{
  "endpoints": [
    {
      "id": 1,
      "hostname": "EP-9773",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "4.14.0"
    },
    {
      "id": 2,
      "hostname": "EP-2488",
      "operating_system": "windows_10",
      "department": "Operations",
      "agent_version": "3.10.10"
    },
    {
      "id": 3,
      "hostname": "EP-4551",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "0.11.13"
    },
    {
      "id": 4,
      "hostname": "EP-8522",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "8.11.15"
    },
    {
      "id": 5,
      "hostname": "EP-8604",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "5.12.11"
    },
    {
      "id": 6,
      "hostname": "EP-9325",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "3.19.14"
    },
    {
      "id": 7,
      "hostname": "EP-3383",
      "operating_system": "windows_10",
      "department": "Finance",
      "agent_version": "2.3.10"
    },
    {
      "id": 8,
      "hostname": "EP-3132",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "7.16.16"
    },
    {
      "id": 9,
      "hostname": "EP-0115",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "9.14.16"
    },
    {
      "id": 10,
      "hostname": "EP-3198",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "0.1.15"
    },
    {
      "id": 11,
      "hostname": "EP-1551",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "7.18.4"
    },
    {
      "id": 12,
      "hostname": "EP-3197",
      "operating_system": "windows_server_2022",
      "department": "Operations",
      "agent_version": "2.8.12"
    },
    {
      "id": 13,
      "hostname": "EP-5750",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "7.20.5"
    },
    {
      "id": 14,
      "hostname": "EP-5055",
      "operating_system": "windows_server_2022",
      "department": "Sales",
      "agent_version": "1.16.9"
    },
    {
      "id": 15,
      "hostname": "EP-9122",
      "operating_system": "windows_11",
      "department": "Finance",
      "agent_version": "4.5.6"
    },
    {
      "id": 16,
      "hostname": "EP-4422",
      "operating_system": "windows_10",
      "department": "Finance",
      "agent_version": "2.11.3"
    },
    {
      "id": 17,
      "hostname": "EP-6451",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "8.10.19"
    },
    {
      "id": 18,
      "hostname": "EP-5661",
      "operating_system": "windows_10",
      "department": "Support",
      "agent_version": "3.0.5"
    },
    {
      "id": 19,
      "hostname": "EP-8904",
      "operating_system": "windows_10",
      "department": "Sales",
      "agent_version": "5.20.6"
    },
    {
      "id": 20,
      "hostname": "EP-9842",
      "operating_system": "windows_10",
      "department": "Engineering",
      "agent_version": "9.14.5"
    },
    {
      "id": 21,
      "hostname": "EP-5663",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "5.9.4"
    },
    {
      "id": 22,
      "hostname": "EP-6111",
      "operating_system": "windows_11",
      "department": "Support",
      "agent_version": "8.6.19"
    },
    {
      "id": 23,
      "hostname": "EP-8476",
      "operating_system": "windows_server_2022",
      "department": "Support",
      "agent_version": "1.2.8"
    },
    {
      "id": 24,
      "hostname": "EP-3816",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "6.7.18"
    },
    {
      "id": 25,
      "hostname": "EP-6756",
      "operating_system": "windows_10",
      "department": "Support",
      "agent_version": "1.18.20"
    },
    {
      "id": 26,
      "hostname": "EP-4063",
      "operating_system": "windows_server_2022",
      "department": "Finance",
      "agent_version": "5.16.13"
    },
    {
      "id": 27,
      "hostname": "EP-7962",
      "operating_system": "windows_11",
      "department": "Support",
      "agent_version": "0.11.14"
    },
    {
      "id": 28,
      "hostname": "EP-3578",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "2.20.7"
    },
    {
      "id": 29,
      "hostname": "EP-5311",
      "operating_system": "windows_11",
      "department": "Engineering",
      "agent_version": "1.2.18"
    },
    {
      "id": 30,
      "hostname": "EP-0194",
      "operating_system": "windows_11",
      "department": "Sales",
      "agent_version": "2.10.12"
    }
  ],
  "launch_chains": [
    {
      "id": 1,
      "catalogue": "chains-v1",
      "app_process": "msedge.exe",
      "child_process": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none"
    },
    {
      "id": 2,
      "catalogue": "chains-v1",
      "app_process": "chrome.exe",
      "child_process": "chrome.exe",
      "category": "browsing",
      "detection_label": "none"
    },
    {
      "id": 3,
      "catalogue": "chains-v1",
      "app_process": "winword.exe",
      "child_process": "splwow64.exe",
      "category": "office",
      "detection_label": "none"
    },
    {
      "id": 4,
      "catalogue": "chains-v1",
      "app_process": "excel.exe",
      "child_process": "excelcnv.exe",
      "category": "office",
      "detection_label": "none"
    },
    {
      "id": 5,
      "catalogue": "chains-v1",
      "app_process": "code.exe",
      "child_process": "node.exe",
      "category": "development",
      "detection_label": "none"
    },
    {
      "id": 6,
      "catalogue": "chains-v1",
      "app_process": "outlook.exe",
      "child_process": "olk.exe",
      "category": "email",
      "detection_label": "none"
    },
    {
      "id": 7,
      "catalogue": "chains-v1",
      "app_process": "teams.exe",
      "child_process": "teams.exe",
      "category": "collaboration",
      "detection_label": "none"
    },
    {
      "id": 8,
      "catalogue": "chains-v1",
      "app_process": "explorer.exe",
      "child_process": "notepad.exe",
      "category": "file_management",
      "detection_label": "none"
    },
    {
      "id": 9,
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "conhost.exe",
      "category": "shell",
      "detection_label": "none"
    },
    {
      "id": 10,
      "catalogue": "chains-v1",
      "app_process": "winword.exe",
      "child_process": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child"
    },
    {
      "id": 11,
      "catalogue": "chains-v1",
      "app_process": "outlook.exe",
      "child_process": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child"
    },
    {
      "id": 12,
      "catalogue": "chains-v1",
      "app_process": "excel.exe",
      "child_process": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load"
    },
    {
      "id": 13,
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command"
    },
    {
      "id": 14,
      "catalogue": "chains-v1",
      "app_process": "cmd.exe",
      "child_process": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility"
    },
    {
      "id": 15,
      "catalogue": "chains-v1",
      "app_process": "powershell.exe",
      "child_process": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task"
    }
  ],
  "sessions": [
    {
      "id": 1,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Leda.Bergnaum99",
      "root_pid": 1223,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:50:16"
    },
    {
      "id": 2,
      "endpoint_id": 16,
      "hostname": "EP-4422",
      "logon_user": "Floyd.Kerluke8",
      "root_pid": 9253,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 14:01:25"
    },
    {
      "id": 3,
      "endpoint_id": 8,
      "hostname": "EP-3132",
      "logon_user": "Madaline_Koepp",
      "root_pid": 3588,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 09:39:24"
    },
    {
      "id": 4,
      "endpoint_id": 10,
      "hostname": "EP-3198",
      "logon_user": "Raven.Rempel82",
      "root_pid": 9279,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 13:35:16"
    },
    {
      "id": 5,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Megane.Ryan58",
      "root_pid": 4092,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 13:52:52"
    },
    {
      "id": 6,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Bernhard.Legros",
      "root_pid": 2205,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 14:40:47"
    },
    {
      "id": 7,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Efren_Walsh",
      "root_pid": 777,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 12:04:44"
    },
    {
      "id": 8,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Roberto.Blanda",
      "root_pid": 8148,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 09:18:05"
    },
    {
      "id": 9,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Kelly_Wiegand",
      "root_pid": 5882,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 15:47:13"
    },
    {
      "id": 10,
      "endpoint_id": 18,
      "hostname": "EP-5661",
      "logon_user": "Bertram.Langworth-Satterfield8",
      "root_pid": 6676,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 17:22:19"
    },
    {
      "id": 11,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Sierra.Grant",
      "root_pid": 2105,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 15:23:02"
    },
    {
      "id": 12,
      "endpoint_id": 21,
      "hostname": "EP-5663",
      "logon_user": "Rusty_Considine",
      "root_pid": 4059,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 16:45:44"
    },
    {
      "id": 13,
      "endpoint_id": 22,
      "hostname": "EP-6111",
      "logon_user": "Rashad.Lueilwitz",
      "root_pid": 6372,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 12:33:57"
    },
    {
      "id": 14,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Lawson.Ledner4",
      "root_pid": 5631,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:34:02"
    },
    {
      "id": 15,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Randal.McLaughlin",
      "root_pid": 1207,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 13:13:27"
    },
    {
      "id": 16,
      "endpoint_id": 11,
      "hostname": "EP-1551",
      "logon_user": "Brionna.Fay",
      "root_pid": 5993,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 10:47:10"
    },
    {
      "id": 17,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Berry.Stehr70",
      "root_pid": 7447,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 17:20:33"
    },
    {
      "id": 18,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Wilhelm_Fisher",
      "root_pid": 5353,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 13:43:36"
    },
    {
      "id": 19,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Chelsea_Spinka-OReilly",
      "root_pid": 5838,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 19:42:29"
    },
    {
      "id": 20,
      "endpoint_id": 12,
      "hostname": "EP-3197",
      "logon_user": "Antonina_Kihn",
      "root_pid": 2248,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 18:53:08"
    },
    {
      "id": 21,
      "endpoint_id": 8,
      "hostname": "EP-3132",
      "logon_user": "Jayda.Gulgowski82",
      "root_pid": 1578,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 11:47:42"
    },
    {
      "id": 22,
      "endpoint_id": 16,
      "hostname": "EP-4422",
      "logon_user": "Kaley_Langosh40",
      "root_pid": 3475,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 15:16:16"
    },
    {
      "id": 23,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Jan.Watsica50",
      "root_pid": 3826,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 09:46:14"
    },
    {
      "id": 24,
      "endpoint_id": 11,
      "hostname": "EP-1551",
      "logon_user": "Christian.Ortiz97",
      "root_pid": 4927,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 17:05:37"
    },
    {
      "id": 25,
      "endpoint_id": 2,
      "hostname": "EP-2488",
      "logon_user": "Gillian_Hoppe31",
      "root_pid": 3737,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 10:47:51"
    },
    {
      "id": 26,
      "endpoint_id": 2,
      "hostname": "EP-2488",
      "logon_user": "Cloyd.Renner",
      "root_pid": 3041,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 14:53:11"
    },
    {
      "id": 27,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Alexander_Rippin95",
      "root_pid": 6515,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 12:19:48"
    },
    {
      "id": 28,
      "endpoint_id": 29,
      "hostname": "EP-5311",
      "logon_user": "Nikko_Cormier-Schmeler36",
      "root_pid": 1782,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:00:55"
    },
    {
      "id": 29,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Lyle_Bergstrom",
      "root_pid": 4443,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 15:51:06"
    },
    {
      "id": 30,
      "endpoint_id": 5,
      "hostname": "EP-8604",
      "logon_user": "Jaylin_Bradtke83",
      "root_pid": 5435,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 16:43:42"
    },
    {
      "id": 31,
      "endpoint_id": 17,
      "hostname": "EP-6451",
      "logon_user": "Van_Wyman14",
      "root_pid": 9042,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 10:37:53"
    },
    {
      "id": 32,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Felipa_Feil51",
      "root_pid": 7143,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 19:05:27"
    },
    {
      "id": 33,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Leonard.Funk",
      "root_pid": 3235,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 08:57:48"
    },
    {
      "id": 34,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Casimer.Beahan",
      "root_pid": 9204,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 16:00:03"
