,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 15966,
      "integrity_level": "medium",
      "started_at": "2025-09-11T15:47:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 287,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31309,
      "integrity_level": "medium",
      "started_at": "2025-09-09T19:00:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 288,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43147,
      "integrity_level": "low",
      "started_at": "2025-09-12T01:06:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 289,
    "fields": {
      "session": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5347,
      "integrity_level": "medium",
      "started_at": "2025-09-10T12:57:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 290,
    "fields": {
      "session": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58314,
      "integrity_level": "high",
      "started_at": "2025-09-12T11:06:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 291,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 24759,
      "integrity_level": "low",
      "started_at": "2025-09-13T00:29:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 292,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43343,
      "integrity_level": "medium",
      "started_at": "2025-09-12T01:45:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 293,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46403,
      "integrity_level": "low",
      "started_at": "2025-09-13T01:00:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 294,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63248,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:00:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 295,
    "fields": {
      "session": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 49610,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:34:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 296,
    "fields": {
      "session": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6413,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:49:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 297,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17238,
      "integrity_level": "high",
      "started_at": "2025-09-10T15:29:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 298,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40165,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:51:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 299,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 40090,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:53:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 300,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 13451,
      "integrity_level": "medium",
      "started_at": "2025-09-09T16:39:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 301,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 935,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:42:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 302,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 21968,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:14:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 303,
    "fields": {
      "session": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60717,
      "integrity_level": "medium",
      "started_at": "2025-09-10T22:20:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 304,
    "fields": {
      "session": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 33428,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:00:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 305,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 43470,
      "integrity_level": "medium",
      "started_at": "2025-09-12T19:40:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 306,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19835,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:33:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 307,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 52995,
      "integrity_level": "medium",
      "started_at": "2025-09-09T15:17:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 308,
    "fields": {
      "session": 7,
      "endpoint_id": 1,
      "parent_pid": 777,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39176,
      "integrity_level": "low",
      "started_at": "2025-09-08T13:25:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 309,
    "fields": {
      "session": 97,
      "endpoint_id": 1,
      "parent_pid": 3764,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2501,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:58:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 310,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31168,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:44:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 311,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 38782,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:45:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 312,
    "fields": {
      "session": 107,
      "endpoint_id": 11,
      "parent_pid": 7525,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58917,
      "integrity_level": "medium",
      "started_at": "2025-09-12T12:14:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 313,
    "fields": {
      "session": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31378,
      "integrity_level": "high",
      "started_at": "2025-09-12T12:29:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 314,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7325,
      "integrity_level": "low",
      "started_at": "2025-09-09T19:20:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 315,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 42933,
      "integrity_level": "high",
      "started_at": "2025-09-11T17:33:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 316,
    "fields": {
      "session": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64565,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:08:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 317,
    "fields": {
      "session": 122,
      "endpoint_id": 17,
      "parent_pid": 6690,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 54314,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:01:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 318,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36233,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:08:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 319,
    "fields": {
      "session": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 9012,
      "integrity_level": "high",
      "started_at": "2025-09-09T14:33:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 320,
    "fields": {
      "session": 7,
      "endpoint_id": 1,
      "parent_pid": 777,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 27511,
      "integrity_level": "high",
      "started_at": "2025-09-08T14:45:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 321,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 56212,
      "integrity_level": "high",
      "started_at": "2025-09-12T16:21:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 322,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45116,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:52:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 323,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39061,
      "integrity_level": "low",
      "started_at": "2025-09-08T20:08:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 324,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 30035,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:23:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 325,
    "fields": {
      "session": 34,
      "endpoint_id": 30,
      "parent_pid": 9204,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20469,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:23:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 326,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23781,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:49:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 327,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54358,
      "integrity_level": "medium",
      "started_at": "2025-09-09T21:42:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 328,
    "fields": {
      "session": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60534,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:01:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 329,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20216,
      "integrity_level": "medium",
      "started_at": "2025-09-09T16:26:06Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 330,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 3831,
      "integrity_level": "medium",
      "started_at": "2025-09-09T21:57:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 331,
    "fields": {
      "session": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 58772,
      "integrity_level": "medium",
      "started_at": "2025-09-11T20:40:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 332,
    "fields": {
      "session": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 14407,
      "integrity_level": "medium",
      "started_at": "2025-09-12T12:32:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 333,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 7215,
      "integrity_level": "low",
      "started_at": "2025-09-08T18:13:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 334,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 60255,
      "integrity_level": "low",
      "started_at": "2025-09-08T16:33:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 335,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48395,
      "integrity_level": "high",
      "started_at": "2025-09-12T16:49:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 336,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 51238,
      "integrity_level": "medium",
      "started_at": "2025-09-09T19:42:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 337,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54920,
      "integrity_level": "medium",
      "started_at": "2025-09-12T02:04:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 338,
    "fields": {
      "session": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26943,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:53:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 339,
    "fields": {
      "session": 40,
      "endpoint_id": 18,
      "parent_pid": 9039,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6596,
      "integrity_level": "medium",
      "started_at": "2025-09-08T14:06:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 340,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 11257,
      "integrity_level": "low",
      "started_at": "2025-09-10T12:55:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 341,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 28515,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:06:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 342,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 47029,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:29:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 343,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 13697,
      "integrity_level": "medium",
      "started_at": "2025-09-11T20:54:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 344,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 31471,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:52:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 345,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 30315,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:19:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 346,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18805,
      "integrity_level": "medium",
      "started_at": "2025-09-12T14:48:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 347,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9114,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:06:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 348,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 36455,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:20:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 349,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20688,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:29:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 350,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 5485,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:42:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 351,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53006,
      "integrity_level": "low",
      "started_at": "2025-09-08T11:41:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 352,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 39809,
      "integrity_level": "high",
      "started_at": "2025-09-10T19:56:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 353,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 57986,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:19:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 354,
    "fields": {
      "session": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42988,
      "integrity_level": "low",
      "started_at": "2025-09-08T13:25:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 355,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 12494,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:36:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 356,
    "fields": {
      "session": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 54721,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:23:43Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 357,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17802,
      "integrity_level": "medium",
      "started_at": "2025-09-09T21:13:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 358,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 52012,
      "integrity_level": "low",
      "started_at": "2025-09-08T14:48:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 359,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 34261,
      "integrity_level": "high",
      "started_at": "2025-09-08T20:51:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 360,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2848,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:06:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 361,
    "fields": {
      "session": 41,
      "endpoint_id": 19,
      "parent_pid": 5450,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26046,
      "integrity_level": "medium",
      "started_at": "2025-09-08T06:39:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 362,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 53635,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:27:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 363,
    "fields": {
      "session": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 16048,
      "integrity_level": "high",
      "started_at": "2025-09-12T16:29:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 364,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36103,
      "integrity_level": "medium",
      "started_at": "2025-09-12T02:38:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 365,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2077,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:56:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 366,
    "fields": {
      "session": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38325,
      "integrity_level": "high",
      "started_at": "2025-09-11T09:28:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 367,
    "fields": {
      "session": 52,
      "endpoint_id": 28,
      "parent_pid": 2323,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58323,
      "integrity_level": "high",
      "started_at": "2025-09-08T19:12:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 368,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 18083,
      "integrity_level": "low",
      "started_at": "2025-09-10T16:12:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 369,
    "fields": {
      "session": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49049,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:53:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 370,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 11839,
      "integrity_level": "medium",
      "started_at": "2025-09-12T19:07:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 371,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 36076,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:37:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 372,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 44607,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:41:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 373,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 18894,
      "integrity_level": "low",
      "started_at": "2025-09-08T19:11:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 374,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34533,
      "integrity_level": "medium",
      "started_at": "2025-09-09T16:44:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 375,
    "fields": {
      "session": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38181,
      "integrity_level": "medium",
      "started_at": "2025-09-10T17:22:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 376,
    "fields": {
      "session": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13354,
      "integrity_level": "low",
      "started_at": "2025-09-08T14:34:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 377,
    "fields": {
      "session": 21,
      "endpoint_id": 8,
      "parent_pid": 1578,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 27111,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:54:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 378,
    "fields": {
      "session": 13,
      "endpoint_id": 22,
      "parent_pid": 6372,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14900,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:41:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 379,
    "fields": {
      "session": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6542,
      "integrity_level": "low",
      "started_at": "2025-09-10T14:07:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 380,
    "fields": {
      "session": 75,
      "endpoint_id": 26,
      "parent_pid": 799,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16118,
      "integrity_level": "medium",
      "started_at": "2025-09-08T11:35:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 381,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36546,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:49:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 382,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35728,
      "integrity_level": "low",
      "started_at": "2025-09-10T16:19:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 383,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42906,
      "integrity_level": "low",
      "started_at": "2025-09-12T21:34:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 384,
    "fields": {
      "session": 81,
      "endpoint_id": 14,
      "parent_pid": 1248,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59974,
      "integrity_level": "medium",
      "started_at": "2025-09-11T16:50:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 385,
    "fields": {
      "session": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 19298,
      "integrity_level": "low",
      "started_at": "2025-09-10T22:51:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 386,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 63102,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:59:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 387,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13027,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:59:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 388,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 29144,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:59:26Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 389,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 1834,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:29:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 390,
    "fields": {
      "session": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50328,
      "integrity_level": "medium",
      "started_at": "2025-09-11T09:38:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 391,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19567,
      "integrity_level": "low",
      "started_at": "2025-09-08T22:08:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 392,
    "fields": {
      "session": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 33782,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:35:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 393,
    "fields": {
      "session": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 15421,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:34:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 394,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11868,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:05:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 395,
    "fields": {
      "session": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 43857,
      "integrity_level": "low",
      "started_at": "2025-09-09T13:02:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 396,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22514,
      "integrity_level": "medium",
      "started_at": "2025-09-09T22:07:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 397,
    "fields": {
      "session": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47772,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:20:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 398,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31853,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:47:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 399,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 12354,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:46:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 400,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 51811,
      "integrity_level": "high",
      "started_at": "2025-09-08T17:43:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 401,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22532,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:41:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 402,
    "fields": {
      "session": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3576,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:59:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 403,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37069,
      "integrity_level": "medium",
      "started_at": "2025-09-08T12:14:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 404,
    "fields": {
      "session": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 1270,
      "integrity_level": "medium",
      "started_at": "2025-09-09T15:56:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 405,
    "fields": {
      "session": 47,
      "endpoint_id": 30,
      "parent_pid": 8438,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 58028,
      "integrity_level": "medium",
      "started_at": "2025-09-10T17:17:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 406,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 24732,
      "integrity_level": "medium",
      "started_at": "2025-09-09T22:11:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 407,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 26398,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:56:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 408,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 29568,
      "integrity_level": "low",
      "started_at": "2025-09-11T12:39:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 409,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60471,
      "integrity_level": "low",
      "started_at": "2025-09-11T21:30:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 410,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 52011,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:55:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 411,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 38569,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:54:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 412,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2537,