    },
    {
      "id": 35,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Jerrell.Dare87",
      "root_pid": 5419,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 11:26:23"
    },
    {
      "id": 36,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Randy.Kunze86",
      "root_pid": 4428,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 16:55:52"
    },
    {
      "id": 37,
      "endpoint_id": 2,
      "hostname": "EP-2488",
      "logon_user": "Taurean_Ortiz61",
      "root_pid": 2950,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 16:10:28"
    },
    {
      "id": 38,
      "endpoint_id": 21,
      "hostname": "EP-5663",
      "logon_user": "Mozell.Williamson",
      "root_pid": 8575,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 07:37:27"
    },
    {
      "id": 39,
      "endpoint_id": 12,
      "hostname": "EP-3197",
      "logon_user": "Leonardo.Kulas",
      "root_pid": 4269,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 10:44:09"
    },
    {
      "id": 40,
      "endpoint_id": 18,
      "hostname": "EP-5661",
      "logon_user": "Ayana_Okuneva",
      "root_pid": 9039,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 13:26:06"
    },
    {
      "id": 41,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Ambrose_Johnston",
      "root_pid": 5450,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 05:39:23"
    },
    {
      "id": 42,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Shelly.Crist",
      "root_pid": 5987,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 13:32:39"
    },
    {
      "id": 43,
      "endpoint_id": 5,
      "hostname": "EP-8604",
      "logon_user": "Felipe.Hayes87",
      "root_pid": 2202,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 16:38:58"
    },
    {
      "id": 44,
      "endpoint_id": 6,
      "hostname": "EP-9325",
      "logon_user": "Roma.Cole",
      "root_pid": 2524,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 07:49:08"
    },
    {
      "id": 45,
      "endpoint_id": 11,
      "hostname": "EP-1551",
      "logon_user": "Taylor.Prosacco",
      "root_pid": 8295,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 17:25:33"
    },
    {
      "id": 46,
      "endpoint_id": 15,
      "hostname": "EP-9122",
      "logon_user": "Lauryn.Moore65",
      "root_pid": 1692,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 18:19:26"
    },
    {
      "id": 47,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Jarrett.Wiegand",
      "root_pid": 8438,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 16:03:21"
    },
    {
      "id": 48,
      "endpoint_id": 10,
      "hostname": "EP-3198",
      "logon_user": "Aric.Altenwerth2",
      "root_pid": 1271,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 06:31:31"
    },
    {
      "id": 49,
      "endpoint_id": 13,
      "hostname": "EP-5750",
      "logon_user": "Cierra_Franecki48",
      "root_pid": 7754,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 15:46:14"
    },
    {
      "id": 50,
      "endpoint_id": 17,
      "hostname": "EP-6451",
      "logon_user": "Margarett.Russel",
      "root_pid": 2098,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 16:38:52"
    },
    {
      "id": 51,
      "endpoint_id": 24,
      "hostname": "EP-3816",
      "logon_user": "Joesph_Kreiger9",
      "root_pid": 3525,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 10:18:42"
    },
    {
      "id": 52,
      "endpoint_id": 28,
      "hostname": "EP-3578",
      "logon_user": "Lolita.Treutel73",
      "root_pid": 2323,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 17:20:07"
    },
    {
      "id": 53,
      "endpoint_id": 23,
      "hostname": "EP-8476",
      "logon_user": "Roosevelt.Collins47",
      "root_pid": 5187,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 14:51:06"
    },
    {
      "id": 54,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Brook.Yost",
      "root_pid": 2990,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 14:15:22"
    },
    {
      "id": 55,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Adolf_Lakin15",
      "root_pid": 4258,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 10:27:15"
    },
    {
      "id": 56,
      "endpoint_id": 30,
      "hostname": "EP-0194",
      "logon_user": "Uriel.Hansen",
      "root_pid": 2847,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 17:25:09"
    },
    {
      "id": 57,
      "endpoint_id": 27,
      "hostname": "EP-7962",
      "logon_user": "Jeannette.OKeefe70",
      "root_pid": 8454,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 15:47:54"
    },
    {
      "id": 58,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Fred_Howell32",
      "root_pid": 5507,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 17:52:23"
    },
    {
      "id": 59,
      "endpoint_id": 2,
      "hostname": "EP-2488",
      "logon_user": "Kameron.Kautzer",
      "root_pid": 3499,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 13:53:20"
    },
    {
      "id": 60,
      "endpoint_id": 25,
      "hostname": "EP-6756",
      "logon_user": "Nicolas_Hammes",
      "root_pid": 1935,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 23:22:02"
    },
    {
      "id": 61,
      "endpoint_id": 29,
      "hostname": "EP-5311",
      "logon_user": "Solon.Rohan47",
      "root_pid": 6985,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 08:45:10"
    },
    {
      "id": 62,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Myrna_Orn",
      "root_pid": 5166,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 13:42:42"
    },
    {
      "id": 63,
      "endpoint_id": 20,
      "hostname": "EP-9842",
      "logon_user": "Mitchell.Glover-Kuhic",
      "root_pid": 6555,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 16:25:05"
    },
    {
      "id": 64,
      "endpoint_id": 4,
      "hostname": "EP-8522",
      "logon_user": "Jacey_Nienow73",
      "root_pid": 2187,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 17:46:02"
    },
    {
      "id": 65,
      "endpoint_id": 28,
      "hostname": "EP-3578",
      "logon_user": "Malachi.Tremblay12",
      "root_pid": 2048,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 11:49:50"
    },
    {
      "id": 66,
      "endpoint_id": 25,
      "hostname": "EP-6756",
      "logon_user": "Cristopher.Ankunding",
      "root_pid": 2140,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 10:09:34"
    },
    {
      "id": 67,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Lionel_Bosco",
      "root_pid": 9805,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:54:10"
    },
    {
      "id": 68,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Andreane.Cartwright30",
      "root_pid": 3905,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 14:58:41"
    },
    {
      "id": 69,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Lelah.Okuneva",
      "root_pid": 807,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 09:36:41"
    },
    {
      "id": 70,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Vince.Johns",
      "root_pid": 9033,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 10:57:01"
    },
    {
      "id": 71,
      "endpoint_id": 2,
      "hostname": "EP-2488",
      "logon_user": "Jules_Hettinger56",
      "root_pid": 9165,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:21:00"
    },
    {
      "id": 72,
      "endpoint_id": 23,
      "hostname": "EP-8476",
      "logon_user": "Name_Walter57",
      "root_pid": 9273,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 10:53:20"
    },
    {
      "id": 73,
      "endpoint_id": 15,
      "hostname": "EP-9122",
      "logon_user": "Mae_Jones",
      "root_pid": 2342,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 15:02:44"
    },
    {
      "id": 74,
      "endpoint_id": 8,
      "hostname": "EP-3132",
      "logon_user": "Emerald.Stehr7",
      "root_pid": 8020,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 13:21:33"
    },
    {
      "id": 75,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Palma_Schuppe",
      "root_pid": 799,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 11:12:44"
    },
    {
      "id": 76,
      "endpoint_id": 17,
      "hostname": "EP-6451",
      "logon_user": "Ellis.Parker",
      "root_pid": 7760,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 11:04:29"
    },
    {
      "id": 77,
      "endpoint_id": 11,
      "hostname": "EP-1551",
      "logon_user": "Idell.Mitchell",
      "root_pid": 6081,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 10:34:42"
    },
    {
      "id": 78,
      "endpoint_id": 28,
      "hostname": "EP-3578",
      "logon_user": "Charlene_MacGyver",
      "root_pid": 4336,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 13:09:16"
    },
    {
      "id": 79,
      "endpoint_id": 24,
      "hostname": "EP-3816",
      "logon_user": "Chelsea.Rath9",
      "root_pid": 1688,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 14:01:46"
    },
    {
      "id": 80,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Johnpaul.Feil",
      "root_pid": 5566,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 13:56:21"
    },
    {
      "id": 81,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Lewis.Torp",
      "root_pid": 1248,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 16:50:43"
    },
    {
      "id": 82,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Kristian.Fadel",
      "root_pid": 3087,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 14:45:58"
    },
    {
      "id": 83,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Meda.Dibbert50",
      "root_pid": 8003,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 09:20:21"
    },
    {
      "id": 84,
      "endpoint_id": 29,
      "hostname": "EP-5311",
      "logon_user": "Summer_Bartell64",
      "root_pid": 6330,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 10:38:51"
    },
    {
      "id": 85,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Filiberto_Abbott",
      "root_pid": 7128,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 15:15:37"
    },
    {
      "id": 86,
      "endpoint_id": 24,
      "hostname": "EP-3816",
      "logon_user": "Darryl.Kuhlman",
      "root_pid": 4959,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 10:03:06"
    },
    {
      "id": 87,
      "endpoint_id": 8,
      "hostname": "EP-3132",
      "logon_user": "Lelah_Raynor10",
      "root_pid": 9087,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 14:51:53"
    },
    {
      "id": 88,
      "endpoint_id": 27,
      "hostname": "EP-7962",
      "logon_user": "Isabelle_Kub",
      "root_pid": 4101,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 09:28:50"
    },
    {
      "id": 89,
      "endpoint_id": 18,
      "hostname": "EP-5661",
      "logon_user": "Sonia.Stamm60",
      "root_pid": 7044,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 14:54:34"
    },
    {
      "id": 90,
      "endpoint_id": 14,
      "hostname": "EP-5055",
      "logon_user": "Anjali.Moore67",
      "root_pid": 5514,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 08:40:22"
    },
    {
      "id": 91,
      "endpoint_id": 19,
      "hostname": "EP-8904",
      "logon_user": "Stanton.Grady49",
      "root_pid": 7689,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 09:45:51"
    },
    {
      "id": 92,
      "endpoint_id": 29,
      "hostname": "EP-5311",
      "logon_user": "Mark.Hegmann84",
      "root_pid": 7465,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 17:05:06"
    },
    {
      "id": 93,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Christina_Kunze55",
      "root_pid": 9342,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 13:37:29"
    },
    {
      "id": 94,
      "endpoint_id": 4,
      "hostname": "EP-8522",
      "logon_user": "Guillermo.Brakus",
      "root_pid": 8955,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 07:05:56"
    },
    {
      "id": 95,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Pete.Bednar",
      "root_pid": 9803,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 20:13:45"
    },
    {
      "id": 96,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Marielle.Leuschke",
      "root_pid": 9109,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 07:52:01"
    },
    {
      "id": 97,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Shea_Deckow35",
      "root_pid": 3764,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 15:43:48"
    },
    {
      "id": 98,
      "endpoint_id": 17,
      "hostname": "EP-6451",
      "logon_user": "Katrina.Dach21",
      "root_pid": 8504,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 16:11:44"
    },
    {
      "id": 99,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Zackary.Dickinson53",
      "root_pid": 8717,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 21:39:40"
    },
    {
      "id": 100,
      "endpoint_id": 13,
      "hostname": "EP-5750",
      "logon_user": "Denis_Kunde98",
      "root_pid": 4103,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 15:13:20"
    },
    {
      "id": 101,
      "endpoint_id": 25,
      "hostname": "EP-6756",
      "logon_user": "Garry_Nicolas",
      "root_pid": 7446,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 12:55:46"
    },
    {
      "id": 102,
      "endpoint_id": 6,
      "hostname": "EP-9325",
      "logon_user": "Jo.Wilderman68",
      "root_pid": 2779,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:45:52"
    },
    {
      "id": 103,
      "endpoint_id": 13,