      "integrity_level": "medium",
      "started_at": "2025-09-11T18:47:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 413,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 15396,
      "integrity_level": "medium",
      "started_at": "2025-09-10T21:28:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 414,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 61129,
      "integrity_level": "high",
      "started_at": "2025-09-09T18:44:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 415,
    "fields": {
      "session": 100,
      "endpoint_id": 13,
      "parent_pid": 4103,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44236,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:24:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 416,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 64425,
      "integrity_level": "medium",
      "started_at": "2025-09-11T21:25:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 417,
    "fields": {
      "session": 92,
      "endpoint_id": 29,
      "parent_pid": 7465,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 7857,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:37:24Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 418,
    "fields": {
      "session": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 25491,
      "integrity_level": "medium",
      "started_at": "2025-09-11T22:05:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 419,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 6165,
      "integrity_level": "medium",
      "started_at": "2025-09-11T13:46:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 420,
    "fields": {
      "session": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47194,
      "integrity_level": "medium",
      "started_at": "2025-09-11T17:04:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 421,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 27717,
      "integrity_level": "high",
      "started_at": "2025-09-12T03:09:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 422,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 23607,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:38:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 423,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29523,
      "integrity_level": "low",
      "started_at": "2025-09-12T19:32:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 424,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12999,
      "integrity_level": "low",
      "started_at": "2025-09-13T01:47:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 425,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28405,
      "integrity_level": "medium",
      "started_at": "2025-09-08T15:51:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 426,
    "fields": {
      "session": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30972,
      "integrity_level": "low",
      "started_at": "2025-09-09T14:10:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 427,
    "fields": {
      "session": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 22114,
      "integrity_level": "low",
      "started_at": "2025-09-10T22:32:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 428,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34210,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:28:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 429,
    "fields": {
      "session": 38,
      "endpoint_id": 21,
      "parent_pid": 8575,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 12950,
      "integrity_level": "low",
      "started_at": "2025-09-08T08:17:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 430,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14673,
      "integrity_level": "medium",
      "started_at": "2025-09-11T12:48:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 431,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7288,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:04:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 432,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58174,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:49:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 433,
    "fields": {
      "session": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49560,
      "integrity_level": "medium",
      "started_at": "2025-09-11T20:16:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 434,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37311,
      "integrity_level": "low",
      "started_at": "2025-09-08T22:39:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 435,
    "fields": {
      "session": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 42046,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:34:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 436,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 46964,
      "integrity_level": "low",
      "started_at": "2025-09-08T22:07:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 437,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45963,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:56:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 438,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39388,
      "integrity_level": "medium",
      "started_at": "2025-09-09T22:18:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 439,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60486,
      "integrity_level": "high",
      "started_at": "2025-09-08T22:47:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 440,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 14899,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:20:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 441,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56072,
      "integrity_level": "medium",
      "started_at": "2025-09-08T23:51:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 442,
    "fields": {
      "session": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7940,
      "integrity_level": "high",
      "started_at": "2025-09-09T23:31:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 443,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7017,
      "integrity_level": "low",
      "started_at": "2025-09-11T14:09:52Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 444,
    "fields": {
      "session": 96,
      "endpoint_id": 9,
      "parent_pid": 9109,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 28259,
      "integrity_level": "medium",
      "started_at": "2025-09-12T07:58:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 445,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 8609,
      "integrity_level": "low",
      "started_at": "2025-09-12T19:50:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 446,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 43909,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:39:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 447,
    "fields": {
      "session": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64946,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:25:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 448,
    "fields": {
      "session": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24095,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:56:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 449,
    "fields": {
      "session": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7351,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:27:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 450,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 52592,
      "integrity_level": "low",
      "started_at": "2025-09-11T22:28:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 451,
    "fields": {
      "session": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18454,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:38:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 452,
    "fields": {
      "session": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 15071,
      "integrity_level": "medium",
      "started_at": "2025-09-11T19:02:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 453,
    "fields": {
      "session": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 31800,
      "integrity_level": "medium",
      "started_at": "2025-09-08T18:18:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 454,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44332,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:24:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 455,
    "fields": {
      "session": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 28274,
      "integrity_level": "low",
      "started_at": "2025-09-11T20:51:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 456,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 45910,
      "integrity_level": "low",
      "started_at": "2025-09-08T21:41:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 457,
    "fields": {
      "session": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60738,
      "integrity_level": "low",
      "started_at": "2025-09-10T21:09:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 458,
    "fields": {
      "session": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 33005,
      "integrity_level": "medium",
      "started_at": "2025-09-12T21:50:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 459,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 15459,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:26:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 460,
    "fields": {
      "session": 40,
      "endpoint_id": 18,
      "parent_pid": 9039,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17152,
      "integrity_level": "medium",
      "started_at": "2025-09-08T14:51:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 461,
    "fields": {
      "session": 86,
      "endpoint_id": 24,
      "parent_pid": 4959,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 3614,
      "integrity_level": "low",
      "started_at": "2025-09-12T10:37:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 462,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 1160,
      "integrity_level": "medium",
      "started_at": "2025-09-10T20:35:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 463,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3725,
      "integrity_level": "medium",
      "started_at": "2025-09-13T02:51:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 464,
    "fields": {
      "session": 97,
      "endpoint_id": 1,
      "parent_pid": 3764,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16918,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:28:10Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 465,
    "fields": {
      "session": 78,
      "endpoint_id": 28,
      "parent_pid": 4336,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61135,
      "integrity_level": "medium",
      "started_at": "2025-09-12T13:53:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 466,
    "fields": {
      "session": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 33595,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:33:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 467,
    "fields": {
      "session": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36899,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:16:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 468,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50480,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:53:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 469,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 29343,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:10:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 470,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 11266,
      "integrity_level": "medium",
      "started_at": "2025-09-12T23:13:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 471,
    "fields": {
      "session": 10,
      "endpoint_id": 18,
      "parent_pid": 6676,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 3932,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:24:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 472,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 50693,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:55:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 473,
    "fields": {
      "session": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 982,
      "integrity_level": "medium",
      "started_at": "2025-09-09T01:02:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 474,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46432,
      "integrity_level": "low",
      "started_at": "2025-09-11T14:16:12Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 475,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6333,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:53:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 476,
    "fields": {
      "session": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56343,
      "integrity_level": "medium",
      "started_at": "2025-09-10T20:23:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 477,
    "fields": {
      "session": 30,
      "endpoint_id": 5,
      "parent_pid": 5435,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 7825,
      "integrity_level": "low",
      "started_at": "2025-09-09T17:37:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 478,
    "fields": {
      "session": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44850,
      "integrity_level": "medium",
      "started_at": "2025-09-09T19:04:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 479,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20100,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:38:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 480,
    "fields": {
      "session": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62992,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:31:36Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 481,
    "fields": {
      "session": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 56274,
      "integrity_level": "low",
      "started_at": "2025-09-08T16:56:55Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 482,
    "fields": {
      "session": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 64717,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:45:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 483,
    "fields": {
      "session": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 12492,
      "integrity_level": "medium",
      "started_at": "2025-09-12T11:44:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 484,
    "fields": {
      "session": 125,
      "endpoint_id": 10,
      "parent_pid": 6716,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 32968,
      "integrity_level": "medium",
      "started_at": "2025-09-08T13:41:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 485,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45501,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:18:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 486,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44392,
      "integrity_level": "medium",
      "started_at": "2025-09-13T00:20:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 487,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44974,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:45:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 488,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61473,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:27:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 489,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 22003,
      "integrity_level": "low",
      "started_at": "2025-09-10T22:41:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 490,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51639,
      "integrity_level": "low",
      "started_at": "2025-09-08T23:36:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 491,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5519,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:25:43Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 492,
    "fields": {
      "session": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 9231,
      "integrity_level": "medium",
      "started_at": "2025-09-09T17:42:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 493,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50019,
      "integrity_level": "high",
      "started_at": "2025-09-11T18:12:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 494,
    "fields": {
      "session": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9289,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:49:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 495,
    "fields": {
      "session": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57344,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:27:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 496,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28484,
      "integrity_level": "medium",
      "started_at": "2025-09-09T20:21:27Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 497,
    "fields": {
      "session": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34077,
      "integrity_level": "medium",
      "started_at": "2025-09-08T22:12:50Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 498,
    "fields": {
      "session": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25642,
      "integrity_level": "medium",
      "started_at": "2025-09-12T12:44:58Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 499,
    "fields": {
      "session": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28518,
      "integrity_level": "medium",
      "started_at": "2025-09-10T18:44:21Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 500,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 56378,
      "integrity_level": "medium",
      "started_at": "2025-09-12T23:37:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 501,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21386,
      "integrity_level": "low",
      "started_at": "2025-09-10T15:38:38Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 502,
    "fields": {
      "session": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 55238,
      "integrity_level": "low",
      "started_at": "2025-09-11T01:12:20Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 503,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58254,
      "integrity_level": "medium",
      "started_at": "2025-09-10T21:46:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 504,
    "fields": {
      "session": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34957,
      "integrity_level": "medium",
      "started_at": "2025-09-08T21:23:46Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 505,
    "fields": {
      "session": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53794,
      "integrity_level": "medium",
      "started_at": "2025-09-10T14:14:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 506,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10074,
      "integrity_level": "low",
      "started_at": "2025-09-08T20:36:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 507,
    "fields": {
      "session": 45,
      "endpoint_id": 11,
      "parent_pid": 8295,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24155,
      "integrity_level": "medium",
      "started_at": "2025-09-12T18:23:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 508,
    "fields": {
      "session": 31,
      "endpoint_id": 17,
      "parent_pid": 9042,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56082,
      "integrity_level": "medium",
      "started_at": "2025-09-11T11:38:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 509,
    "fields": {
      "session": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6233,
      "integrity_level": "medium",
      "started_at": "2025-09-12T15:31:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 510,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 41236,
      "integrity_level": "low",
      "started_at": "2025-09-10T17:17:42Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 511,
    "fields": {
      "session": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21581,
      "integrity_level": "medium",
      "started_at": "2025-09-09T11:47:44Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 512,
    "fields": {
      "session": 96,
      "endpoint_id": 9,
      "parent_pid": 9109,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13102,
      "integrity_level": "medium",
      "started_at": "2025-09-12T09:30:09Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 513,
    "fields": {
      "session": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4995,
      "integrity_level": "low",
      "started_at": "2025-09-11T02:06:22Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 514,
    "fields": {
      "session": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 25807,
      "integrity_level": "low",
      "started_at": "2025-09-13T03:32:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 515,
    "fields": {
      "session": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36077,
      "integrity_level": "medium",
      "started_at": "2025-09-10T16:41:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 516,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1617,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:44:15Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 517,
    "fields": {
      "session": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57726,
      "integrity_level": "high",
      "started_at": "2025-09-11T19:14:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 518,
    "fields": {
      "session": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 39724,
      "integrity_level": "low",
      "started_at": "2025-09-09T20:41:56Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 519,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28678,
      "integrity_level": "medium",
      "started_at": "2025-09-09T22:36:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 520,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57289,
      "integrity_level": "low",
      "started_at": "2025-09-10T18:35:51Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 521,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 10497,
      "integrity_level": "medium",
      "started_at": "2025-09-08T21:14:03Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 522,
    "fields": {
      "session": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 51499,
      "integrity_level": "medium",
      "started_at": "2025-09-08T19:52:39Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 523,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 41324,
      "integrity_level": "low",
      "started_at": "2025-09-10T23:14:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 524,
    "fields": {
      "session": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 64374,
      "integrity_level": "medium",
      "started_at": "2025-09-10T17:16:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 525,
    "fields": {
      "session": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9432,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:19:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 526,
    "fields": {
      "session": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13520,
      "integrity_level": "medium",
      "started_at": "2025-09-11T15:42:16Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 527,
    "fields": {
      "session": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25250,
      "integrity_level": "medium",
      "started_at": "2025-09-08T20:40:23Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 528,
    "fields": {
      "session": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 37202,
      "integrity_level": "low",
      "started_at": "2025-09-10T23:54:01Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 529,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 52105,
      "integrity_level": "medium",
      "started_at": "2025-09-12T21:11:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 530,
    "fields": {
      "session": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 46255,
      "integrity_level": "medium",
      "started_at": "2025-09-09T00:55:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 531,
    "fields": {
      "session": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 56848,
      "integrity_level": "medium",
      "started_at": "2025-09-08T17:34:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 532,
    "fields": {
      "session": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27202,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:06:30Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 533,
    "fields": {
      "session": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44023,
      "integrity_level": "high",
      "started_at": "2025-09-10T16:40:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 534,
    "fields": {
      "session": 111,
      "endpoint_id": 25,
      "parent_pid": 4893,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63803,
      "integrity_level": "medium",
      "started_at": "2025-09-11T10:29:49Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 535,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 12682,
      "integrity_level": "medium",
      "started_at": "2025-09-13T00:00:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 536,
    "fields": {
      "session": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37531,
      "integrity_level": "medium",
      "started_at": "2025-09-09T15:26:14Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 537,
    "fields": {
      "session": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40163,
      "integrity_level": "medium",
      "started_at": "2025-09-11T22:27:18Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 538,
    "fields": {
      "session": 47,
      "endpoint_id": 30,
      "parent_pid": 8438,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3478,
      "integrity_level": "low",
      "started_at": "2025-09-10T18:02:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 539,
    "fields": {
      "session": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 38696,
      "integrity_level": "low",
      "started_at": "2025-09-10T20:19:48Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 540,
    "fields": {
      "session": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18596,
      "integrity_level": "medium",
      "started_at": "2025-09-09T13:13:26Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 541,
    "fields": {
      "session": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 50925,
      "integrity_level": "low",
      "started_at": "2025-09-11T15:23:35Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 542,
    "fields": {
      "session": 18,
      "endpoint_id": 19,
      "parent_pid": 5353,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42031,
      "integrity_level": "medium",
      "started_at": "2025-09-09T14:58:31Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 543,
    "fields": {
      "session": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 14472,
      "integrity_level": "high",
      "started_at": "2025-09-10T16:56:47Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 544,
    "fields": {
      "session": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56307,
      "integrity_level": "high",
      "started_at": "2025-09-08T21:16:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 545,
    "fields": {
      "session": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17648,
      "integrity_level": "medium",
      "started_at": "2025-09-11T15:25:05Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 546,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21296,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:05:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 547,
    "fields": {
      "session": 31,
      "endpoint_id": 17,
      "parent_pid": 9042,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20376,
      "integrity_level": "high",
      "started_at": "2025-09-11T12:44:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 548,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26369,
      "integrity_level": "medium",
      "started_at": "2025-09-10T19:18:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 549,
    "fields": {
      "session": 99,
      "endpoint_id": 9,
      "parent_pid": 8717,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54109,
      "integrity_level": "medium",
      "started_at": "2025-09-08T22:52:45Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 550,
    "fields": {
      "session": 11,
      "endpoint_id": 7,
      "parent_pid": 2105,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33263,
      "integrity_level": "medium",
      "started_at": "2025-09-12T17:15:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 551,
    "fields": {
      "session": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42543,
      "integrity_level": "medium",
      "started_at": "2025-09-11T00:02:57Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 552,
    "fields": {
      "session": 115,
      "endpoint_id": 28,
      "parent_pid": 6071,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58514,
      "integrity_level": "medium",
      "started_at": "2025-09-12T13:59:04Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 553,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 850,
      "integrity_level": "low",
      "started_at": "2025-09-13T00:42:00Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 554,
    "fields": {
      "session": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 2524,
      "integrity_level": "low",
      "started_at": "2025-09-09T14:54:43Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 555,
    "fields": {
      "session": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9809,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:58:53Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 556,
    "fields": {
      "session": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 44299,
      "integrity_level": "low",
      "started_at": "2025-09-10T19:23:29Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 557,
    "fields": {
      "session": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51424,
      "integrity_level": "low",
      "started_at": "2025-09-12T04:18:54Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 558,
    "fields": {
      "session": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57792,
      "integrity_level": "medium",
      "started_at": "2025-09-12T14:08:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 559,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 45335,
      "integrity_level": "low",
      "started_at": "2025-09-12T20:21:17Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 560,
    "fields": {
      "session": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18770,
      "integrity_level": "medium",
      "started_at": "2025-09-13T01:57:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 561,
    "fields": {
      "session": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 31827,
      "integrity_level": "medium",
      "started_at": "2025-09-12T20:33:08Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 562,
    "fields": {
      "session": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58496,
      "integrity_level": "high",
      "started_at": "2025-09-08T17:27:59Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 563,
    "fields": {
      "session": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62900,
      "integrity_level": "medium",
      "started_at": "2025-09-10T15:55:33Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 564,
    "fields": {
      "session": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20441,
      "integrity_level": "medium",
      "started_at": "2025-09-09T15:38:40Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 565,
    "fields": {
      "session": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59866,
      "integrity_level": "medium",
      "started_at": "2025-09-12T14:43:13Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 566,
    "fields": {
      "session": 114,
      "endpoint_id": 26,
      "parent_pid": 1599,
      "launch_chain": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 18059,
      "integrity_level": "medium",
      "started_at": "2025-09-08T16:35:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 567,
    "fields": {
      "session": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 25903,
      "integrity_level": "low",
      "started_at": "2025-09-10T19:52:11Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 568,
    "fields": {
      "session": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2260,
      "integrity_level": "medium",
      "started_at": "2025-09-09T15:49:19Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 569,
    "fields": {
      "session": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10941,
      "integrity_level": "low",
      "started_at": "2025-09-11T19:03:32Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 570,
    "fields": {
      "session": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 37692,
      "integrity_level": "high",
      "started_at": "2025-09-11T22:49:28Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 571,
    "fields": {
      "session": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7435,
      "integrity_level": "medium",
      "started_at": "2025-09-13T01:11:41Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 572,
    "fields": {
      "session": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17893,
      "integrity_level": "medium",
      "started_at": "2025-09-09T19:05:26Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 573,
    "fields": {
      "session": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 28951,
      "integrity_level": "low",
      "started_at": "2025-09-11T18:29:02Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 574,
    "fields": {
      "session": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 56518,
      "integrity_level": "medium",
      "started_at": "2025-09-12T22:58:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 575,
    "fields": {
      "session": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42950,
      "integrity_level": "low",
      "started_at": "2025-09-11T20:52:07Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 576,
    "fields": {
      "session": 58,
      "endpoint_id": 7,
      "parent_pid": 5507,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9308,
      "integrity_level": "low",
      "started_at": "2025-09-09T19:14:37Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 577,
    "fields": {
      "session": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50253,
      "integrity_level": "medium",
      "started_at": "2025-09-10T13:56:34Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 578,
    "fields": {
      "session": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37119,
      "integrity_level": "medium",
      "started_at": "2025-09-09T23:02:25Z"
    }
  },
  {
    "model": "app.appprocess",
    "pk": 579,
    "fields": {
      "session": 100,
      "endpoint_id": 13,
      "parent_pid": 4103,
      "launch_chain": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24394,
      "integrity_level": "high",
      "started_at": "2025-09-08T16:35:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 1,
    "fields": {
      "app_process": 419,
      "endpoint_id": 14,
      "parent_pid": 6165,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 8349,
      "command_source": "local_disk",
      "started_at": "2025-09-11T13:48:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 2,
    "fields": {
      "app_process": 146,
      "endpoint_id": 15,
      "parent_pid": 25240,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32092,
      "command_source": "local_disk",
      "started_at": "2025-09-12T18:47:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 3,
    "fields": {
      "app_process": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 41696,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T17:15:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 4,
    "fields": {
      "app_process": 142,
      "endpoint_id": 17,
      "parent_pid": 53142,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57847,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:33:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 5,
    "fields": {
      "app_process": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11652,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:40:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 6,
    "fields": {
      "app_process": 438,
      "endpoint_id": 19,
      "parent_pid": 39388,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56438,
      "command_source": "local_disk",
      "started_at": "2025-09-09T22:20:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 7,
    "fields": {
      "app_process": 250,
      "endpoint_id": 14,
      "parent_pid": 35738,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53327,
      "command_source": "user_profile",
      "started_at": "2025-09-09T09:27:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 8,
    "fields": {
      "app_process": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 5608,
      "command_source": "user_profile",
      "started_at": "2025-09-11T23:31:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 9,
    "fields": {
      "app_process": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 22059,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T17:38:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 10,
    "fields": {
      "app_process": 454,
      "endpoint_id": 24,
      "parent_pid": 44332,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58536,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T17:25:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 11,
    "fields": {
      "app_process": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 56489,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:34:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 12,
    "fields": {
      "app_process": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 40588,
      "command_source": "network_path",
      "started_at": "2025-09-11T21:30:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 13,
    "fields": {
      "app_process": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64348,
      "command_source": "network_path",
      "started_at": "2025-09-11T23:32:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 14,
    "fields": {
      "app_process": 44,
      "endpoint_id": 28,
      "parent_pid": 34278,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30253,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:09:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 15,
    "fields": {
      "app_process": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20465,
      "command_source": "local_disk",
      "started_at": "2025-09-11T08:59:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 16,
    "fields": {
      "app_process": 262,
      "endpoint_id": 17,
      "parent_pid": 3605,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48987,
      "command_source": "local_disk",
      "started_at": "2025-09-09T18:36:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 17,
    "fields": {
      "app_process": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 30439,
      "command_source": "local_disk",
      "started_at": "2025-09-11T21:32:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 18,
    "fields": {
      "app_process": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17607,
      "command_source": "local_disk",
      "started_at": "2025-09-13T00:22:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 19,
    "fields": {
      "app_process": 404,
      "endpoint_id": 1,
      "parent_pid": 1270,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 44864,
      "command_source": "local_disk",
      "started_at": "2025-09-09T15:56:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 20,
    "fields": {
      "app_process": 280,
      "endpoint_id": 24,
      "parent_pid": 42237,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42362,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T15:05:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 21,
    "fields": {
      "app_process": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11797,
      "command_source": "local_disk",
      "started_at": "2025-09-11T10:31:23Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 22,
    "fields": {
      "app_process": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 11435,
      "command_source": "user_profile",
      "started_at": "2025-09-10T12:38:07Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 23,
    "fields": {
      "app_process": 416,
      "endpoint_id": 2,
      "parent_pid": 64425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47384,
      "command_source": "local_disk",
      "started_at": "2025-09-11T21:26:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 24,
    "fields": {
      "app_process": 489,
      "endpoint_id": 18,
      "parent_pid": 22003,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 33056,
      "command_source": "local_disk",
      "started_at": "2025-09-10T22:41:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 25,
    "fields": {
      "app_process": 360,
      "endpoint_id": 16,
      "parent_pid": 2848,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 41048,
      "command_source": "local_disk",
      "started_at": "2025-09-12T18:07:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 26,
    "fields": {
      "app_process": 104,
      "endpoint_id": 3,
      "parent_pid": 53814,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 24023,
      "command_source": "local_disk",
      "started_at": "2025-09-11T17:39:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 27,
    "fields": {
      "app_process": 355,
      "endpoint_id": 19,
      "parent_pid": 12494,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 26192,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:37:26Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 28,
    "fields": {
      "app_process": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 55130,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T16:24:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 29,
    "fields": {
      "app_process": 56,
      "endpoint_id": 10,
      "parent_pid": 61151,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 22662,
      "command_source": "local_disk",
      "started_at": "2025-09-08T08:00:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 30,
    "fields": {
      "app_process": 31,
      "endpoint_id": 1,
      "parent_pid": 14661,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63918,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T13:01:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 31,
    "fields": {
      "app_process": 215,
      "endpoint_id": 26,
      "parent_pid": 39630,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 1795,
      "command_source": "local_disk",
      "started_at": "2025-09-09T12:09:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 32,
    "fields": {
      "app_process": 192,
      "endpoint_id": 1,
      "parent_pid": 3940,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 50476,
      "command_source": "local_disk",
      "started_at": "2025-09-09T14:29:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 33,
    "fields": {
      "app_process": 416,
      "endpoint_id": 2,
      "parent_pid": 64425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 23623,
      "command_source": "local_disk",
      "started_at": "2025-09-11T21:26:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 34,
    "fields": {
      "app_process": 561,
      "endpoint_id": 16,
      "parent_pid": 31827,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 58601,
      "command_source": "local_disk",
      "started_at": "2025-09-12T20:33:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 35,
    "fields": {
      "app_process": 52,
      "endpoint_id": 30,
      "parent_pid": 34765,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 42438,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:59:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 36,
    "fields": {
      "app_process": 90,
      "endpoint_id": 14,
      "parent_pid": 62491,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16591,
      "command_source": "user_profile",
      "started_at": "2025-09-10T11:58:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 37,
    "fields": {
      "app_process": 21,
      "endpoint_id": 29,
      "parent_pid": 33716,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28380,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T11:01:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 38,
    "fields": {
      "app_process": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 48111,
      "command_source": "local_disk",
      "started_at": "2025-09-11T09:00:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 39,
    "fields": {
      "app_process": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51314,
      "command_source": "user_profile",
      "started_at": "2025-09-09T12:32:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 40,
    "fields": {
      "app_process": 3,
      "endpoint_id": 8,
      "parent_pid": 43396,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53442,
      "command_source": "local_disk",
      "started_at": "2025-09-12T11:23:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 41,
    "fields": {
      "app_process": 490,
      "endpoint_id": 2,
      "parent_pid": 51639,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29964,
      "command_source": "local_disk",
      "started_at": "2025-09-08T23:38:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 42,
    "fields": {
      "app_process": 152,
      "endpoint_id": 9,
      "parent_pid": 31558,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 15403,
      "command_source": "local_disk",
      "started_at": "2025-09-12T18:06:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 43,
    "fields": {
      "app_process": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57013,
      "command_source": "user_profile",
      "started_at": "2025-09-10T19:29:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 44,
    "fields": {
      "app_process": 195,
      "endpoint_id": 9,
      "parent_pid": 54269,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62735,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T18:22:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 45,
    "fields": {
      "app_process": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22079,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T16:47:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 46,
    "fields": {
      "app_process": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55298,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:03:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 47,
    "fields": {
      "app_process": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48708,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:27:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 48,
    "fields": {
      "app_process": 500,
      "endpoint_id": 11,
      "parent_pid": 56378,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 32335,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T23:38:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 49,
    "fields": {
      "app_process": 10,
      "endpoint_id": 12,
      "parent_pid": 39319,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51816,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:08:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 50,
    "fields": {
      "app_process": 88,
      "endpoint_id": 12,
      "parent_pid": 9701,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 19801,
      "command_source": "user_profile",
      "started_at": "2025-09-09T11:46:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 51,
    "fields": {
      "app_process": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 62136,
      "command_source": "local_disk",
      "started_at": "2025-09-09T12:47:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 52,
    "fields": {
      "app_process": 293,
      "endpoint_id": 1,
      "parent_pid": 46403,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40901,
      "command_source": "temp_folder",
      "started_at": "2025-09-13T01:02:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 53,
    "fields": {
      "app_process": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5457,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:08:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 54,
    "fields": {
      "app_process": 438,
      "endpoint_id": 19,
      "parent_pid": 39388,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43256,
      "command_source": "local_disk",
      "started_at": "2025-09-09T22:20:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 55,
    "fields": {
      "app_process": 162,
      "endpoint_id": 29,
      "parent_pid": 4295,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 32472,
      "command_source": "user_profile",
      "started_at": "2025-09-11T13:33:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 56,
    "fields": {
      "app_process": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 39507,