      "hostname": "EP-5750",
      "logon_user": "Newell_Rippin71",
      "root_pid": 3347,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 15:29:21"
    },
    {
      "id": 104,
      "endpoint_id": 21,
      "hostname": "EP-5663",
      "logon_user": "Florence.Hackett5",
      "root_pid": 7548,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 10:32:09"
    },
    {
      "id": 105,
      "endpoint_id": 18,
      "hostname": "EP-5661",
      "logon_user": "Gavin.Windler",
      "root_pid": 9411,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 10:34:49"
    },
    {
      "id": 106,
      "endpoint_id": 12,
      "hostname": "EP-3197",
      "logon_user": "Junior.Haley31",
      "root_pid": 8968,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 13:43:23"
    },
    {
      "id": 107,
      "endpoint_id": 11,
      "hostname": "EP-1551",
      "logon_user": "Nellie_Senger",
      "root_pid": 7525,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 11:50:39"
    },
    {
      "id": 108,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Fern.Boehm92",
      "root_pid": 9857,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 18:52:32"
    },
    {
      "id": 109,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Vicki.Glover23",
      "root_pid": 9809,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 13:09:52"
    },
    {
      "id": 110,
      "endpoint_id": 5,
      "hostname": "EP-8604",
      "logon_user": "Brenna.Huels79",
      "root_pid": 4857,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 11:41:38"
    },
    {
      "id": 111,
      "endpoint_id": 25,
      "hostname": "EP-6756",
      "logon_user": "Estell_Conroy",
      "root_pid": 4893,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 10:16:51"
    },
    {
      "id": 112,
      "endpoint_id": 3,
      "hostname": "EP-4551",
      "logon_user": "Hubert_Bergnaum",
      "root_pid": 8684,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 15:28:27"
    },
    {
      "id": 113,
      "endpoint_id": 22,
      "hostname": "EP-6111",
      "logon_user": "Kris.Roob60",
      "root_pid": 4002,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 11:05:51"
    },
    {
      "id": 114,
      "endpoint_id": 26,
      "hostname": "EP-4063",
      "logon_user": "Kathy_Beahan54",
      "root_pid": 1599,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 15:46:23"
    },
    {
      "id": 115,
      "endpoint_id": 28,
      "hostname": "EP-3578",
      "logon_user": "Antonia_Stamm13",
      "root_pid": 6071,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 13:24:36"
    },
    {
      "id": 116,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Herminio.Cummings26",
      "root_pid": 1596,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 10:34:41"
    },
    {
      "id": 117,
      "endpoint_id": 25,
      "hostname": "EP-6756",
      "logon_user": "Roberta_Wintheiser8",
      "root_pid": 6672,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 18:57:04"
    },
    {
      "id": 118,
      "endpoint_id": 18,
      "hostname": "EP-5661",
      "logon_user": "Fletcher_Zulauf",
      "root_pid": 4211,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 15:40:57"
    },
    {
      "id": 119,
      "endpoint_id": 21,
      "hostname": "EP-5663",
      "logon_user": "Kacie_Quitzon",
      "root_pid": 6808,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 19:29:09"
    },
    {
      "id": 120,
      "endpoint_id": 9,
      "hostname": "EP-0115",
      "logon_user": "Billy_Cartwright88",
      "root_pid": 5090,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 15:39:46"
    },
    {
      "id": 121,
      "endpoint_id": 5,
      "hostname": "EP-8604",
      "logon_user": "Heath_Adams",
      "root_pid": 6355,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 13:09:08"
    },
    {
      "id": 122,
      "endpoint_id": 17,
      "hostname": "EP-6451",
      "logon_user": "Tami.Ritchie79",
      "root_pid": 6690,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 12:51:30"
    },
    {
      "id": 123,
      "endpoint_id": 4,
      "hostname": "EP-8522",
      "logon_user": "Osborne.Schuster",
      "root_pid": 9605,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-10 14:09:48"
    },
    {
      "id": 124,
      "endpoint_id": 7,
      "hostname": "EP-3383",
      "logon_user": "Margarete_Von49",
      "root_pid": 3310,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 08:55:54"
    },
    {
      "id": 125,
      "endpoint_id": 10,
      "hostname": "EP-3198",
      "logon_user": "Sim_Schimmel62",
      "root_pid": 6716,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 12:54:49"
    },
    {
      "id": 126,
      "endpoint_id": 12,
      "hostname": "EP-3197",
      "logon_user": "Lacy_Stehr16",
      "root_pid": 9993,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 14:00:45"
    },
    {
      "id": 127,
      "endpoint_id": 22,
      "hostname": "EP-6111",
      "logon_user": "Sonia_Cormier7",
      "root_pid": 1504,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 09:36:38"
    },
    {
      "id": 128,
      "endpoint_id": 10,
      "hostname": "EP-3198",
      "logon_user": "Gardner_Hagenes85",
      "root_pid": 3770,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-09 11:34:32"
    },
    {
      "id": 129,
      "endpoint_id": 1,
      "hostname": "EP-9773",
      "logon_user": "Corbin_Kassulke",
      "root_pid": 5131,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-08 18:51:47"
    },
    {
      "id": 130,
      "endpoint_id": 8,
      "hostname": "EP-3132",
      "logon_user": "Rashad.Shields",
      "root_pid": 6080,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-12 10:07:23"
    },
    {
      "id": 131,
      "endpoint_id": 3,
      "hostname": "EP-4551",
      "logon_user": "Gunner_Mayer16",
      "root_pid": 807,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 15:46:39"
    },
    {
      "id": 132,
      "endpoint_id": 5,
      "hostname": "EP-8604",
      "logon_user": "Lorna.Cummerata71",
      "root_pid": 9527,
      "root_process": "explorer.exe",
      "logon_at": "2025-09-11 11:55:58"
    }
  ],
  "app_processes": [
    {
      "id": 1,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 59762,
      "integrity_level": "medium",
      "started_at": "2025-09-10 11:50:44"
    },
    {
      "id": 2,
      "session_id": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 36180,
      "integrity_level": "medium",
      "started_at": "2025-09-11 08:15:16"
    },
    {
      "id": 3,
      "session_id": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43396,
      "integrity_level": "medium",
      "started_at": "2025-09-12 11:22:06"
    },
    {
      "id": 4,
      "session_id": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13733,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:41:50"
    },
    {
      "id": 5,
      "session_id": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 4607,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:51:29"
    },
    {
      "id": 6,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26184,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:14:40"
    },
    {
      "id": 7,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 41495,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:30:38"
    },
    {
      "id": 8,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27161,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:47:02"
    },
    {
      "id": 9,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51181,
      "integrity_level": "medium",
      "started_at": "2025-09-12 11:03:31"
    },
    {
      "id": 10,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 39319,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:07:14"
    },
    {
      "id": 11,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25035,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:12:19"
    },
    {
      "id": 12,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 52296,
      "integrity_level": "medium",
      "started_at": "2025-09-11 14:10:33"
    },
    {
      "id": 13,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 63035,
      "integrity_level": "low",
      "started_at": "2025-09-08 16:27:00"
    },
    {
      "id": 14,
      "session_id": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45424,
      "integrity_level": "high",
      "started_at": "2025-09-08 12:01:56"
    },
    {
      "id": 15,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 32021,
      "integrity_level": "low",
      "started_at": "2025-09-08 17:36:36"
    },
    {
      "id": 16,
      "session_id": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 16776,
      "integrity_level": "low",
      "started_at": "2025-09-12 12:29:32"
    },
    {
      "id": 17,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45058,
      "integrity_level": "low",
      "started_at": "2025-09-08 06:55:37"
    },
    {
      "id": 18,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 39435,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:09:17"
    },
    {
      "id": 19,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 44084,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:45:33"
    },
    {
      "id": 20,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31578,
      "integrity_level": "medium",
      "started_at": "2025-09-11 08:58:20"
    },
    {
      "id": 21,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33716,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:59:47"
    },
    {
      "id": 22,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 5433,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:07:23"
    },
    {
      "id": 23,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21327,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:16:03"
    },
    {
      "id": 24,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45339,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:11:23"
    },
    {
      "id": 25,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 8704,
      "integrity_level": "medium",
      "started_at": "2025-09-09 18:50:04"
    },
    {
      "id": 26,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28134,
      "integrity_level": "medium",
      "started_at": "2025-09-12 17:43:34"
    },
    {
      "id": 27,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 31659,
      "integrity_level": "low",
      "started_at": "2025-09-12 19:53:08"
    },
    {
      "id": 28,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 55377,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:10:11"
    },
    {
      "id": 29,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 10195,
      "integrity_level": "low",
      "started_at": "2025-09-10 13:25:51"
    },
    {
      "id": 30,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 52146,
      "integrity_level": "medium",
      "started_at": "2025-09-11 11:45:07"
    },
    {
      "id": 31,
      "session_id": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14661,
      "integrity_level": "low",
      "started_at": "2025-09-09 13:00:56"
    },
    {
      "id": 32,
      "session_id": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6449,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:37:11"
    },
    {
      "id": 33,
      "session_id": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6437,
      "integrity_level": "high",
      "started_at": "2025-09-08 15:40:46"
    },
    {
      "id": 34,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 23104,
      "integrity_level": "low",
      "started_at": "2025-09-08 20:12:09"
    },
    {
      "id": 35,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 59744,
      "integrity_level": "low",
      "started_at": "2025-09-11 11:57:44"
    },
    {
      "id": 36,
      "session_id": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 26578,
      "integrity_level": "medium",
      "started_at": "2025-09-08 10:18:56"
    },
    {
      "id": 37,
      "session_id": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64176,
      "integrity_level": "medium",
      "started_at": "2025-09-09 12:31:50"
    },
    {
      "id": 38,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52701,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:48:18"
    },
    {
      "id": 39,
      "session_id": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 41614,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:57:49"
    },
    {
      "id": 40,
      "session_id": 126,
      "endpoint_id": 12,
      "parent_pid": 9993,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 24267,
      "integrity_level": "medium",
      "started_at": "2025-09-12 14:13:07"
    },
    {
      "id": 41,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37138,
      "integrity_level": "low",
      "started_at": "2025-09-09 17:53:40"
    },
    {
      "id": 42,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43487,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:24:41"
    },
    {
      "id": 43,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 57823,
      "integrity_level": "high",
      "started_at": "2025-09-11 16:36:24"
    },
    {
      "id": 44,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34278,
      "integrity_level": "medium",
      "started_at": "2025-09-08 14:09:18"
    },
    {
      "id": 45,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 10542,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:28:45"
    },
    {
      "id": 46,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61930,