      "command_source": "network_path",
      "started_at": "2025-09-08T19:53:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 57,
    "fields": {
      "app_process": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23633,
      "command_source": "user_profile",
      "started_at": "2025-09-09T15:57:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 58,
    "fields": {
      "app_process": 543,
      "endpoint_id": 5,
      "parent_pid": 14472,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 10035,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:58:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 59,
    "fields": {
      "app_process": 230,
      "endpoint_id": 19,
      "parent_pid": 40314,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 56323,
      "command_source": "local_disk",
      "started_at": "2025-09-12T10:35:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 60,
    "fields": {
      "app_process": 284,
      "endpoint_id": 10,
      "parent_pid": 25670,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57665,
      "command_source": "local_disk",
      "started_at": "2025-09-08T10:21:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 61,
    "fields": {
      "app_process": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 11673,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:42:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 62,
    "fields": {
      "app_process": 385,
      "endpoint_id": 5,
      "parent_pid": 19298,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 32560,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T22:52:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 63,
    "fields": {
      "app_process": 413,
      "endpoint_id": 18,
      "parent_pid": 15396,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 37668,
      "command_source": "user_profile",
      "started_at": "2025-09-10T21:29:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 64,
    "fields": {
      "app_process": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19943,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:14:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 65,
    "fields": {
      "app_process": 120,
      "endpoint_id": 15,
      "parent_pid": 29798,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34225,
      "command_source": "network_path",
      "started_at": "2025-09-08T15:15:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 66,
    "fields": {
      "app_process": 349,
      "endpoint_id": 19,
      "parent_pid": 20688,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18561,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:30:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 67,
    "fields": {
      "app_process": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19867,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:06:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 68,
    "fields": {
      "app_process": 403,
      "endpoint_id": 10,
      "parent_pid": 37069,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 49014,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:15:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 69,
    "fields": {
      "app_process": 261,
      "endpoint_id": 27,
      "parent_pid": 8522,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 55239,
      "command_source": "user_profile",
      "started_at": "2025-09-11T15:09:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 70,
    "fields": {
      "app_process": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 48159,
      "command_source": "local_disk",
      "started_at": "2025-09-09T01:03:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 71,
    "fields": {
      "app_process": 132,
      "endpoint_id": 10,
      "parent_pid": 54687,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53544,
      "command_source": "local_disk",
      "started_at": "2025-09-08T09:34:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 72,
    "fields": {
      "app_process": 95,
      "endpoint_id": 5,
      "parent_pid": 6543,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 19550,
      "command_source": "user_profile",
      "started_at": "2025-09-10T17:51:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 73,
    "fields": {
      "app_process": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 41382,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:12:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 74,
    "fields": {
      "app_process": 341,
      "endpoint_id": 14,
      "parent_pid": 28515,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62547,
      "command_source": "user_profile",
      "started_at": "2025-09-11T12:07:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 75,
    "fields": {
      "app_process": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32784,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:57:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 76,
    "fields": {
      "app_process": 414,
      "endpoint_id": 12,
      "parent_pid": 61129,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 4981,
      "command_source": "network_path",
      "started_at": "2025-09-09T18:44:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 77,
    "fields": {
      "app_process": 191,
      "endpoint_id": 18,
      "parent_pid": 7221,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 2424,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:47:15Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 78,
    "fields": {
      "app_process": 330,
      "endpoint_id": 19,
      "parent_pid": 3831,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50028,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T21:58:54Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 79,
    "fields": {
      "app_process": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 59197,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:13:18Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 80,
    "fields": {
      "app_process": 322,
      "endpoint_id": 18,
      "parent_pid": 45116,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1197,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:52:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 81,
    "fields": {
      "app_process": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20666,
      "command_source": "user_profile",
      "started_at": "2025-09-11T20:08:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 82,
    "fields": {
      "app_process": 127,
      "endpoint_id": 15,
      "parent_pid": 54190,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16153,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:24:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 83,
    "fields": {
      "app_process": 413,
      "endpoint_id": 18,
      "parent_pid": 15396,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 35845,
      "command_source": "local_disk",
      "started_at": "2025-09-10T21:31:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 84,
    "fields": {
      "app_process": 156,
      "endpoint_id": 22,
      "parent_pid": 8336,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32720,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:17:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 85,
    "fields": {
      "app_process": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24093,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:30:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 86,
    "fields": {
      "app_process": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12517,
      "command_source": "local_disk",
      "started_at": "2025-09-11T22:24:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 87,
    "fields": {
      "app_process": 380,
      "endpoint_id": 26,
      "parent_pid": 16118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6205,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T11:36:15Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 88,
    "fields": {
      "app_process": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 47945,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:03:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 89,
    "fields": {
      "app_process": 163,
      "endpoint_id": 9,
      "parent_pid": 49369,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 25132,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:35:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 90,
    "fields": {
      "app_process": 288,
      "endpoint_id": 30,
      "parent_pid": 43147,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60299,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T01:07:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 91,
    "fields": {
      "app_process": 332,
      "endpoint_id": 8,
      "parent_pid": 14407,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 12847,
      "command_source": "local_disk",
      "started_at": "2025-09-12T12:33:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 92,
    "fields": {
      "app_process": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27929,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:48:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 93,
    "fields": {
      "app_process": 563,
      "endpoint_id": 14,
      "parent_pid": 62900,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 58209,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:57:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 94,
    "fields": {
      "app_process": 518,
      "endpoint_id": 17,
      "parent_pid": 39724,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 13723,
      "command_source": "local_disk",
      "started_at": "2025-09-09T20:42:26Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 95,
    "fields": {
      "app_process": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27509,
      "command_source": "user_profile",
      "started_at": "2025-09-09T15:57:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 96,
    "fields": {
      "app_process": 451,
      "endpoint_id": 22,
      "parent_pid": 18454,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45475,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:39:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 97,
    "fields": {
      "app_process": 160,
      "endpoint_id": 12,
      "parent_pid": 46776,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 36668,
      "command_source": "user_profile",
      "started_at": "2025-09-09T12:12:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 98,
    "fields": {
      "app_process": 71,
      "endpoint_id": 14,
      "parent_pid": 20163,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 28025,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T10:24:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 99,
    "fields": {
      "app_process": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21572,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:35:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 100,
    "fields": {
      "app_process": 355,
      "endpoint_id": 19,
      "parent_pid": 12494,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 35449,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:38:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 101,
    "fields": {
      "app_process": 175,
      "endpoint_id": 15,
      "parent_pid": 45523,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42582,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T19:14:55Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 102,
    "fields": {
      "app_process": 210,
      "endpoint_id": 2,
      "parent_pid": 28766,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42752,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:29:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 103,
    "fields": {
      "app_process": 477,
      "endpoint_id": 5,
      "parent_pid": 7825,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37925,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:38:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 104,
    "fields": {
      "app_process": 384,
      "endpoint_id": 14,
      "parent_pid": 59974,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58288,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:52:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 105,
    "fields": {
      "app_process": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44465,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:48:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 106,
    "fields": {
      "app_process": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58533,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:30:15Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 107,
    "fields": {
      "app_process": 167,
      "endpoint_id": 5,
      "parent_pid": 5361,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 14190,
      "command_source": "local_disk",
      "started_at": "2025-09-10T20:02:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 108,
    "fields": {
      "app_process": 23,
      "endpoint_id": 29,
      "parent_pid": 21327,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14242,
      "command_source": "local_disk",
      "started_at": "2025-09-11T10:16:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 109,
    "fields": {
      "app_process": 254,
      "endpoint_id": 18,
      "parent_pid": 56120,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15299,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:46:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 110,
    "fields": {
      "app_process": 535,
      "endpoint_id": 11,
      "parent_pid": 12682,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 58444,
      "command_source": "local_disk",
      "started_at": "2025-09-13T00:01:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 111,
    "fields": {
      "app_process": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 18087,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:25:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 112,
    "fields": {
      "app_process": 21,
      "endpoint_id": 29,
      "parent_pid": 33716,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63700,
      "command_source": "user_profile",
      "started_at": "2025-09-11T11:02:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 113,
    "fields": {
      "app_process": 231,
      "endpoint_id": 30,
      "parent_pid": 54292,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62647,
      "command_source": "user_profile",
      "started_at": "2025-09-10T15:57:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 114,
    "fields": {
      "app_process": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 18970,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T18:13:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 115,
    "fields": {
      "app_process": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 57332,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:11:55Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 116,
    "fields": {
      "app_process": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62514,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:28:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 117,
    "fields": {
      "app_process": 389,
      "endpoint_id": 23,
      "parent_pid": 1834,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 57982,
      "command_source": "user_profile",
      "started_at": "2025-09-10T18:30:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 118,
    "fields": {
      "app_process": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34309,
      "command_source": "local_disk",
      "started_at": "2025-09-08T21:17:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 119,
    "fields": {
      "app_process": 125,
      "endpoint_id": 15,
      "parent_pid": 54123,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2794,
      "command_source": "local_disk",
      "started_at": "2025-09-08T15:19:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 120,
    "fields": {
      "app_process": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 42642,
      "command_source": "network_path",
      "started_at": "2025-09-13T00:14:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 121,
    "fields": {
      "app_process": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32063,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:35:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 122,
    "fields": {
      "app_process": 550,
      "endpoint_id": 7,
      "parent_pid": 33263,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59623,
      "command_source": "user_profile",
      "started_at": "2025-09-12T17:16:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 123,
    "fields": {
      "app_process": 163,
      "endpoint_id": 9,
      "parent_pid": 49369,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 39980,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:36:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 124,
    "fields": {
      "app_process": 540,
      "endpoint_id": 19,
      "parent_pid": 18596,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23120,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:13:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 125,
    "fields": {
      "app_process": 155,
      "endpoint_id": 11,
      "parent_pid": 1398,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46351,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:41:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 126,
    "fields": {
      "app_process": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28540,
      "command_source": "local_disk",
      "started_at": "2025-09-11T22:25:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 127,
    "fields": {
      "app_process": 153,
      "endpoint_id": 1,
      "parent_pid": 61558,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31826,
      "command_source": "local_disk",
      "started_at": "2025-09-08T21:43:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 128,
    "fields": {
      "app_process": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13658,
      "command_source": "user_profile",
      "started_at": "2025-09-13T00:29:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 129,
    "fields": {
      "app_process": 505,
      "endpoint_id": 6,
      "parent_pid": 53794,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9870,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:15:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 130,
    "fields": {
      "app_process": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41911,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T17:54:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 131,
    "fields": {
      "app_process": 161,
      "endpoint_id": 13,
      "parent_pid": 38072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57241,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:46:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 132,
    "fields": {
      "app_process": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41698,
      "command_source": "network_path",
      "started_at": "2025-09-09T13:29:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 133,
    "fields": {
      "app_process": 262,
      "endpoint_id": 17,
      "parent_pid": 3605,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 27298,
      "command_source": "local_disk",
      "started_at": "2025-09-09T18:38:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 134,
    "fields": {
      "app_process": 257,
      "endpoint_id": 11,
      "parent_pid": 17170,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18349,
      "command_source": "local_disk",
      "started_at": "2025-09-12T17:31:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 135,
    "fields": {
      "app_process": 410,
      "endpoint_id": 14,
      "parent_pid": 52011,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 57872,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:57:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 136,
    "fields": {
      "app_process": 480,
      "endpoint_id": 10,
      "parent_pid": 62992,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42078,
      "command_source": "user_profile",
      "started_at": "2025-09-10T15:32:56Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 137,
    "fields": {
      "app_process": 393,
      "endpoint_id": 1,
      "parent_pid": 15421,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 55647,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:34:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 138,
    "fields": {
      "app_process": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 22649,
      "command_source": "user_profile",
      "started_at": "2025-09-13T00:31:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 139,
    "fields": {
      "app_process": 229,
      "endpoint_id": 15,
      "parent_pid": 27407,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53469,
      "command_source": "local_disk",
      "started_at": "2025-09-08T18:07:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 140,
    "fields": {
      "app_process": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 4189,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:57:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 141,
    "fields": {
      "app_process": 520,
      "endpoint_id": 1,
      "parent_pid": 57289,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21334,
      "command_source": "local_disk",
      "started_at": "2025-09-10T18:36:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 142,
    "fields": {
      "app_process": 316,
      "endpoint_id": 9,
      "parent_pid": 64565,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 15003,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T13:08:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 143,
    "fields": {
      "app_process": 154,
      "endpoint_id": 2,
      "parent_pid": 57288,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59509,
      "command_source": "network_path",
      "started_at": "2025-09-08T12:07:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 144,
    "fields": {
      "app_process": 531,
      "endpoint_id": 26,
      "parent_pid": 56848,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 30252,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:35:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 145,
    "fields": {
      "app_process": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48637,
      "command_source": "user_profile",
      "started_at": "2025-09-10T13:59:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 146,
    "fields": {
      "app_process": 378,
      "endpoint_id": 22,
      "parent_pid": 14900,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 37072,
      "command_source": "local_disk",
      "started_at": "2025-09-08T13:42:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 147,
    "fields": {
      "app_process": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 49679,
      "command_source": "user_profile",
      "started_at": "2025-09-09T17:39:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 148,
    "fields": {
      "app_process": 267,
      "endpoint_id": 2,
      "parent_pid": 37820,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 23922,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:13:23Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 149,
    "fields": {
      "app_process": 496,
      "endpoint_id": 17,
      "parent_pid": 28484,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5767,
      "command_source": "local_disk",
      "started_at": "2025-09-09T20:22:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 150,
    "fields": {
      "app_process": 4,
      "endpoint_id": 10,
      "parent_pid": 13733,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45620,
      "command_source": "user_profile",
      "started_at": "2025-09-10T13:41:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 151,
    "fields": {
      "app_process": 253,
      "endpoint_id": 2,
      "parent_pid": 55668,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 42773,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:40:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 152,
    "fields": {
      "app_process": 450,
      "endpoint_id": 3,
      "parent_pid": 52592,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 32316,
      "command_source": "local_disk",
      "started_at": "2025-09-11T22:29:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 153,
    "fields": {
      "app_process": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 39357,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:41:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 154,
    "fields": {
      "app_process": 325,
      "endpoint_id": 30,