      "integrity_level": "low",
      "started_at": "2025-09-12 21:05:51"
    },
    {
      "id": 47,
      "session_id": 52,
      "endpoint_id": 28,
      "parent_pid": 2323,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26066,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:34:30"
    },
    {
      "id": 48,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6832,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:53:38"
    },
    {
      "id": 49,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44112,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:49:13"
    },
    {
      "id": 50,
      "session_id": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4770,
      "integrity_level": "low",
      "started_at": "2025-09-11 18:03:53"
    },
    {
      "id": 51,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 9327,
      "integrity_level": "medium",
      "started_at": "2025-09-09 19:48:19"
    },
    {
      "id": 52,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 34765,
      "integrity_level": "low",
      "started_at": "2025-09-11 20:58:47"
    },
    {
      "id": 53,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62824,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:16:05"
    },
    {
      "id": 54,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14883,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:02:15"
    },
    {
      "id": 55,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 31902,
      "integrity_level": "low",
      "started_at": "2025-09-11 18:27:56"
    },
    {
      "id": 56,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 61151,
      "integrity_level": "high",
      "started_at": "2025-09-08 07:59:52"
    },
    {
      "id": 57,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 7006,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:44:43"
    },
    {
      "id": 58,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47835,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:18:39"
    },
    {
      "id": 59,
      "session_id": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 53339,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:30:17"
    },
    {
      "id": 60,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 20713,
      "integrity_level": "medium",
      "started_at": "2025-09-08 21:13:04"
    },
    {
      "id": 61,
      "session_id": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 62437,
      "integrity_level": "medium",
      "started_at": "2025-09-12 16:39:59"
    },
    {
      "id": 62,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 13633,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:25:08"
    },
    {
      "id": 63,
      "session_id": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24941,
      "integrity_level": "medium",
      "started_at": "2025-09-10 21:01:49"
    },
    {
      "id": 64,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 27918,
      "integrity_level": "low",
      "started_at": "2025-09-09 13:37:18"
    },
    {
      "id": 65,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32057,
      "integrity_level": "medium",
      "started_at": "2025-09-11 22:23:53"
    },
    {
      "id": 66,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47490,
      "integrity_level": "low",
      "started_at": "2025-09-11 23:31:19"
    },
    {
      "id": 67,
      "session_id": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44935,
      "integrity_level": "medium",
      "started_at": "2025-09-09 16:45:02"
    },
    {
      "id": 68,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28650,
      "integrity_level": "high",
      "started_at": "2025-09-10 17:45:16"
    },
    {
      "id": 69,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 34591,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:37:53"
    },
    {
      "id": 70,
      "session_id": 32,
      "endpoint_id": 20,
      "parent_pid": 7143,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7497,
      "integrity_level": "low",
      "started_at": "2025-09-12 20:22:19"
    },
    {
      "id": 71,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20163,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:23:31"
    },
    {
      "id": 72,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15433,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:39:59"
    },
    {
      "id": 73,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47384,
      "integrity_level": "low",
      "started_at": "2025-09-08 16:19:38"
    },
    {
      "id": 74,
      "session_id": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 39720,
      "integrity_level": "medium",
      "started_at": "2025-09-12 10:42:43"
    },
    {
      "id": 75,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13860,
      "integrity_level": "low",
      "started_at": "2025-09-08 11:17:20"
    },
    {
      "id": 76,
      "session_id": 42,
      "endpoint_id": 20,
      "parent_pid": 5987,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 27802,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:38:58"
    },
    {
      "id": 77,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64195,
      "integrity_level": "low",
      "started_at": "2025-09-08 09:18:33"
    },
    {
      "id": 78,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 6027,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:59:38"
    },
    {
      "id": 79,
      "session_id": 124,
      "endpoint_id": 7,
      "parent_pid": 3310,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32308,
      "integrity_level": "medium",
      "started_at": "2025-09-09 09:46:25"
    },
    {
      "id": 80,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5293,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:07:40"
    },
    {
      "id": 81,
      "session_id": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 60792,
      "integrity_level": "medium",
      "started_at": "2025-09-09 10:47:41"
    },
    {
      "id": 82,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 46471,
      "integrity_level": "low",
      "started_at": "2025-09-10 11:40:58"
    },
    {
      "id": 83,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 25522,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:34:40"
    },
    {
      "id": 84,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27434,
      "integrity_level": "medium",
      "started_at": "2025-09-12 17:46:02"
    },
    {
      "id": 85,
      "session_id": 12,
      "endpoint_id": 21,
      "parent_pid": 4059,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 1264,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:08:42"
    },
    {
      "id": 86,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 13878,
      "integrity_level": "medium",
      "started_at": "2025-09-10 17:02:58"
    },
    {
      "id": 87,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 42358,
      "integrity_level": "high",
      "started_at": "2025-09-08 15:17:29"
    },
    {
      "id": 88,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 9701,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:45:42"
    },
    {
      "id": 89,
      "session_id": 6,
      "endpoint_id": 19,
      "parent_pid": 2205,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 7169,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:30:13"
    },
    {
      "id": 90,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62491,
      "integrity_level": "medium",
      "started_at": "2025-09-10 11:56:32"
    },
    {
      "id": 91,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24205,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:02:58"
    },
    {
      "id": 92,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49989,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:12:28"
    },
    {
      "id": 93,
      "session_id": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20325,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:04:01"
    },
    {
      "id": 94,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23005,
      "integrity_level": "medium",
      "started_at": "2025-09-12 00:51:27"
    },
    {
      "id": 95,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6543,
      "integrity_level": "low",
      "started_at": "2025-09-10 17:49:25"
    },
    {
      "id": 96,
      "session_id": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 53626,
      "integrity_level": "medium",
      "started_at": "2025-09-08 11:18:52"
    },
    {
      "id": 97,
      "session_id": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 10964,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:33:44"
    },
    {
      "id": 98,
      "session_id": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41939,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:18:39"
    },
    {
      "id": 99,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20374,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:48:36"
    },
    {
      "id": 100,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 54664,
      "integrity_level": "high",
      "started_at": "2025-09-08 14:12:14"
    },
    {
      "id": 101,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20280,
      "integrity_level": "low",
      "started_at": "2025-09-10 14:52:47"
    },
    {
      "id": 102,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16232,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:21:56"
    },
    {
      "id": 103,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37100,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:35:16"
    },
    {
      "id": 104,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53814,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:38:29"
    },
    {
      "id": 105,
      "session_id": 92,
      "endpoint_id": 29,
      "parent_pid": 7465,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39442,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:08:27"
    },
    {
      "id": 106,
      "session_id": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11209,
      "integrity_level": "high",
      "started_at": "2025-09-12 17:12:45"
    },
    {
      "id": 107,
      "session_id": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22672,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:27:17"
    },
    {
      "id": 108,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25979,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:36:42"
    },
    {
      "id": 109,
      "session_id": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 47511,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:04:20"
    },
    {
      "id": 110,
      "session_id": 44,
      "endpoint_id": 6,
      "parent_pid": 2524,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5764,
      "integrity_level": "medium",
      "started_at": "2025-09-12 09:03:21"
    },
    {
      "id": 111,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24998,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:46:04"
    },
    {
      "id": 112,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 14943,
      "integrity_level": "medium",
      "started_at": "2025-09-10 11:57:14"
    },
    {
      "id": 113,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32416,
      "integrity_level": "high",
      "started_at": "2025-09-08 16:36:04"
    },
    {
      "id": 114,
      "session_id": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58166,
      "integrity_level": "high",
      "started_at": "2025-09-12 17:45:23"
    },
    {
      "id": 115,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63965,
      "integrity_level": "high",
      "started_at": "2025-09-10 13:17:25"
    },
    {
      "id": 116,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54176,
      "integrity_level": "high",
      "started_at": "2025-09-12 18:35:41"
    },
    {
      "id": 117,
      "session_id": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 23533,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:27:39"
    },
    {
      "id": 118,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 1891,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:25:49"
    },
    {
      "id": 119,
      "session_id": 32,
      "endpoint_id": 20,
      "parent_pid": 7143,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 46524,
      "integrity_level": "high",
      "started_at": "2025-09-12 21:37:44"
    },
    {
      "id": 120,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29798,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:15:22"
    },
    {
      "id": 121,
      "session_id": 35,
      "endpoint_id": 26,
      "parent_pid": 5419,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54076,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:15:56"
    },
    {
      "id": 122,
      "session_id": 117,
      "endpoint_id": 25,
      "parent_pid": 6672,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 13399,
      "integrity_level": "low",
      "started_at": "2025-09-12 20:16:58"
    },
    {
      "id": 123,
      "session_id": 11,
      "endpoint_id": 7,
      "parent_pid": 2105,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17270,
      "integrity_level": "medium",
      "started_at": "2025-09-12 16:04:42"
    },
    {
      "id": 124,
      "session_id": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 35872,
      "integrity_level": "high",
      "started_at": "2025-09-11 08:42:25"
    },
    {
      "id": 125,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 54123,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:19:15"