      "parent_pid": 20469,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32301,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:24:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 155,
    "fields": {
      "app_process": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3432,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:59:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 156,
    "fields": {
      "app_process": 260,
      "endpoint_id": 2,
      "parent_pid": 12286,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35571,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T13:50:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 157,
    "fields": {
      "app_process": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59399,
      "command_source": "network_path",
      "started_at": "2025-09-11T18:59:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 158,
    "fields": {
      "app_process": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50455,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T14:24:54Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 159,
    "fields": {
      "app_process": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20820,
      "command_source": "network_path",
      "started_at": "2025-09-13T00:23:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 160,
    "fields": {
      "app_process": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22164,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:00:54Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 161,
    "fields": {
      "app_process": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51929,
      "command_source": "network_path",
      "started_at": "2025-09-09T13:16:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 162,
    "fields": {
      "app_process": 312,
      "endpoint_id": 11,
      "parent_pid": 58917,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22010,
      "command_source": "local_disk",
      "started_at": "2025-09-12T12:14:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 163,
    "fields": {
      "app_process": 52,
      "endpoint_id": 30,
      "parent_pid": 34765,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 4275,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:59:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 164,
    "fields": {
      "app_process": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2699,
      "command_source": "local_disk",
      "started_at": "2025-09-11T22:25:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 165,
    "fields": {
      "app_process": 319,
      "endpoint_id": 5,
      "parent_pid": 9012,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7656,
      "command_source": "user_profile",
      "started_at": "2025-09-09T14:34:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 166,
    "fields": {
      "app_process": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49010,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:19:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 167,
    "fields": {
      "app_process": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51826,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:48:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 168,
    "fields": {
      "app_process": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 5536,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:34:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 169,
    "fields": {
      "app_process": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11749,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T12:33:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 170,
    "fields": {
      "app_process": 145,
      "endpoint_id": 2,
      "parent_pid": 11876,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 3164,
      "command_source": "user_profile",
      "started_at": "2025-09-10T12:24:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 171,
    "fields": {
      "app_process": 455,
      "endpoint_id": 8,
      "parent_pid": 28274,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 61064,
      "command_source": "network_path",
      "started_at": "2025-09-11T20:52:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 172,
    "fields": {
      "app_process": 1,
      "endpoint_id": 5,
      "parent_pid": 59762,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 21300,
      "command_source": "local_disk",
      "started_at": "2025-09-10T11:51:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 173,
    "fields": {
      "app_process": 108,
      "endpoint_id": 12,
      "parent_pid": 25979,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 61855,
      "command_source": "local_disk",
      "started_at": "2025-09-12T20:37:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 174,
    "fields": {
      "app_process": 335,
      "endpoint_id": 16,
      "parent_pid": 48395,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56733,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T16:51:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 175,
    "fields": {
      "app_process": 299,
      "endpoint_id": 5,
      "parent_pid": 40090,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 48172,
      "command_source": "user_profile",
      "started_at": "2025-09-10T14:55:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 176,
    "fields": {
      "app_process": 59,
      "endpoint_id": 30,
      "parent_pid": 53339,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 53100,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T18:32:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 177,
    "fields": {
      "app_process": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55169,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:51:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 178,
    "fields": {
      "app_process": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28119,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:36:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 179,
    "fields": {
      "app_process": 441,
      "endpoint_id": 17,
      "parent_pid": 56072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16208,
      "command_source": "local_disk",
      "started_at": "2025-09-08T23:52:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 180,
    "fields": {
      "app_process": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34061,
      "command_source": "local_disk",
      "started_at": "2025-09-13T00:25:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 181,
    "fields": {
      "app_process": 433,
      "endpoint_id": 8,
      "parent_pid": 49560,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40639,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T20:17:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 182,
    "fields": {
      "app_process": 420,
      "endpoint_id": 27,
      "parent_pid": 47194,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 8820,
      "command_source": "user_profile",
      "started_at": "2025-09-11T17:04:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 183,
    "fields": {
      "app_process": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25934,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T16:48:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 184,
    "fields": {
      "app_process": 430,
      "endpoint_id": 29,
      "parent_pid": 14673,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47191,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T12:50:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 185,
    "fields": {
      "app_process": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50340,
      "command_source": "local_disk",
      "started_at": "2025-09-12T14:26:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 186,
    "fields": {
      "app_process": 241,
      "endpoint_id": 10,
      "parent_pid": 32223,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30415,
      "command_source": "local_disk",
      "started_at": "2025-09-09T14:09:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 187,
    "fields": {
      "app_process": 564,
      "endpoint_id": 24,
      "parent_pid": 20441,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14955,
      "command_source": "local_disk",
      "started_at": "2025-09-09T15:39:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 188,
    "fields": {
      "app_process": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36612,
      "command_source": "local_disk",
      "started_at": "2025-09-10T20:10:02Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 189,
    "fields": {
      "app_process": 449,
      "endpoint_id": 6,
      "parent_pid": 7351,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 42612,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:28:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 190,
    "fields": {
      "app_process": 354,
      "endpoint_id": 8,
      "parent_pid": 42988,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 47393,
      "command_source": "local_disk",
      "started_at": "2025-09-08T13:26:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 191,
    "fields": {
      "app_process": 62,
      "endpoint_id": 30,
      "parent_pid": 13633,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 26603,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:26:54Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 192,
    "fields": {
      "app_process": 576,
      "endpoint_id": 7,
      "parent_pid": 9308,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63629,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T19:15:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 193,
    "fields": {
      "app_process": 225,
      "endpoint_id": 19,
      "parent_pid": 60709,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51651,
      "command_source": "user_profile",
      "started_at": "2025-09-09T11:46:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 194,
    "fields": {
      "app_process": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50831,
      "command_source": "local_disk",
      "started_at": "2025-09-12T11:07:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 195,
    "fields": {
      "app_process": 164,
      "endpoint_id": 13,
      "parent_pid": 44115,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14436,
      "command_source": "local_disk",
      "started_at": "2025-09-09T18:19:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 196,
    "fields": {
      "app_process": 565,
      "endpoint_id": 11,
      "parent_pid": 59866,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53258,
      "command_source": "user_profile",
      "started_at": "2025-09-12T14:44:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 197,
    "fields": {
      "app_process": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51841,
      "command_source": "network_path",
      "started_at": "2025-09-09T20:18:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 198,
    "fields": {
      "app_process": 232,
      "endpoint_id": 2,
      "parent_pid": 32167,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26563,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:35:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 199,
    "fields": {
      "app_process": 23,
      "endpoint_id": 29,
      "parent_pid": 21327,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9025,
      "command_source": "user_profile",
      "started_at": "2025-09-11T10:17:50Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 200,
    "fields": {
      "app_process": 139,
      "endpoint_id": 27,
      "parent_pid": 13534,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62314,
      "command_source": "local_disk",
      "started_at": "2025-09-11T13:44:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 201,
    "fields": {
      "app_process": 398,
      "endpoint_id": 12,
      "parent_pid": 31853,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52141,
      "command_source": "local_disk",
      "started_at": "2025-09-12T22:47:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 202,
    "fields": {
      "app_process": 437,
      "endpoint_id": 5,
      "parent_pid": 45963,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49554,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:57:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 203,
    "fields": {
      "app_process": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41894,
      "command_source": "user_profile",
      "started_at": "2025-09-08T16:57:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 204,
    "fields": {
      "app_process": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 51038,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:16:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 205,
    "fields": {
      "app_process": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18956,
      "command_source": "user_profile",
      "started_at": "2025-09-11T12:30:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 206,
    "fields": {
      "app_process": 432,
      "endpoint_id": 20,
      "parent_pid": 58174,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 64523,
      "command_source": "local_disk",
      "started_at": "2025-09-08T18:51:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 207,
    "fields": {
      "app_process": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 63233,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:14:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 208,
    "fields": {
      "app_process": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31548,
      "command_source": "local_disk",
      "started_at": "2025-09-08T15:43:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 209,
    "fields": {
      "app_process": 204,
      "endpoint_id": 24,
      "parent_pid": 15665,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 20424,
      "command_source": "local_disk",
      "started_at": "2025-09-08T10:51:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 210,
    "fields": {
      "app_process": 546,
      "endpoint_id": 15,
      "parent_pid": 21296,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60117,
      "command_source": "local_disk",
      "started_at": "2025-09-12T22:06:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 211,
    "fields": {
      "app_process": 530,
      "endpoint_id": 2,
      "parent_pid": 46255,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47334,
      "command_source": "local_disk",
      "started_at": "2025-09-09T00:57:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 212,
    "fields": {
      "app_process": 314,
      "endpoint_id": 17,
      "parent_pid": 7325,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 35275,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T19:20:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 213,
    "fields": {
      "app_process": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1164,
      "command_source": "local_disk",
      "started_at": "2025-09-12T00:52:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 214,
    "fields": {
      "app_process": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60294,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T13:58:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 215,
    "fields": {
      "app_process": 380,
      "endpoint_id": 26,
      "parent_pid": 16118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 38785,
      "command_source": "local_disk",
      "started_at": "2025-09-08T11:36:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 216,
    "fields": {
      "app_process": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9359,
      "command_source": "local_disk",
      "started_at": "2025-09-10T12:39:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 217,
    "fields": {
      "app_process": 458,
      "endpoint_id": 9,
      "parent_pid": 33005,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32321,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:51:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 218,
    "fields": {
      "app_process": 12,
      "endpoint_id": 8,
      "parent_pid": 52296,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20052,
      "command_source": "local_disk",
      "started_at": "2025-09-11T14:10:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 219,
    "fields": {
      "app_process": 554,
      "endpoint_id": 24,
      "parent_pid": 2524,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9205,
      "command_source": "local_disk",
      "started_at": "2025-09-09T14:55:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 220,
    "fields": {
      "app_process": 464,
      "endpoint_id": 1,
      "parent_pid": 16918,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40999,
      "command_source": "user_profile",
      "started_at": "2025-09-08T17:29:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 221,
    "fields": {
      "app_process": 264,
      "endpoint_id": 17,
      "parent_pid": 6071,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25061,
      "command_source": "user_profile",
      "started_at": "2025-09-11T14:55:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 222,
    "fields": {
      "app_process": 451,
      "endpoint_id": 22,
      "parent_pid": 18454,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 44563,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:41:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 223,
    "fields": {
      "app_process": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 27781,
      "command_source": "user_profile",
      "started_at": "2025-09-09T12:47:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 224,
    "fields": {
      "app_process": 443,
      "endpoint_id": 29,
      "parent_pid": 7017,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14180,
      "command_source": "local_disk",
      "started_at": "2025-09-11T14:11:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 225,
    "fields": {
      "app_process": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 30097,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T13:02:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 226,
    "fields": {
      "app_process": 420,
      "endpoint_id": 27,
      "parent_pid": 47194,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 24640,
      "command_source": "network_path",
      "started_at": "2025-09-11T17:05:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 227,
    "fields": {
      "app_process": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 55244,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T12:15:23Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 228,
    "fields": {
      "app_process": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22005,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:01:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 229,
    "fields": {
      "app_process": 377,
      "endpoint_id": 8,
      "parent_pid": 27111,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 30427,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:54:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 230,
    "fields": {
      "app_process": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22511,
      "command_source": "network_path",
      "started_at": "2025-09-10T12:39:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 231,
    "fields": {
      "app_process": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31301,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:16:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 232,
    "fields": {
      "app_process": 567,
      "endpoint_id": 30,
      "parent_pid": 25903,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 32355,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:53:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 233,
    "fields": {
      "app_process": 92,
      "endpoint_id": 4,
      "parent_pid": 49989,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 38098,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:14:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 234,
    "fields": {
      "app_process": 71,
      "endpoint_id": 14,
      "parent_pid": 20163,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 29804,
      "command_source": "local_disk",
      "started_at": "2025-09-11T10:24:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 235,
    "fields": {
      "app_process": 437,
      "endpoint_id": 5,
      "parent_pid": 45963,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1654,
      "command_source": "user_profile",
      "started_at": "2025-09-10T14:59:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 236,
    "fields": {
      "app_process": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21573,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:41:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 237,
    "fields": {
      "app_process": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32565,
      "command_source": "local_disk",
      "started_at": "2025-09-09T15:59:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 238,
    "fields": {
      "app_process": 376,
      "endpoint_id": 8,
      "parent_pid": 13354,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23600,
      "command_source": "user_profile",
      "started_at": "2025-09-08T14:35:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 239,
    "fields": {
      "app_process": 503,
      "endpoint_id": 9,
      "parent_pid": 58254,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 64715,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T21:47:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 240,
    "fields": {
      "app_process": 179,
      "endpoint_id": 12,
      "parent_pid": 41425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57671,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T21:59:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 241,
    "fields": {
      "app_process": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 12122,
      "command_source": "user_profile",
      "started_at": "2025-09-12T15:52:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 242,
    "fields": {
      "app_process": 464,
      "endpoint_id": 1,
      "parent_pid": 16918,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57971,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:29:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 243,
    "fields": {
      "app_process": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 1729,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T15:59:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 244,
    "fields": {
      "app_process": 132,
      "endpoint_id": 10,
      "parent_pid": 54687,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11111,
      "command_source": "local_disk",
      "started_at": "2025-09-08T09:34:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 245,
    "fields": {
      "app_process": 237,
      "endpoint_id": 24,
      "parent_pid": 14924,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13239,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:40:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 246,
    "fields": {
      "app_process": 379,
      "endpoint_id": 10,
      "parent_pid": 6542,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36390,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T14:07:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 247,
    "fields": {
      "app_process": 404,
      "endpoint_id": 1,
      "parent_pid": 1270,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 36715,
      "command_source": "user_profile",
      "started_at": "2025-09-09T15:57:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 248,
    "fields": {
      "app_process": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26572,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:03:23Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 249,
    "fields": {
      "app_process": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25415,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:10:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 250,
    "fields": {
      "app_process": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 60016,
      "command_source": "user_profile",
      "started_at": "2025-09-12T15:34:56Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 251,
    "fields": {
      "app_process": 62,
      "endpoint_id": 30,
      "parent_pid": 13633,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 48711,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:28:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 252,
    "fields": {
      "app_process": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 3603,
      "command_source": "local_disk",
      "started_at": "2025-09-09T01:05:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 253,
    "fields": {
      "app_process": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40023,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T16:10:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 254,
    "fields": {
      "app_process": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49295,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:57:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 255,
    "fields": {
      "app_process": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58155,
      "command_source": "local_disk",
      "started_at": "2025-09-12T15:53:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 256,
    "fields": {
      "app_process": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38598,
      "command_source": "local_disk",
      "started_at": "2025-09-12T17:46:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 257,
    "fields": {
      "app_process": 366,
      "endpoint_id": 4,
      "parent_pid": 38325,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29704,
      "command_source": "user_profile",
      "started_at": "2025-09-11T09:30:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 258,
    "fields": {
      "app_process": 348,
      "endpoint_id": 14,
      "parent_pid": 36455,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 15922,
      "command_source": "user_profile",
      "started_at": "2025-09-10T15:21:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 259,
    "fields": {
      "app_process": 69,
      "endpoint_id": 2,
      "parent_pid": 34591,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 55151,
      "command_source": "user_profile",
      "started_at": "2025-09-11T17:38:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 260,
    "fields": {
      "app_process": 44,
      "endpoint_id": 28,
      "parent_pid": 34278,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61890,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:11:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 261,
    "fields": {
      "app_process": 412,
      "endpoint_id": 8,
      "parent_pid": 2537,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 35144,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:48:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 262,
    "fields": {
      "app_process": 68,
      "endpoint_id": 30,
      "parent_pid": 28650,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49643,
      "command_source": "local_disk",
      "started_at": "2025-09-10T17:46:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 263,
    "fields": {
      "app_process": 236,
      "endpoint_id": 3,
      "parent_pid": 19597,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17769,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:38:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 264,
    "fields": {
      "app_process": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15100,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T10:40:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 265,
    "fields": {
      "app_process": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 64321,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:39:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 266,
    "fields": {
      "app_process": 308,
      "endpoint_id": 1,
      "parent_pid": 39176,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36227,
      "command_source": "local_disk",
      "started_at": "2025-09-08T13:27:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 267,
    "fields": {
      "app_process": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 40481,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:12:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 268,
    "fields": {
      "app_process": 398,
      "endpoint_id": 12,
      "parent_pid": 31853,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6531,
      "command_source": "local_disk",
      "started_at": "2025-09-12T22:49:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 269,
    "fields": {
      "app_process": 221,
      "endpoint_id": 25,
      "parent_pid": 36353,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51335,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:44:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 270,
    "fields": {
      "app_process": 508,
      "endpoint_id": 17,
      "parent_pid": 56082,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22611,
      "command_source": "user_profile",
      "started_at": "2025-09-11T11:39:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 271,
    "fields": {
      "app_process": 191,
      "endpoint_id": 18,
      "parent_pid": 7221,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 28096,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:48:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 272,
    "fields": {
      "app_process": 454,
      "endpoint_id": 24,
      "parent_pid": 44332,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59285,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T17:27:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 273,
    "fields": {
      "app_process": 79,
      "endpoint_id": 7,
      "parent_pid": 32308,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32749,
      "command_source": "network_path",
      "started_at": "2025-09-09T09:47:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 274,
    "fields": {
      "app_process": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 21245,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:19:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 275,
    "fields": {
      "app_process": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 55324,
      "command_source": "local_disk",
      "started_at": "2025-09-09T16:41:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 276,
    "fields": {
      "app_process": 4,
      "endpoint_id": 10,
      "parent_pid": 13733,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11243,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:43:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 277,
    "fields": {
      "app_process": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 58788,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:01:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 278,
    "fields": {
      "app_process": 474,
      "endpoint_id": 14,
      "parent_pid": 46432,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44687,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T14:17:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 279,
    "fields": {
      "app_process": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61570,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T11:09:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 280,
    "fields": {
      "app_process": 236,
      "endpoint_id": 3,
      "parent_pid": 19597,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53586,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:38:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 281,
    "fields": {
      "app_process": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 51509,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T20:11:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 282,
    "fields": {
      "app_process": 47,
      "endpoint_id": 28,
      "parent_pid": 26066,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34472,
      "command_source": "local_disk",
      "started_at": "2025-09-08T18:35:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 283,
    "fields": {
      "app_process": 212,
      "endpoint_id": 4,
      "parent_pid": 61892,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26873,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:43:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 284,
    "fields": {
      "app_process": 445,
      "endpoint_id": 16,
      "parent_pid": 8609,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45608,
      "command_source": "local_disk",
      "started_at": "2025-09-12T19:51:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 285,
    "fields": {
      "app_process": 349,
      "endpoint_id": 19,
      "parent_pid": 20688,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59177,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:32:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 286,
    "fields": {
      "app_process": 352,
      "endpoint_id": 18,
      "parent_pid": 39809,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18022,
      "command_source": "user_profile",
      "started_at": "2025-09-10T19:58:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 287,
    "fields": {
      "app_process": 389,
      "endpoint_id": 23,
      "parent_pid": 1834,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 46842,
      "command_source": "network_path",
      "started_at": "2025-09-10T18:30:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 288,
    "fields": {
      "app_process": 56,
      "endpoint_id": 10,
      "parent_pid": 61151,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 16846,
      "command_source": "local_disk",
      "started_at": "2025-09-08T08:02:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 289,
    "fields": {
      "app_process": 145,
      "endpoint_id": 2,
      "parent_pid": 11876,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64062,
      "command_source": "local_disk",
      "started_at": "2025-09-10T12:24:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 290,
    "fields": {
      "app_process": 443,
      "endpoint_id": 29,
      "parent_pid": 7017,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 6071,
      "command_source": "local_disk",
      "started_at": "2025-09-11T14:12:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 291,
    "fields": {
      "app_process": 187,
      "endpoint_id": 3,
      "parent_pid": 56528,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 11089,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T19:06:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 292,
    "fields": {
      "app_process": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17881,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:29:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 293,
    "fields": {
      "app_process": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23133,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:59:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 294,
    "fields": {
      "app_process": 103,
      "endpoint_id": 16,
      "parent_pid": 37100,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 2152,
      "command_source": "local_disk",
      "started_at": "2025-09-12T15:35:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 295,
    "fields": {
      "app_process": 456,
      "endpoint_id": 12,
      "parent_pid": 45910,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 37910,
      "command_source": "local_disk",
      "started_at": "2025-09-08T21:42:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 296,
    "fields": {
      "app_process": 423,
      "endpoint_id": 16,
      "parent_pid": 29523,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12747,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T19:34:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 297,
    "fields": {
      "app_process": 549,
      "endpoint_id": 9,
      "parent_pid": 54109,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54251,
      "command_source": "network_path",
      "started_at": "2025-09-08T22:54:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 298,
    "fields": {
      "app_process": 557,
      "endpoint_id": 30,
      "parent_pid": 51424,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44477,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T04:19:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 299,
    "fields": {
      "app_process": 525,
      "endpoint_id": 24,
      "parent_pid": 9432,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15415,
      "command_source": "local_disk",
      "started_at": "2025-09-09T14:20:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 300,
    "fields": {
      "app_process": 570,
      "endpoint_id": 3,
      "parent_pid": 37692,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 3681,
      "command_source": "user_profile",
      "started_at": "2025-09-11T22:49:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 301,
    "fields": {
      "app_process": 476,
      "endpoint_id": 16,
      "parent_pid": 56343,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24563,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T20:24:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 302,
    "fields": {
      "app_process": 92,
      "endpoint_id": 4,
      "parent_pid": 49989,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9180,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:16:26Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 303,
    "fields": {
      "app_process": 348,
      "endpoint_id": 14,
      "parent_pid": 36455,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 42246,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:23:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 304,
    "fields": {
      "app_process": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11738,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:50:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 305,
    "fields": {
      "app_process": 533,
      "endpoint_id": 1,
      "parent_pid": 44023,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25135,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:42:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 306,
    "fields": {
      "app_process": 254,
      "endpoint_id": 18,
      "parent_pid": 56120,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27568,
      "command_source": "user_profile",
      "started_at": "2025-09-10T15:47:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 307,
    "fields": {
      "app_process": 387,
      "endpoint_id": 28,
      "parent_pid": 13027,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18296,
      "command_source": "network_path",
      "started_at": "2025-09-08T19:00:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 308,
    "fields": {
      "app_process": 38,
      "endpoint_id": 23,
      "parent_pid": 52701,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61360,
      "command_source": "local_disk",
      "started_at": "2025-09-10T15:48:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 309,
    "fields": {
      "app_process": 12,
      "endpoint_id": 8,
      "parent_pid": 52296,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 2764,
      "command_source": "user_profile",
      "started_at": "2025-09-11T14:12:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 310,
    "fields": {
      "app_process": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9990,
      "command_source": "user_profile",
      "started_at": "2025-09-11T12:21:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 311,
    "fields": {
      "app_process": 523,
      "endpoint_id": 9,
      "parent_pid": 41324,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 39904,
      "command_source": "network_path",
      "started_at": "2025-09-10T23:16:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 312,
    "fields": {
      "app_process": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 17374,
      "command_source": "local_disk",
      "started_at": "2025-09-12T23:14:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 313,
    "fields": {
      "app_process": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 49530,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:41:55Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 314,
    "fields": {
      "app_process": 88,
      "endpoint_id": 12,
      "parent_pid": 9701,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7157,
      "command_source": "network_path",
      "started_at": "2025-09-09T11:47:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 315,
    "fields": {
      "app_process": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61084,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:44:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 316,
    "fields": {
      "app_process": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25409,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:57:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 317,
    "fields": {
      "app_process": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60884,
      "command_source": "local_disk",
      "started_at": "2025-09-12T14:26:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 318,
    "fields": {
      "app_process": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 12786,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:13:56Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 319,
    "fields": {
      "app_process": 259,
      "endpoint_id": 29,
      "parent_pid": 1192,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 24121,
      "command_source": "local_disk",
      "started_at": "2025-09-10T12:04:50Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 320,
    "fields": {
      "app_process": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 9286,
      "command_source": "network_path",
      "started_at": "2025-09-08T17:16:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 321,
    "fields": {
      "app_process": 239,
      "endpoint_id": 23,
      "parent_pid": 3544,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10671,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:31:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 322,
    "fields": {
      "app_process": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47075,
      "command_source": "user_profile",
      "started_at": "2025-09-08T21:17:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 323,
    "fields": {
      "app_process": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 29428,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:37:17Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 324,
    "fields": {
      "app_process": 557,
      "endpoint_id": 30,
      "parent_pid": 51424,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10452,
      "command_source": "local_disk",
      "started_at": "2025-09-12T04:19:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 325,
    "fields": {
      "app_process": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18947,
      "command_source": "local_disk",
      "started_at": "2025-09-12T00:54:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 326,
    "fields": {
      "app_process": 280,
      "endpoint_id": 24,
      "parent_pid": 42237,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23642,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T15:06:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 327,
    "fields": {
      "app_process": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25589,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T17:48:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 328,
    "fields": {
      "app_process": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41697,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:38:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 329,
    "fields": {
      "app_process": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 47419,
      "command_source": "user_profile",
      "started_at": "2025-09-09T16:41:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 330,
    "fields": {
      "app_process": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 57718,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T01:07:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 331,
    "fields": {
      "app_process": 275,
      "endpoint_id": 27,
      "parent_pid": 50379,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18698,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:32:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 332,
    "fields": {
      "app_process": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22027,
      "command_source": "user_profile",
      "started_at": "2025-09-10T14:04:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 333,
    "fields": {
      "app_process": 303,
      "endpoint_id": 7,
      "parent_pid": 60717,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59737,
      "command_source": "local_disk",
      "started_at": "2025-09-10T22:22:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 334,
    "fields": {
      "app_process": 326,
      "endpoint_id": 8,
      "parent_pid": 23781,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33463,
      "command_source": "local_disk",
      "started_at": "2025-09-11T17:50:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 335,
    "fields": {
      "app_process": 563,
      "endpoint_id": 14,
      "parent_pid": 62900,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 28152,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T15:57:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 336,
    "fields": {
      "app_process": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45925,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:05:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 337,
    "fields": {
      "app_process": 201,
      "endpoint_id": 12,
      "parent_pid": 63883,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 50103,
      "command_source": "user_profile",
      "started_at": "2025-09-09T13:30:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 338,
    "fields": {
      "app_process": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 60354,
      "command_source": "temp_folder",
      "started_at": "2025-09-13T00:16:07Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 339,
    "fields": {
      "app_process": 70,
      "endpoint_id": 20,
      "parent_pid": 7497,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18447,
      "command_source": "local_disk",
      "started_at": "2025-09-12T20:23:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 340,
    "fields": {
      "app_process": 144,
      "endpoint_id": 18,
      "parent_pid": 57322,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 13091,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:39:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 341,
    "fields": {
      "app_process": 522,
      "endpoint_id": 28,
      "parent_pid": 51499,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 13177,
      "command_source": "network_path",
      "started_at": "2025-09-08T19:52:55Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 342,
    "fields": {
      "app_process": 225,
      "endpoint_id": 19,
      "parent_pid": 60709,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45960,
      "command_source": "local_disk",
      "started_at": "2025-09-09T11:48:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 343,
    "fields": {
      "app_process": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40560,
      "command_source": "local_disk",
      "started_at": "2025-09-08T15:52:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 344,
    "fields": {
      "app_process": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43942,
      "command_source": "local_disk",
      "started_at": "2025-09-09T20:19:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 345,
    "fields": {
      "app_process": 319,
      "endpoint_id": 5,
      "parent_pid": 9012,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 26755,
      "command_source": "local_disk",
      "started_at": "2025-09-09T14:34:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 346,
    "fields": {
      "app_process": 449,
      "endpoint_id": 6,
      "parent_pid": 7351,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 5719,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T13:28:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 347,
    "fields": {
      "app_process": 532,
      "endpoint_id": 11,
      "parent_pid": 27202,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40037,
      "command_source": "user_profile",
      "started_at": "2025-09-08T16:06:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 348,
    "fields": {
      "app_process": 515,
      "endpoint_id": 19,
      "parent_pid": 36077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 23389,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T16:41:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 349,
    "fields": {
      "app_process": 481,
      "endpoint_id": 26,
      "parent_pid": 56274,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 22128,
      "command_source": "user_profile",
      "started_at": "2025-09-08T16:58:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 350,
    "fields": {
      "app_process": 314,
      "endpoint_id": 17,
      "parent_pid": 7325,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18978,