    },
    {
      "id": 126,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63920,
      "integrity_level": "medium",
      "started_at": "2025-09-08 21:33:50"
    },
    {
      "id": 127,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54190,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:22:38"
    },
    {
      "id": 128,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40436,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:19:59"
    },
    {
      "id": 129,
      "session_id": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8473,
      "integrity_level": "high",
      "started_at": "2025-09-09 13:02:27"
    },
    {
      "id": 130,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62677,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:57:13"
    },
    {
      "id": 131,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 21536,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:16:06"
    },
    {
      "id": 132,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 54687,
      "integrity_level": "medium",
      "started_at": "2025-09-08 09:34:02"
    },
    {
      "id": 133,
      "session_id": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58185,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:44:42"
    },
    {
      "id": 134,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16981,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:09:56"
    },
    {
      "id": 135,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 16644,
      "integrity_level": "low",
      "started_at": "2025-09-12 17:04:51"
    },
    {
      "id": 136,
      "session_id": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45127,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:04:48"
    },
    {
      "id": 137,
      "session_id": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14030,
      "integrity_level": "medium",
      "started_at": "2025-09-10 23:52:52"
    },
    {
      "id": 138,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21859,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:26:06"
    },
    {
      "id": 139,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13534,
      "integrity_level": "medium",
      "started_at": "2025-09-11 13:44:44"
    },
    {
      "id": 140,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 54066,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:51:01"
    },
    {
      "id": 141,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 29579,
      "integrity_level": "medium",
      "started_at": "2025-09-11 13:47:50"
    },
    {
      "id": 142,
      "session_id": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53142,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:33:01"
    },
    {
      "id": 143,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14475,
      "integrity_level": "high",
      "started_at": "2025-09-08 18:52:12"
    },
    {
      "id": 144,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 57322,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:38:56"
    },
    {
      "id": 145,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 11876,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:23:40"
    },
    {
      "id": 146,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25240,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:45:19"
    },
    {
      "id": 147,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28944,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:02:30"
    },
    {
      "id": 148,
      "session_id": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 54781,
      "integrity_level": "low",
      "started_at": "2025-09-08 15:42:39"
    },
    {
      "id": 149,
      "session_id": 85,
      "endpoint_id": 9,
      "parent_pid": 7128,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41988,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:05:54"
    },
    {
      "id": 150,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35093,
      "integrity_level": "medium",
      "started_at": "2025-09-12 12:34:08"
    },
    {
      "id": 151,
      "session_id": 66,
      "endpoint_id": 25,
      "parent_pid": 2140,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45079,
      "integrity_level": "low",
      "started_at": "2025-09-08 11:10:23"
    },
    {
      "id": 152,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31558,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:05:19"
    },
    {
      "id": 153,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61558,
      "integrity_level": "medium",
      "started_at": "2025-09-08 21:42:16"
    },
    {
      "id": 154,
      "session_id": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57288,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:07:06"
    },
    {
      "id": 155,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1398,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:41:19"
    },
    {
      "id": 156,
      "session_id": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8336,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:16:51"
    },
    {
      "id": 157,
      "session_id": 127,
      "endpoint_id": 22,
      "parent_pid": 1504,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 10269,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:08:04"
    },
    {
      "id": 158,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 11402,
      "integrity_level": "low",
      "started_at": "2025-09-10 17:24:08"
    },
    {
      "id": 159,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44836,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:26:16"
    },
    {
      "id": 160,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 46776,
      "integrity_level": "medium",
      "started_at": "2025-09-09 12:10:08"
    },
    {
      "id": 161,
      "session_id": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 38072,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:46:34"
    },
    {
      "id": 162,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 4295,
      "integrity_level": "low",
      "started_at": "2025-09-11 13:33:09"
    },
    {
      "id": 163,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49369,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:35:00"
    },
    {
      "id": 164,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44115,
      "integrity_level": "medium",
      "started_at": "2025-09-09 18:19:27"
    },
    {
      "id": 165,
      "session_id": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24591,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:05:21"
    },
    {
      "id": 166,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 14994,
      "integrity_level": "medium",
      "started_at": "2025-09-09 18:31:45"
    },
    {
      "id": 167,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 5361,
      "integrity_level": "medium",
      "started_at": "2025-09-10 20:00:14"
    },
    {
      "id": 168,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17830,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:31:36"
    },
    {
      "id": 169,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60234,
      "integrity_level": "high",
      "started_at": "2025-09-11 15:27:31"
    },
    {
      "id": 170,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41453,
      "integrity_level": "high",
      "started_at": "2025-09-08 13:29:04"
    },
    {
      "id": 171,
      "session_id": 36,
      "endpoint_id": 20,
      "parent_pid": 4428,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30005,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:27:26"
    },
    {
      "id": 172,
      "session_id": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 44074,
      "integrity_level": "low",
      "started_at": "2025-09-11 12:39:23"
    },
    {
      "id": 173,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49561,
      "integrity_level": "low",
      "started_at": "2025-09-10 13:47:21"
    },
    {
      "id": 174,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18938,
      "integrity_level": "low",
      "started_at": "2025-09-09 19:38:03"
    },
    {
      "id": 175,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45523,
      "integrity_level": "medium",
      "started_at": "2025-09-12 19:14:07"
    },
    {
      "id": 176,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33369,
      "integrity_level": "medium",
      "started_at": "2025-09-12 21:27:21"
    },
    {
      "id": 177,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 52969,
      "integrity_level": "low",
      "started_at": "2025-09-08 15:14:12"
    },
    {
      "id": 178,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 53009,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:07:54"
    },
    {
      "id": 179,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41425,
      "integrity_level": "medium",
      "started_at": "2025-09-12 21:57:29"
    },
    {
      "id": 180,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 22062,
      "integrity_level": "medium",
      "started_at": "2025-09-12 13:41:22"
    },
    {
      "id": 181,
      "session_id": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 40256,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:10:13"
    },
    {
      "id": 182,
      "session_id": 33,
      "endpoint_id": 26,
      "parent_pid": 3235,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61073,
      "integrity_level": "medium",
      "started_at": "2025-09-08 10:13:45"
    },
    {
      "id": 183,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57760,
      "integrity_level": "medium",
      "started_at": "2025-09-11 20:06:30"
    },
    {
      "id": 184,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 34069,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:58:38"
    },
    {
      "id": 185,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43534,
      "integrity_level": "low",
      "started_at": "2025-09-09 15:30:09"
    },
    {
      "id": 186,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38818,
      "integrity_level": "medium",
      "started_at": "2025-09-09 20:10:52"
    },
    {
      "id": 187,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 56528,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:05:02"
    },
    {
      "id": 188,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55862,
      "integrity_level": "medium",
      "started_at": "2025-09-11 20:27:58"
    },
    {
      "id": 189,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26077,
      "integrity_level": "medium",
      "started_at": "2025-09-10 20:09:27"
    },
    {
      "id": 190,
      "session_id": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 31025,
      "integrity_level": "medium",
      "started_at": "2025-09-11 00:00:34"
    },
    {
      "id": 191,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 7221,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:45:37"
    },
    {
      "id": 192,
      "session_id": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3940,
      "integrity_level": "high",
      "started_at": "2025-09-09 14:27:20"
    },
    {
      "id": 193,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 20177,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:41:36"
    },
    {
      "id": 194,
      "session_id": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 29813,
      "integrity_level": "low",
      "started_at": "2025-09-12 10:58:10"
    },
    {
      "id": 195,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54269,
      "integrity_level": "high",
      "started_at": "2025-09-12 18:21:29"
    },
    {
      "id": 196,
      "session_id": 54,
      "endpoint_id": 7,
      "parent_pid": 2990,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 40860,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:34:52"
    },
    {
      "id": 197,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39816,
      "integrity_level": "low",
      "started_at": "2025-09-09 15:56:04"
    },
    {
      "id": 198,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 48079,
      "integrity_level": "medium",
      "started_at": "2025-09-10 21:29:21"
    },
    {
      "id": 199,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31843,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:32:24"
    },
    {
      "id": 200,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 6928,
      "integrity_level": "high",
      "started_at": "2025-09-10 14:38:39"
    },
    {
      "id": 201,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 63883,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:30:00"
    },
    {
      "id": 202,
      "session_id": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 43291,
      "integrity_level": "medium",
      "started_at": "2025-09-08 11:43:04"
    },
    {
      "id": 203,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 16739,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:57:02"
    },
    {
      "id": 204,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 15665,
      "integrity_level": "low",
      "started_at": "2025-09-08 10:49:57"
    },
    {
      "id": 205,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50897,
      "integrity_level": "high",
      "started_at": "2025-09-08 18:28:51"
    },
    {
      "id": 206,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18564,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:20:42"
    },
    {
      "id": 207,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 12954,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:25:58"
    },
    {
      "id": 208,
      "session_id": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56449,
      "integrity_level": "high",
      "started_at": "2025-09-11 16:17:34"
    },
    {
      "id": 209,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 32252,
      "integrity_level": "medium",
      "started_at": "2025-09-11 13:58:44"
    },
    {
      "id": 210,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28766,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:29:05"
    },
    {
      "id": 211,
      "session_id": 90,
      "endpoint_id": 14,
      "parent_pid": 5514,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 5420,
      "integrity_level": "medium",
      "started_at": "2025-09-11 09:30:40"
    },
    {
      "id": 212,
      "session_id": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61892,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:41:52"
    },
    {
      "id": 213,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37867,
      "integrity_level": "medium",
      "started_at": "2025-09-08 22:25:56"
    },
    {
      "id": 214,
      "session_id": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 22372,
      "integrity_level": "medium",
      "started_at": "2025-09-08 11:53:54"
    },
    {
      "id": 215,
      "session_id": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 39630,
      "integrity_level": "low",
      "started_at": "2025-09-09 12:09:17"
    },
    {
      "id": 216,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 4540,
      "integrity_level": "medium",
      "started_at": "2025-09-08 23:44:56"
    },
    {
      "id": 217,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61419,
      "integrity_level": "low",
      "started_at": "2025-09-10 17:42:05"
    },
    {
      "id": 218,
      "session_id": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 61225,
      "integrity_level": "high",
      "started_at": "2025-09-08 12:15:16"
    },
    {
      "id": 219,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30347,
      "integrity_level": "medium",
      "started_at": "2025-09-09 20:17:30"
    },
    {
      "id": 220,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 23413,
      "integrity_level": "high",
      "started_at": "2025-09-10 12:01:45"
    },
    {
      "id": 221,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36353,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:43:34"
    },
    {
      "id": 222,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 28924,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:25:45"
    },
    {
      "id": 223,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 13972,
      "integrity_level": "medium",
      "started_at": "2025-09-11 11:11:23"
    },
    {
      "id": 224,
      "session_id": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 61478,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:55:01"
    },
    {
      "id": 225,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60709,
      "integrity_level": "high",
      "started_at": "2025-09-09 11:44:29"
    },
    {
      "id": 226,
      "session_id": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28834,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:33:00"
    },
    {
      "id": 227,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 48805,
      "integrity_level": "low",
      "started_at": "2025-09-08 12:13:40"
    },
    {
      "id": 228,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 55636,
      "integrity_level": "low",
      "started_at": "2025-09-10 14:34:31"
    },
    {
      "id": 229,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27407,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:06:49"
    },
    {
      "id": 230,
      "session_id": 91,
      "endpoint_id": 19,
      "parent_pid": 7689,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 40314,
      "integrity_level": "high",
      "started_at": "2025-09-12 10:35:01"
    },
    {
      "id": 231,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 54292,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:57:17"
    },
    {
      "id": 232,
      "session_id": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32167,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:34:34"
    },
    {
      "id": 233,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 46600,
      "integrity_level": "medium",
      "started_at": "2025-09-13 00:14:24"
    },
    {
      "id": 234,
      "session_id": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62469,
      "integrity_level": "low",
      "started_at": "2025-09-09 13:48:36"
    },
    {
      "id": 235,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34266,
      "integrity_level": "low",
      "started_at": "2025-09-10 14:04:24"
    },
    {
      "id": 236,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 19597,
      "integrity_level": "low",
      "started_at": "2025-09-11 20:36:31"
    },
    {
      "id": 237,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14924,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:39:40"
    },
    {
      "id": 238,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23200,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:16:54"
    },
    {
      "id": 239,
      "session_id": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3544,
      "integrity_level": "high",
      "started_at": "2025-09-08 12:31:01"
    },
    {
      "id": 240,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32551,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:33:03"
    },
    {
      "id": 241,
      "session_id": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32223,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:08:35"
    },
    {
      "id": 242,
      "session_id": 119,
      "endpoint_id": 21,
      "parent_pid": 6808,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27221,
      "integrity_level": "low",
      "started_at": "2025-09-10 20:58:28"
    },
    {
      "id": 243,
      "session_id": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12920,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:47:10"
    },
    {
      "id": 244,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 60267,
      "integrity_level": "high",
      "started_at": "2025-09-10 17:39:42"
    },
    {
      "id": 245,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 35064,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:44:16"
    },
    {
      "id": 246,
      "session_id": 33,
      "endpoint_id": 26,
      "parent_pid": 3235,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5696,
      "integrity_level": "medium",
      "started_at": "2025-09-08 11:17:34"
    },
    {
      "id": 247,
      "session_id": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 49419,
      "integrity_level": "medium",
      "started_at": "2025-09-10 10:39:38"
    },
    {
      "id": 248,
      "session_id": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60865,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:41:33"
    },
    {
      "id": 249,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 2629,
      "integrity_level": "low",
      "started_at": "2025-09-10 18:02:21"
    },
    {
      "id": 250,
      "session_id": 8,
      "endpoint_id": 14,
      "parent_pid": 8148,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35738,
      "integrity_level": "medium",
      "started_at": "2025-09-09 09:25:53"
    },
    {
      "id": 251,
      "session_id": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56178,
      "integrity_level": "medium",
      "started_at": "2025-09-11 13:44:36"
    },
    {
      "id": 252,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 47675,
      "integrity_level": "low",
      "started_at": "2025-09-10 18:40:29"
    },
    {
      "id": 253,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 55668,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:40:14"
    },
    {
      "id": 254,
      "session_id": 89,
      "endpoint_id": 18,
      "parent_pid": 7044,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56120,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:44:55"
    },
    {
      "id": 255,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 23623,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:19:05"
    },
    {
      "id": 256,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 6303,
      "integrity_level": "medium",
      "started_at": "2025-09-10 17:54:55"
    },
    {
      "id": 257,
      "session_id": 45,
      "endpoint_id": 11,
      "parent_pid": 8295,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17170,
      "integrity_level": "medium",
      "started_at": "2025-09-12 17:31:07"
    },
    {
      "id": 258,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 22176,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:18:00"
    },
    {
      "id": 259,
      "session_id": 28,
      "endpoint_id": 29,
      "parent_pid": 1782,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 1192,
      "integrity_level": "high",
      "started_at": "2025-09-10 12:04:23"
    },
    {
      "id": 260,
      "session_id": 25,
      "endpoint_id": 2,
      "parent_pid": 3737,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12286,
      "integrity_level": "low",
      "started_at": "2025-09-08 13:48:55"
    },
    {
      "id": 261,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 8522,
      "integrity_level": "high",
      "started_at": "2025-09-11 15:08:42"
    },
    {
      "id": 262,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3605,
      "integrity_level": "medium",
      "started_at": "2025-09-09 18:36:35"
    },
    {
      "id": 263,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 62432,
      "integrity_level": "high",
      "started_at": "2025-09-12 19:44:42"
    },
    {
      "id": 264,
      "session_id": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 6071,
      "integrity_level": "medium",
      "started_at": "2025-09-11 14:53:59"
    },
    {
      "id": 265,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 932,
      "integrity_level": "medium",
      "started_at": "2025-09-11 11:36:24"
    },
    {
      "id": 266,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56419,
      "integrity_level": "low",
      "started_at": "2025-09-11 14:56:48"
    },
    {
      "id": 267,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 37820,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:11:45"
    },
    {
      "id": 268,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 1833,
      "integrity_level": "medium",
      "started_at": "2025-09-10 20:31:53"
    },
    {
      "id": 269,
      "session_id": 28,
      "endpoint_id": 29,
      "parent_pid": 1782,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45000,
      "integrity_level": "low",
      "started_at": "2025-09-10 12:15:09"
    },
    {
      "id": 270,
      "session_id": 129,
      "endpoint_id": 1,
      "parent_pid": 5131,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 58553,
      "integrity_level": "medium",
      "started_at": "2025-09-09 01:03:27"
    },
    {
      "id": 271,
      "session_id": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 54078,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:58:54"
    },
    {
      "id": 272,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47307,
      "integrity_level": "high",
      "started_at": "2025-09-09 18:40:07"
    },
    {
      "id": 273,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 56921,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:26:21"
    },
    {
      "id": 274,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 8488,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:28:37"
    },
    {
      "id": 275,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50379,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:31:31"
    },
    {
      "id": 276,
      "session_id": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 15988,
      "integrity_level": "low",
      "started_at": "2025-09-10 11:53:40"
    },
    {
      "id": 277,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 47062,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:33:10"
    },
    {
      "id": 278,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 46939,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:52:50"
    },
    {
      "id": 279,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15100,
      "integrity_level": "low",
      "started_at": "2025-09-11 16:06:57"
    },
    {
      "id": 280,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42237,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:04:54"
    },
    {
      "id": 281,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44118,
      "integrity_level": "medium",
      "started_at": "2025-09-11 15:17:58"
    },
    {
      "id": 282,
      "session_id": 104,
      "endpoint_id": 21,
      "parent_pid": 7548,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25431,
      "integrity_level": "medium",
      "started_at": "2025-09-09 10:53:00"
    },
    {
      "id": 283,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 31200,
      "integrity_level": "medium",
      "started_at": "2025-09-09 12:46:16"
    },
    {
      "id": 284,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25670,
      "integrity_level": "medium",
      "started_at": "2025-09-08 10:19:26"
    },
    {
      "id": 285,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64241,