      "command_source": "local_disk",
      "started_at": "2025-09-09T19:21:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 351,
    "fields": {
      "app_process": 456,
      "endpoint_id": 12,
      "parent_pid": 45910,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 14819,
      "command_source": "local_disk",
      "started_at": "2025-09-08T21:42:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 352,
    "fields": {
      "app_process": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 19944,
      "command_source": "local_disk",
      "started_at": "2025-09-08T18:15:04Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 353,
    "fields": {
      "app_process": 356,
      "endpoint_id": 16,
      "parent_pid": 54721,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 38745,
      "command_source": "local_disk",
      "started_at": "2025-09-10T18:23:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 354,
    "fields": {
      "app_process": 322,
      "endpoint_id": 18,
      "parent_pid": 45116,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37192,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:54:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 355,
    "fields": {
      "app_process": 252,
      "endpoint_id": 4,
      "parent_pid": 47675,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 7207,
      "command_source": "user_profile",
      "started_at": "2025-09-10T18:41:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 356,
    "fields": {
      "app_process": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62331,
      "command_source": "local_disk",
      "started_at": "2025-09-08T15:53:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 357,
    "fields": {
      "app_process": 11,
      "endpoint_id": 13,
      "parent_pid": 25035,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 37690,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:12:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 358,
    "fields": {
      "app_process": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 788,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:32:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 359,
    "fields": {
      "app_process": 310,
      "endpoint_id": 27,
      "parent_pid": 31168,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 25178,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:46:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 360,
    "fields": {
      "app_process": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42080,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:36:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 361,
    "fields": {
      "app_process": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48953,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:29:23Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 362,
    "fields": {
      "app_process": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 7566,
      "command_source": "local_disk",
      "started_at": "2025-09-08T19:54:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 363,
    "fields": {
      "app_process": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40145,
      "command_source": "local_disk",
      "started_at": "2025-09-09T20:21:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 364,
    "fields": {
      "app_process": 568,
      "endpoint_id": 10,
      "parent_pid": 2260,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33834,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T15:49:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 365,
    "fields": {
      "app_process": 442,
      "endpoint_id": 19,
      "parent_pid": 7940,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45537,
      "command_source": "local_disk",
      "started_at": "2025-09-09T23:31:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 366,
    "fields": {
      "app_process": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54289,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T15:55:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 367,
    "fields": {
      "app_process": 298,
      "endpoint_id": 2,
      "parent_pid": 40165,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5447,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:52:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 368,
    "fields": {
      "app_process": 2,
      "endpoint_id": 4,
      "parent_pid": 36180,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 57299,
      "command_source": "user_profile",
      "started_at": "2025-09-11T08:16:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 369,
    "fields": {
      "app_process": 417,
      "endpoint_id": 29,
      "parent_pid": 7857,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 42628,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:37:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 370,
    "fields": {
      "app_process": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 34000,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:25:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 371,
    "fields": {
      "app_process": 11,
      "endpoint_id": 13,
      "parent_pid": 25035,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 41579,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:13:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 372,
    "fields": {
      "app_process": 127,
      "endpoint_id": 15,
      "parent_pid": 54190,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47838,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:25:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 373,
    "fields": {
      "app_process": 376,
      "endpoint_id": 8,
      "parent_pid": 13354,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48102,
      "command_source": "local_disk",
      "started_at": "2025-09-08T14:35:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 374,
    "fields": {
      "app_process": 561,
      "endpoint_id": 16,
      "parent_pid": 31827,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19878,
      "command_source": "local_disk",
      "started_at": "2025-09-12T20:35:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 375,
    "fields": {
      "app_process": 248,
      "endpoint_id": 4,
      "parent_pid": 60865,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61982,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:42:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 376,
    "fields": {
      "app_process": 396,
      "endpoint_id": 19,
      "parent_pid": 22514,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58420,
      "command_source": "local_disk",
      "started_at": "2025-09-09T22:08:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 377,
    "fields": {
      "app_process": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64130,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:18:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 378,
    "fields": {
      "app_process": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33597,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T15:19:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 379,
    "fields": {
      "app_process": 532,
      "endpoint_id": 11,
      "parent_pid": 27202,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9815,
      "command_source": "user_profile",
      "started_at": "2025-09-08T16:07:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 380,
    "fields": {
      "app_process": 195,
      "endpoint_id": 9,
      "parent_pid": 54269,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51187,
      "command_source": "user_profile",
      "started_at": "2025-09-12T18:22:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 381,
    "fields": {
      "app_process": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57075,
      "command_source": "user_profile",
      "started_at": "2025-09-11T18:42:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 382,
    "fields": {
      "app_process": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51952,
      "command_source": "local_disk",
      "started_at": "2025-09-12T17:49:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 383,
    "fields": {
      "app_process": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9382,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:58:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 384,
    "fields": {
      "app_process": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 51724,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:59:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 385,
    "fields": {
      "app_process": 265,
      "endpoint_id": 14,
      "parent_pid": 932,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 16388,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T11:38:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 386,
    "fields": {
      "app_process": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27036,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:16:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 387,
    "fields": {
      "app_process": 198,
      "endpoint_id": 5,
      "parent_pid": 48079,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 60734,
      "command_source": "local_disk",
      "started_at": "2025-09-10T21:31:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 388,
    "fields": {
      "app_process": 455,
      "endpoint_id": 8,
      "parent_pid": 28274,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 5593,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T20:52:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 389,
    "fields": {
      "app_process": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28686,
      "command_source": "local_disk",
      "started_at": "2025-09-08T19:55:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 390,
    "fields": {
      "app_process": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 1144,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:31:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 391,
    "fields": {
      "app_process": 42,
      "endpoint_id": 27,
      "parent_pid": 43487,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2753,
      "command_source": "user_profile",
      "started_at": "2025-09-11T12:25:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 392,
    "fields": {
      "app_process": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 31836,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T18:15:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 393,
    "fields": {
      "app_process": 211,
      "endpoint_id": 14,
      "parent_pid": 5420,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 34454,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T09:32:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 394,
    "fields": {
      "app_process": 308,
      "endpoint_id": 1,
      "parent_pid": 39176,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22945,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T13:29:03Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 395,
    "fields": {
      "app_process": 221,
      "endpoint_id": 25,
      "parent_pid": 36353,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 2690,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:45:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 396,
    "fields": {
      "app_process": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 35574,
      "command_source": "local_disk",
      "started_at": "2025-09-13T00:32:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 397,
    "fields": {
      "app_process": 146,
      "endpoint_id": 15,
      "parent_pid": 25240,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62976,
      "command_source": "local_disk",
      "started_at": "2025-09-12T18:47:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 398,
    "fields": {
      "app_process": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32866,
      "command_source": "local_disk",
      "started_at": "2025-09-09T17:54:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 399,
    "fields": {
      "app_process": 363,
      "endpoint_id": 2,
      "parent_pid": 16048,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32246,
      "command_source": "user_profile",
      "started_at": "2025-09-12T16:29:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 400,
    "fields": {
      "app_process": 139,
      "endpoint_id": 27,
      "parent_pid": 13534,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30629,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T13:46:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 401,
    "fields": {
      "app_process": 282,
      "endpoint_id": 21,
      "parent_pid": 25431,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 5995,
      "command_source": "user_profile",
      "started_at": "2025-09-09T10:53:18Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 402,
    "fields": {
      "app_process": 259,
      "endpoint_id": 29,
      "parent_pid": 1192,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 64519,
      "command_source": "local_disk",
      "started_at": "2025-09-10T12:04:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 403,
    "fields": {
      "app_process": 560,
      "endpoint_id": 12,
      "parent_pid": 18770,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54426,
      "command_source": "user_profile",
      "started_at": "2025-09-13T01:59:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 404,
    "fields": {
      "app_process": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 29843,
      "command_source": "user_profile",
      "started_at": "2025-09-12T15:36:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 405,
    "fields": {
      "app_process": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 45716,
      "command_source": "local_disk",
      "started_at": "2025-09-11T23:32:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 406,
    "fields": {
      "app_process": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45962,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:43:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 407,
    "fields": {
      "app_process": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41437,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:20:01Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 408,
    "fields": {
      "app_process": 217,
      "endpoint_id": 23,
      "parent_pid": 61419,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42529,
      "command_source": "local_disk",
      "started_at": "2025-09-10T17:42:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 409,
    "fields": {
      "app_process": 503,
      "endpoint_id": 9,
      "parent_pid": 58254,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57005,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T21:49:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 410,
    "fields": {
      "app_process": 97,
      "endpoint_id": 13,
      "parent_pid": 10964,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 63419,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T17:35:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 411,
    "fields": {
      "app_process": 1,
      "endpoint_id": 5,
      "parent_pid": 59762,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 16568,
      "command_source": "local_disk",
      "started_at": "2025-09-10T11:52:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 412,
    "fields": {
      "app_process": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29898,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:59:24Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 413,
    "fields": {
      "app_process": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 34929,
      "command_source": "user_profile",
      "started_at": "2025-09-08T13:03:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 414,
    "fields": {
      "app_process": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22148,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:42:39Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 415,
    "fields": {
      "app_process": 325,
      "endpoint_id": 30,
      "parent_pid": 20469,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 53441,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:25:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 416,
    "fields": {
      "app_process": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32671,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:30:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 417,
    "fields": {
      "app_process": 385,
      "endpoint_id": 5,
      "parent_pid": 19298,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 27953,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T22:54:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 418,
    "fields": {
      "app_process": 435,
      "endpoint_id": 7,
      "parent_pid": 42046,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 36056,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:36:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 419,
    "fields": {
      "app_process": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 1287,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T10:40:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 420,
    "fields": {
      "app_process": 489,
      "endpoint_id": 18,
      "parent_pid": 22003,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 41581,
      "command_source": "local_disk",
      "started_at": "2025-09-10T22:43:02Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 421,
    "fields": {
      "app_process": 13,
      "endpoint_id": 12,
      "parent_pid": 63035,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 9672,
      "command_source": "user_profile",
      "started_at": "2025-09-08T16:28:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 422,
    "fields": {
      "app_process": 462,
      "endpoint_id": 9,
      "parent_pid": 1160,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 8626,
      "command_source": "local_disk",
      "started_at": "2025-09-10T20:35:59Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 423,
    "fields": {
      "app_process": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58521,
      "command_source": "user_profile",
      "started_at": "2025-09-09T13:18:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 424,
    "fields": {
      "app_process": 36,
      "endpoint_id": 8,
      "parent_pid": 26578,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13750,
      "command_source": "user_profile",
      "started_at": "2025-09-08T10:19:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 425,
    "fields": {
      "app_process": 458,
      "endpoint_id": 9,
      "parent_pid": 33005,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26208,
      "command_source": "user_profile",
      "started_at": "2025-09-12T21:52:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 426,
    "fields": {
      "app_process": 69,
      "endpoint_id": 2,
      "parent_pid": 34591,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 63087,
      "command_source": "network_path",
      "started_at": "2025-09-11T17:39:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 427,
    "fields": {
      "app_process": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 35789,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T16:38:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 428,
    "fields": {
      "app_process": 202,
      "endpoint_id": 23,
      "parent_pid": 43291,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 50742,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T11:44:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 429,
    "fields": {
      "app_process": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 28227,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T13:40:20Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 430,
    "fields": {
      "app_process": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60323,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T21:12:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 431,
    "fields": {
      "app_process": 531,
      "endpoint_id": 26,
      "parent_pid": 56848,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 55347,
      "command_source": "user_profile",
      "started_at": "2025-09-08T17:37:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 432,
    "fields": {
      "app_process": 533,
      "endpoint_id": 1,
      "parent_pid": 44023,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42562,
      "command_source": "user_profile",
      "started_at": "2025-09-10T16:43:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 433,
    "fields": {
      "app_process": 158,
      "endpoint_id": 23,
      "parent_pid": 11402,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50804,
      "command_source": "local_disk",
      "started_at": "2025-09-10T17:24:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 434,
    "fields": {
      "app_process": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 36419,
      "command_source": "user_profile",
      "started_at": "2025-09-11T20:08:56Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 435,
    "fields": {
      "app_process": 450,
      "endpoint_id": 3,
      "parent_pid": 52592,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 59120,
      "command_source": "local_disk",
      "started_at": "2025-09-11T22:30:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 436,
    "fields": {
      "app_process": 292,
      "endpoint_id": 30,
      "parent_pid": 43343,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42834,
      "command_source": "local_disk",
      "started_at": "2025-09-12T01:46:54Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 437,
    "fields": {
      "app_process": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 50986,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T13:04:50Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 438,
    "fields": {
      "app_process": 396,
      "endpoint_id": 19,
      "parent_pid": 22514,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62045,
      "command_source": "local_disk",
      "started_at": "2025-09-09T22:08:26Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 439,
    "fields": {
      "app_process": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40738,
      "command_source": "local_disk",
      "started_at": "2025-09-11T15:19:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 440,
    "fields": {
      "app_process": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42535,
      "command_source": "local_disk",
      "started_at": "2025-09-09T16:41:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 441,
    "fields": {
      "app_process": 507,
      "endpoint_id": 11,
      "parent_pid": 24155,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33961,
      "command_source": "local_disk",
      "started_at": "2025-09-12T18:24:34Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 442,
    "fields": {
      "app_process": 433,
      "endpoint_id": 8,
      "parent_pid": 49560,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6330,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:18:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 443,
    "fields": {
      "app_process": 113,
      "endpoint_id": 14,
      "parent_pid": 32416,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60327,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:36:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 444,
    "fields": {
      "app_process": 550,
      "endpoint_id": 7,
      "parent_pid": 33263,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17342,
      "command_source": "network_path",
      "started_at": "2025-09-12T17:16:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 445,
    "fields": {
      "app_process": 253,
      "endpoint_id": 2,
      "parent_pid": 55668,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 11470,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:42:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 446,
    "fields": {
      "app_process": 49,
      "endpoint_id": 5,
      "parent_pid": 44112,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14939,
      "command_source": "local_disk",
      "started_at": "2025-09-10T12:49:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 447,
    "fields": {
      "app_process": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 24948,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T16:35:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 448,
    "fields": {
      "app_process": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 27297,
      "command_source": "local_disk",
      "started_at": "2025-09-09T21:14:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 449,
    "fields": {