      "integrity_level": "medium",
      "started_at": "2025-09-12 14:24:49"
    },
    {
      "id": 286,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 15966,
      "integrity_level": "medium",
      "started_at": "2025-09-11 15:47:46"
    },
    {
      "id": 287,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31309,
      "integrity_level": "medium",
      "started_at": "2025-09-09 19:00:18"
    },
    {
      "id": 288,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 43147,
      "integrity_level": "low",
      "started_at": "2025-09-12 01:06:39"
    },
    {
      "id": 289,
      "session_id": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5347,
      "integrity_level": "medium",
      "started_at": "2025-09-10 12:57:46"
    },
    {
      "id": 290,
      "session_id": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58314,
      "integrity_level": "high",
      "started_at": "2025-09-12 11:06:46"
    },
    {
      "id": 291,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 24759,
      "integrity_level": "low",
      "started_at": "2025-09-13 00:29:13"
    },
    {
      "id": 292,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43343,
      "integrity_level": "medium",
      "started_at": "2025-09-12 01:45:18"
    },
    {
      "id": 293,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46403,
      "integrity_level": "low",
      "started_at": "2025-09-13 01:00:58"
    },
    {
      "id": 294,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63248,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:00:27"
    },
    {
      "id": 295,
      "session_id": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 49610,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:34:16"
    },
    {
      "id": 296,
      "session_id": 57,
      "endpoint_id": 27,
      "parent_pid": 8454,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6413,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:49:06"
    },
    {
      "id": 297,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17238,
      "integrity_level": "high",
      "started_at": "2025-09-10 15:29:13"
    },
    {
      "id": 298,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40165,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:51:51"
    },
    {
      "id": 299,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 40090,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:53:57"
    },
    {
      "id": 300,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 13451,
      "integrity_level": "medium",
      "started_at": "2025-09-09 16:39:51"
    },
    {
      "id": 301,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 935,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:42:52"
    },
    {
      "id": 302,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 21968,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:14:03"
    },
    {
      "id": 303,
      "session_id": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60717,
      "integrity_level": "medium",
      "started_at": "2025-09-10 22:20:35"
    },
    {
      "id": 304,
      "session_id": 72,
      "endpoint_id": 23,
      "parent_pid": 9273,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 33428,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:00:29"
    },
    {
      "id": 305,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 43470,
      "integrity_level": "medium",
      "started_at": "2025-09-12 19:40:48"
    },
    {
      "id": 306,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19835,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:33:51"
    },
    {
      "id": 307,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 52995,
      "integrity_level": "medium",
      "started_at": "2025-09-09 15:17:15"
    },
    {
      "id": 308,
      "session_id": 7,
      "endpoint_id": 1,
      "parent_pid": 777,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39176,
      "integrity_level": "low",
      "started_at": "2025-09-08 13:25:49"
    },
    {
      "id": 309,
      "session_id": 97,
      "endpoint_id": 1,
      "parent_pid": 3764,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2501,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:58:14"
    },
    {
      "id": 310,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31168,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:44:35"
    },
    {
      "id": 311,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 38782,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:45:55"
    },
    {
      "id": 312,
      "session_id": 107,
      "endpoint_id": 11,
      "parent_pid": 7525,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58917,
      "integrity_level": "medium",
      "started_at": "2025-09-12 12:14:36"
    },
    {
      "id": 313,
      "session_id": 23,
      "endpoint_id": 20,
      "parent_pid": 3826,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31378,
      "integrity_level": "high",
      "started_at": "2025-09-12 12:29:03"
    },
    {
      "id": 314,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7325,
      "integrity_level": "low",
      "started_at": "2025-09-09 19:20:20"
    },
    {
      "id": 315,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 42933,
      "integrity_level": "high",
      "started_at": "2025-09-11 17:33:35"
    },
    {
      "id": 316,
      "session_id": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64565,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:08:22"
    },
    {
      "id": 317,
      "session_id": 122,
      "endpoint_id": 17,
      "parent_pid": 6690,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 54314,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:01:14"
    },
    {
      "id": 318,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36233,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:08:41"
    },
    {
      "id": 319,
      "session_id": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 9012,
      "integrity_level": "high",
      "started_at": "2025-09-09 14:33:30"
    },
    {
      "id": 320,
      "session_id": 7,
      "endpoint_id": 1,
      "parent_pid": 777,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 27511,
      "integrity_level": "high",
      "started_at": "2025-09-08 14:45:39"
    },
    {
      "id": 321,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 56212,
      "integrity_level": "high",
      "started_at": "2025-09-12 16:21:36"
    },
    {
      "id": 322,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45116,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:52:20"
    },
    {
      "id": 323,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39061,
      "integrity_level": "low",
      "started_at": "2025-09-08 20:08:14"
    },
    {
      "id": 324,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 30035,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:23:19"
    },
    {
      "id": 325,
      "session_id": 34,
      "endpoint_id": 30,
      "parent_pid": 9204,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20469,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:23:07"
    },
    {
      "id": 326,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23781,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:49:34"
    },
    {
      "id": 327,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54358,
      "integrity_level": "medium",
      "started_at": "2025-09-09 21:42:37"
    },
    {
      "id": 328,
      "session_id": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60534,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:01:31"
    },
    {
      "id": 329,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 20216,
      "integrity_level": "medium",
      "started_at": "2025-09-09 16:26:06"
    },
    {
      "id": 330,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 3831,
      "integrity_level": "medium",
      "started_at": "2025-09-09 21:57:46"
    },
    {
      "id": 331,
      "session_id": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 58772,
      "integrity_level": "medium",
      "started_at": "2025-09-11 20:40:54"
    },
    {
      "id": 332,
      "session_id": 130,
      "endpoint_id": 8,
      "parent_pid": 6080,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 14407,
      "integrity_level": "medium",
      "started_at": "2025-09-12 12:32:13"
    },
    {
      "id": 333,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 7215,
      "integrity_level": "low",
      "started_at": "2025-09-08 18:13:15"
    },
    {
      "id": 334,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 60255,
      "integrity_level": "low",
      "started_at": "2025-09-08 16:33:17"
    },
    {
      "id": 335,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48395,
      "integrity_level": "high",
      "started_at": "2025-09-12 16:49:05"
    },
    {
      "id": 336,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 51238,
      "integrity_level": "medium",
      "started_at": "2025-09-09 19:42:08"
    },
    {
      "id": 337,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54920,
      "integrity_level": "medium",
      "started_at": "2025-09-12 02:04:33"
    },
    {
      "id": 338,
      "session_id": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26943,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:53:11"
    },
    {
      "id": 339,
      "session_id": 40,
      "endpoint_id": 18,
      "parent_pid": 9039,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6596,
      "integrity_level": "medium",
      "started_at": "2025-09-08 14:06:40"
    },
    {
      "id": 340,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 11257,
      "integrity_level": "low",
      "started_at": "2025-09-10 12:55:09"
    },
    {
      "id": 341,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 28515,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:06:30"
    },
    {
      "id": 342,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 47029,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:29:32"
    },
    {
      "id": 343,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 13697,
      "integrity_level": "medium",
      "started_at": "2025-09-11 20:54:16"
    },
    {
      "id": 344,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 31471,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:52:29"
    },
    {
      "id": 345,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 30315,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:19:27"
    },
    {
      "id": 346,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18805,
      "integrity_level": "medium",
      "started_at": "2025-09-12 14:48:44"
    },
    {
      "id": 347,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9114,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:06:10"
    },
    {
      "id": 348,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 36455,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:20:13"
    },
    {
      "id": 349,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20688,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:29:19"
    },
    {
      "id": 350,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 5485,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:42:34"
    },
    {
      "id": 351,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53006,
      "integrity_level": "low",
      "started_at": "2025-09-08 11:41:42"
    },
    {
      "id": 352,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 39809,
      "integrity_level": "high",
      "started_at": "2025-09-10 19:56:59"
    },
    {
      "id": 353,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 57986,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:19:03"
    },
    {
      "id": 354,
      "session_id": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42988,
      "integrity_level": "low",
      "started_at": "2025-09-08 13:25:03"
    },
    {
      "id": 355,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 12494,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:36:14"
    },
    {
      "id": 356,
      "session_id": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 54721,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:23:43"
    },
    {
      "id": 357,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17802,
      "integrity_level": "medium",
      "started_at": "2025-09-09 21:13:19"
    },
    {
      "id": 358,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 52012,
      "integrity_level": "low",
      "started_at": "2025-09-08 14:48:32"
    },
    {
      "id": 359,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 34261,
      "integrity_level": "high",
      "started_at": "2025-09-08 20:51:54"
    },
    {
      "id": 360,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2848,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:06:19"
    },
    {
      "id": 361,
      "session_id": 41,
      "endpoint_id": 19,
      "parent_pid": 5450,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26046,
      "integrity_level": "medium",
      "started_at": "2025-09-08 06:39:42"
    },
    {
      "id": 362,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 53635,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:27:24"
    },
    {
      "id": 363,
      "session_id": 26,
      "endpoint_id": 2,
      "parent_pid": 3041,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 16048,
      "integrity_level": "high",
      "started_at": "2025-09-12 16:29:18"
    },
    {
      "id": 364,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36103,