      "app_process": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 14400,
      "command_source": "user_profile",
      "started_at": "2025-09-09T21:15:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 450,
    "fields": {
      "app_process": 419,
      "endpoint_id": 14,
      "parent_pid": 6165,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 59971,
      "command_source": "local_disk",
      "started_at": "2025-09-11T13:49:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 451,
    "fields": {
      "app_process": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2999,
      "command_source": "user_profile",
      "started_at": "2025-09-11T10:31:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 452,
    "fields": {
      "app_process": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25118,
      "command_source": "user_profile",
      "started_at": "2025-09-11T12:42:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 453,
    "fields": {
      "app_process": 137,
      "endpoint_id": 25,
      "parent_pid": 14030,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62691,
      "command_source": "local_disk",
      "started_at": "2025-09-10T23:53:06Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 454,
    "fields": {
      "app_process": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 12381,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T12:48:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 455,
    "fields": {
      "app_process": 481,
      "endpoint_id": 26,
      "parent_pid": 56274,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 39143,
      "command_source": "local_disk",
      "started_at": "2025-09-08T16:59:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 456,
    "fields": {
      "app_process": 3,
      "endpoint_id": 8,
      "parent_pid": 43396,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36925,
      "command_source": "local_disk",
      "started_at": "2025-09-12T11:25:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 457,
    "fields": {
      "app_process": 414,
      "endpoint_id": 12,
      "parent_pid": 61129,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7849,
      "command_source": "local_disk",
      "started_at": "2025-09-09T18:45:26Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 458,
    "fields": {
      "app_process": 14,
      "endpoint_id": 2,
      "parent_pid": 45424,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19962,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:03:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 459,
    "fields": {
      "app_process": 212,
      "endpoint_id": 4,
      "parent_pid": 61892,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 24152,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:43:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 460,
    "fields": {
      "app_process": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 54275,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:30:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 461,
    "fields": {
      "app_process": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 19698,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T23:15:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 462,
    "fields": {
      "app_process": 567,
      "endpoint_id": 30,
      "parent_pid": 25903,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 7572,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:54:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 463,
    "fields": {
      "app_process": 287,
      "endpoint_id": 17,
      "parent_pid": 31309,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2604,
      "command_source": "local_disk",
      "started_at": "2025-09-09T19:01:58Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 464,
    "fields": {
      "app_process": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7884,
      "command_source": "local_disk",
      "started_at": "2025-09-12T11:11:18Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 465,
    "fields": {
      "app_process": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 11073,
      "command_source": "local_disk",
      "started_at": "2025-09-11T21:32:31Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 466,
    "fields": {
      "app_process": 260,
      "endpoint_id": 2,
      "parent_pid": 12286,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14040,
      "command_source": "local_disk",
      "started_at": "2025-09-08T13:51:37Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 467,
    "fields": {
      "app_process": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60186,
      "command_source": "user_profile",
      "started_at": "2025-09-08T12:16:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 468,
    "fields": {
      "app_process": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 27212,
      "command_source": "local_disk",
      "started_at": "2025-09-11T20:44:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 469,
    "fields": {
      "app_process": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 62295,
      "command_source": "network_path",
      "started_at": "2025-09-08T13:03:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 470,
    "fields": {
      "app_process": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 48336,
      "command_source": "local_disk",
      "started_at": "2025-09-12T15:37:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 471,
    "fields": {
      "app_process": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1177,
      "command_source": "user_profile",
      "started_at": "2025-09-09T12:35:05Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 472,
    "fields": {
      "app_process": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 4171,
      "command_source": "local_disk",
      "started_at": "2025-09-12T23:15:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 473,
    "fields": {
      "app_process": 328,
      "endpoint_id": 8,
      "parent_pid": 60534,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57301,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T19:02:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 474,
    "fields": {
      "app_process": 379,
      "endpoint_id": 10,
      "parent_pid": 6542,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52577,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T14:08:36Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 475,
    "fields": {
      "app_process": 239,
      "endpoint_id": 23,
      "parent_pid": 3544,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5674,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:32:27Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 476,
    "fields": {
      "app_process": 508,
      "endpoint_id": 17,
      "parent_pid": 56082,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30113,
      "command_source": "local_disk",
      "started_at": "2025-09-11T11:39:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 477,
    "fields": {
      "app_process": 176,
      "endpoint_id": 12,
      "parent_pid": 33369,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59287,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:27:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 478,
    "fields": {
      "app_process": 232,
      "endpoint_id": 2,
      "parent_pid": 32167,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10769,
      "command_source": "local_disk",
      "started_at": "2025-09-08T12:36:56Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 479,
    "fields": {
      "app_process": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 45316,
      "command_source": "local_disk",
      "started_at": "2025-09-13T00:17:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 480,
    "fields": {
      "app_process": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53545,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:43:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 481,
    "fields": {
      "app_process": 474,
      "endpoint_id": 14,
      "parent_pid": 46432,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7765,
      "command_source": "local_disk",
      "started_at": "2025-09-11T14:19:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 482,
    "fields": {
      "app_process": 475,
      "endpoint_id": 19,
      "parent_pid": 6333,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26737,
      "command_source": "local_disk",
      "started_at": "2025-09-10T14:55:16Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 483,
    "fields": {
      "app_process": 268,
      "endpoint_id": 9,
      "parent_pid": 1833,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2361,
      "command_source": "network_path",
      "started_at": "2025-09-10T20:33:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 484,
    "fields": {
      "app_process": 332,
      "endpoint_id": 8,
      "parent_pid": 14407,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 63497,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T12:35:35Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 485,
    "fields": {
      "app_process": 266,
      "endpoint_id": 29,
      "parent_pid": 56419,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19328,
      "command_source": "local_disk",
      "started_at": "2025-09-11T14:57:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 486,
    "fields": {
      "app_process": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14135,
      "command_source": "local_disk",
      "started_at": "2025-09-10T13:59:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 487,
    "fields": {
      "app_process": 359,
      "endpoint_id": 17,
      "parent_pid": 34261,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 53930,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T20:52:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 488,
    "fields": {
      "app_process": 136,
      "endpoint_id": 30,
      "parent_pid": 45127,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57792,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:05:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 489,
    "fields": {
      "app_process": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 1537,
      "command_source": "user_profile",
      "started_at": "2025-09-10T20:11:10Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 490,
    "fields": {
      "app_process": 265,
      "endpoint_id": 14,
      "parent_pid": 932,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15438,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T11:39:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 491,
    "fields": {
      "app_process": 176,
      "endpoint_id": 12,
      "parent_pid": 33369,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30177,
      "command_source": "temp_folder",
      "started_at": "2025-09-12T21:28:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 492,
    "fields": {
      "app_process": 543,
      "endpoint_id": 5,
      "parent_pid": 14472,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 29057,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:59:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 493,
    "fields": {
      "app_process": 54,
      "endpoint_id": 5,
      "parent_pid": 14883,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19121,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:03:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 494,
    "fields": {
      "app_process": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13427,
      "command_source": "local_disk",
      "started_at": "2025-09-11T10:31:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 495,
    "fields": {
      "app_process": 178,
      "endpoint_id": 4,
      "parent_pid": 53009,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 26313,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:09:28Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 496,
    "fields": {
      "app_process": 570,
      "endpoint_id": 3,
      "parent_pid": 37692,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 5968,
      "command_source": "temp_folder",
      "started_at": "2025-09-11T22:49:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 497,
    "fields": {
      "app_process": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46203,
      "command_source": "user_profile",
      "started_at": "2025-09-12T00:56:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 498,
    "fields": {
      "app_process": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60752,
      "command_source": "local_disk",
      "started_at": "2025-09-12T21:38:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 499,
    "fields": {
      "app_process": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 58932,
      "command_source": "local_disk",
      "started_at": "2025-09-09T21:17:21Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 500,
    "fields": {
      "app_process": 15,
      "endpoint_id": 12,
      "parent_pid": 32021,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 44121,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:38:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 501,
    "fields": {
      "app_process": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22254,
      "command_source": "local_disk",
      "started_at": "2025-09-11T15:20:19Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 502,
    "fields": {
      "app_process": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48233,
      "command_source": "user_profile",
      "started_at": "2025-09-12T21:12:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 503,
    "fields": {
      "app_process": 210,
      "endpoint_id": 2,
      "parent_pid": 28766,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 4285,
      "command_source": "local_disk",
      "started_at": "2025-09-11T18:30:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 504,
    "fields": {
      "app_process": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55758,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:21:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 505,
    "fields": {
      "app_process": 136,
      "endpoint_id": 30,
      "parent_pid": 45127,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4410,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:07:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 506,
    "fields": {
      "app_process": 564,
      "endpoint_id": 24,
      "parent_pid": 20441,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20515,
      "command_source": "local_disk",
      "started_at": "2025-09-09T15:39:42Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 507,
    "fields": {
      "app_process": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6478,
      "command_source": "network_path",
      "started_at": "2025-09-09T17:55:47Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 508,
    "fields": {
      "app_process": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 38648,
      "command_source": "local_disk",
      "started_at": "2025-09-11T16:40:15Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 509,
    "fields": {
      "app_process": 120,
      "endpoint_id": 15,
      "parent_pid": 29798,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41150,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:16:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 510,
    "fields": {
      "app_process": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5944,
      "command_source": "local_disk",
      "started_at": "2025-09-10T10:42:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 511,
    "fields": {
      "app_process": 104,
      "endpoint_id": 3,
      "parent_pid": 53814,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57857,
      "command_source": "user_profile",
      "started_at": "2025-09-11T17:41:41Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 512,
    "fields": {
      "app_process": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 5172,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:42:07Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 513,
    "fields": {
      "app_process": 10,
      "endpoint_id": 12,
      "parent_pid": 39319,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54310,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:09:14Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 514,
    "fields": {
      "app_process": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17491,
      "command_source": "user_profile",
      "started_at": "2025-09-10T14:05:25Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 515,
    "fields": {
      "app_process": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 16824,
      "command_source": "local_disk",
      "started_at": "2025-09-10T16:15:44Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 516,
    "fields": {
      "app_process": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62947,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:22:29Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 517,
    "fields": {
      "app_process": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41123,
      "command_source": "local_disk",
      "started_at": "2025-09-11T09:00:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 518,
    "fields": {
      "app_process": 288,
      "endpoint_id": 30,
      "parent_pid": 43147,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12040,
      "command_source": "local_disk",
      "started_at": "2025-09-12T01:07:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 519,
    "fields": {
      "app_process": 137,
      "endpoint_id": 25,
      "parent_pid": 14030,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48662,
      "command_source": "local_disk",
      "started_at": "2025-09-10T23:53:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 520,
    "fields": {
      "app_process": 417,
      "endpoint_id": 29,
      "parent_pid": 7857,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61765,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:38:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 521,
    "fields": {
      "app_process": 7,
      "endpoint_id": 16,
      "parent_pid": 41495,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 50159,
      "command_source": "local_disk",
      "started_at": "2025-09-12T15:31:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 522,
    "fields": {
      "app_process": 293,
      "endpoint_id": 1,
      "parent_pid": 46403,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59866,
      "command_source": "temp_folder",
      "started_at": "2025-09-13T01:04:49Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 523,
    "fields": {
      "app_process": 68,
      "endpoint_id": 30,
      "parent_pid": 28650,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53691,
      "command_source": "user_profile",
      "started_at": "2025-09-10T17:47:00Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 524,
    "fields": {
      "app_process": 430,
      "endpoint_id": 29,
      "parent_pid": 14673,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43398,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:51:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 525,
    "fields": {
      "app_process": 312,
      "endpoint_id": 11,
      "parent_pid": 58917,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47650,
      "command_source": "network_path",
      "started_at": "2025-09-12T12:15:22Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 526,
    "fields": {
      "app_process": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36964,
      "command_source": "user_profile",
      "started_at": "2025-09-10T14:05:33Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 527,
    "fields": {
      "app_process": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18729,
      "command_source": "temp_folder",
      "started_at": "2025-09-10T19:30:32Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 528,
    "fields": {
      "app_process": 33,
      "endpoint_id": 26,
      "parent_pid": 6437,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56161,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T15:42:09Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 529,
    "fields": {
      "app_process": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17609,
      "command_source": "user_profile",
      "started_at": "2025-09-08T15:44:12Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 530,
    "fields": {
      "app_process": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40131,
      "command_source": "user_profile",
      "started_at": "2025-09-08T21:19:02Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 531,
    "fields": {
      "app_process": 362,
      "endpoint_id": 12,
      "parent_pid": 53635,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 19543,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T19:28:40Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 532,
    "fields": {
      "app_process": 240,
      "endpoint_id": 12,
      "parent_pid": 32551,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25659,
      "command_source": "user_profile",
      "started_at": "2025-09-09T14:34:08Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 533,
    "fields": {
      "app_process": 477,
      "endpoint_id": 5,
      "parent_pid": 7825,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 59066,
      "command_source": "temp_folder",
      "started_at": "2025-09-09T17:38:57Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 534,
    "fields": {
      "app_process": 560,
      "endpoint_id": 12,
      "parent_pid": 18770,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32766,
      "command_source": "user_profile",
      "started_at": "2025-09-13T02:00:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 535,
    "fields": {
      "app_process": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26148,
      "command_source": "local_disk",
      "started_at": "2025-09-11T12:42:46Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 536,
    "fields": {
      "app_process": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2445,
      "command_source": "local_disk",
      "started_at": "2025-09-11T19:05:51Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 537,
    "fields": {
      "app_process": 403,
      "endpoint_id": 10,
      "parent_pid": 37069,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57618,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T12:16:38Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 538,
    "fields": {
      "app_process": 229,
      "endpoint_id": 15,
      "parent_pid": 27407,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34097,
      "command_source": "local_disk",
      "started_at": "2025-09-08T18:09:45Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 539,
    "fields": {
      "app_process": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18995,
      "command_source": "local_disk",
      "started_at": "2025-09-08T17:32:43Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 540,
    "fields": {
      "app_process": 421,
      "endpoint_id": 30,
      "parent_pid": 27717,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 30739,
      "command_source": "local_disk",
      "started_at": "2025-09-12T03:11:52Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 541,
    "fields": {
      "app_process": 523,
      "endpoint_id": 9,
      "parent_pid": 41324,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 56709,
      "command_source": "local_disk",
      "started_at": "2025-09-10T23:17:30Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 542,
    "fields": {
      "app_process": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28812,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:44:48Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 543,
    "fields": {
      "app_process": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7487,
      "command_source": "local_disk",
      "started_at": "2025-09-09T13:19:53Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 544,
    "fields": {
      "app_process": 441,
      "endpoint_id": 17,
      "parent_pid": 56072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40497,
      "command_source": "temp_folder",
      "started_at": "2025-09-08T23:54:11Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 545,
    "fields": {
      "app_process": 571,
      "endpoint_id": 11,
      "parent_pid": 7435,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36946,
      "command_source": "local_disk",
      "started_at": "2025-09-13T01:12:13Z"
    }
  },
  {
    "model": "app.childprocess",
    "pk": 546,
    "fields": {
      "app_process": 352,
      "endpoint_id": 18,
      "parent_pid": 39809,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45022,
      "command_source": "local_disk",
      "started_at": "2025-09-10T19:59:12Z"
    }
  }
]