      "integrity_level": "medium",
      "started_at": "2025-09-12 02:38:58"
    },
    {
      "id": 365,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2077,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:56:36"
    },
    {
      "id": 366,
      "session_id": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38325,
      "integrity_level": "high",
      "started_at": "2025-09-11 09:28:36"
    },
    {
      "id": 367,
      "session_id": 52,
      "endpoint_id": 28,
      "parent_pid": 2323,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58323,
      "integrity_level": "high",
      "started_at": "2025-09-08 19:12:57"
    },
    {
      "id": 368,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 18083,
      "integrity_level": "low",
      "started_at": "2025-09-10 16:12:58"
    },
    {
      "id": 369,
      "session_id": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49049,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:53:13"
    },
    {
      "id": 370,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 11839,
      "integrity_level": "medium",
      "started_at": "2025-09-12 19:07:03"
    },
    {
      "id": 371,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 36076,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:37:54"
    },
    {
      "id": 372,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 44607,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:41:48"
    },
    {
      "id": 373,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 18894,
      "integrity_level": "low",
      "started_at": "2025-09-08 19:11:57"
    },
    {
      "id": 374,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34533,
      "integrity_level": "medium",
      "started_at": "2025-09-09 16:44:22"
    },
    {
      "id": 375,
      "session_id": 71,
      "endpoint_id": 2,
      "parent_pid": 9165,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38181,
      "integrity_level": "medium",
      "started_at": "2025-09-10 17:22:05"
    },
    {
      "id": 376,
      "session_id": 3,
      "endpoint_id": 8,
      "parent_pid": 3588,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13354,
      "integrity_level": "low",
      "started_at": "2025-09-08 14:34:14"
    },
    {
      "id": 377,
      "session_id": 21,
      "endpoint_id": 8,
      "parent_pid": 1578,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 27111,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:54:04"
    },
    {
      "id": 378,
      "session_id": 13,
      "endpoint_id": 22,
      "parent_pid": 6372,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14900,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:41:01"
    },
    {
      "id": 379,
      "session_id": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6542,
      "integrity_level": "low",
      "started_at": "2025-09-10 14:07:38"
    },
    {
      "id": 380,
      "session_id": 75,
      "endpoint_id": 26,
      "parent_pid": 799,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16118,
      "integrity_level": "medium",
      "started_at": "2025-09-08 11:35:22"
    },
    {
      "id": 381,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36546,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:49:22"
    },
    {
      "id": 382,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35728,
      "integrity_level": "low",
      "started_at": "2025-09-10 16:19:14"
    },
    {
      "id": 383,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42906,
      "integrity_level": "low",
      "started_at": "2025-09-12 21:34:23"
    },
    {
      "id": 384,
      "session_id": 81,
      "endpoint_id": 14,
      "parent_pid": 1248,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59974,
      "integrity_level": "medium",
      "started_at": "2025-09-11 16:50:53"
    },
    {
      "id": 385,
      "session_id": 43,
      "endpoint_id": 5,
      "parent_pid": 2202,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 19298,
      "integrity_level": "low",
      "started_at": "2025-09-10 22:51:07"
    },
    {
      "id": 386,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 63102,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:59:30"
    },
    {
      "id": 387,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13027,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:59:44"
    },
    {
      "id": 388,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 29144,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:59:26"
    },
    {
      "id": 389,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 1834,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:29:32"
    },
    {
      "id": 390,
      "session_id": 94,
      "endpoint_id": 4,
      "parent_pid": 8955,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50328,
      "integrity_level": "medium",
      "started_at": "2025-09-11 09:38:05"
    },
    {
      "id": 391,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19567,
      "integrity_level": "low",
      "started_at": "2025-09-08 22:08:12"
    },
    {
      "id": 392,
      "session_id": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 33782,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:35:47"
    },
    {
      "id": 393,
      "session_id": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 15421,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:34:27"
    },
    {
      "id": 394,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11868,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:05:33"
    },
    {
      "id": 395,
      "session_id": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 43857,
      "integrity_level": "low",
      "started_at": "2025-09-09 13:02:59"
    },
    {
      "id": 396,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22514,
      "integrity_level": "medium",
      "started_at": "2025-09-09 22:07:05"
    },
    {
      "id": 397,
      "session_id": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47772,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:20:15"
    },
    {
      "id": 398,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31853,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:47:41"
    },
    {
      "id": 399,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 12354,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:46:58"
    },
    {
      "id": 400,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 51811,
      "integrity_level": "high",
      "started_at": "2025-09-08 17:43:45"
    },
    {
      "id": 401,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22532,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:41:44"
    },
    {
      "id": 402,
      "session_id": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3576,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:59:07"
    },
    {
      "id": 403,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37069,
      "integrity_level": "medium",
      "started_at": "2025-09-08 12:14:04"
    },
    {
      "id": 404,
      "session_id": 27,
      "endpoint_id": 1,
      "parent_pid": 6515,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 1270,
      "integrity_level": "medium",
      "started_at": "2025-09-09 15:56:22"
    },
    {
      "id": 405,
      "session_id": 47,
      "endpoint_id": 30,
      "parent_pid": 8438,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 58028,
      "integrity_level": "medium",
      "started_at": "2025-09-10 17:17:30"
    },
    {
      "id": 406,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 24732,
      "integrity_level": "medium",
      "started_at": "2025-09-09 22:11:36"
    },
    {
      "id": 407,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 26398,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:56:22"
    },
    {
      "id": 408,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 29568,
      "integrity_level": "low",
      "started_at": "2025-09-11 12:39:33"
    },
    {
      "id": 409,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60471,
      "integrity_level": "low",
      "started_at": "2025-09-11 21:30:32"
    },
    {
      "id": 410,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 52011,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:55:09"
    },
    {
      "id": 411,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 38569,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:54:40"
    },
    {
      "id": 412,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2537,
      "integrity_level": "medium",
      "started_at": "2025-09-11 18:47:34"
    },
    {
      "id": 413,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 15396,
      "integrity_level": "medium",
      "started_at": "2025-09-10 21:28:45"
    },
    {
      "id": 414,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 61129,
      "integrity_level": "high",
      "started_at": "2025-09-09 18:44:03"
    },
    {
      "id": 415,
      "session_id": 100,
      "endpoint_id": 13,
      "parent_pid": 4103,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44236,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:24:51"
    },
    {
      "id": 416,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 64425,
      "integrity_level": "medium",
      "started_at": "2025-09-11 21:25:17"
    },
    {
      "id": 417,
      "session_id": 92,
      "endpoint_id": 29,
      "parent_pid": 7465,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 7857,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:37:24"
    },
    {
      "id": 418,
      "session_id": 131,
      "endpoint_id": 3,
      "parent_pid": 807,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 25491,
      "integrity_level": "medium",
      "started_at": "2025-09-11 22:05:34"
    },
    {
      "id": 419,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 6165,
      "integrity_level": "medium",
      "started_at": "2025-09-11 13:46:17"
    },
    {
      "id": 420,
      "session_id": 88,
      "endpoint_id": 27,
      "parent_pid": 4101,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 47194,
      "integrity_level": "medium",
      "started_at": "2025-09-11 17:04:11"
    },
    {
      "id": 421,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 27717,
      "integrity_level": "high",
      "started_at": "2025-09-12 03:09:53"
    },
    {
      "id": 422,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 23607,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:38:12"
    },
    {
      "id": 423,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29523,
      "integrity_level": "low",
      "started_at": "2025-09-12 19:32:39"
    },
    {
      "id": 424,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12999,
      "integrity_level": "low",
      "started_at": "2025-09-13 01:47:49"
    },
    {
      "id": 425,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28405,
      "integrity_level": "medium",
      "started_at": "2025-09-08 15:51:27"
    },
    {
      "id": 426,
      "session_id": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30972,
      "integrity_level": "low",
      "started_at": "2025-09-09 14:10:01"
    },
    {
      "id": 427,
      "session_id": 95,
      "endpoint_id": 7,
      "parent_pid": 9803,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 22114,
      "integrity_level": "low",
      "started_at": "2025-09-10 22:32:01"
    },
    {
      "id": 428,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 34210,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:28:27"
    },
    {
      "id": 429,
      "session_id": 38,
      "endpoint_id": 21,
      "parent_pid": 8575,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 12950,
      "integrity_level": "low",
      "started_at": "2025-09-08 08:17:51"
    },
    {
      "id": 430,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14673,
      "integrity_level": "medium",
      "started_at": "2025-09-11 12:48:40"
    },
    {
      "id": 431,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7288,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:04:36"
    },
    {
      "id": 432,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58174,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:49:17"
    },
    {
      "id": 433,
      "session_id": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49560,
      "integrity_level": "medium",
      "started_at": "2025-09-11 20:16:36"
    },
    {
      "id": 434,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37311,
      "integrity_level": "low",
      "started_at": "2025-09-08 22:39:04"
    },
    {
      "id": 435,
      "session_id": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 42046,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:34:46"
    },
    {
      "id": 436,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 46964,
      "integrity_level": "low",
      "started_at": "2025-09-08 22:07:12"
    },
    {
      "id": 437,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45963,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:56:10"
    },
    {
      "id": 438,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 39388,
      "integrity_level": "medium",
      "started_at": "2025-09-09 22:18:27"
    },
    {
      "id": 439,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60486,
      "integrity_level": "high",
      "started_at": "2025-09-08 22:47:59"
    },
    {
      "id": 440,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 14899,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:20:11"
    },
    {
      "id": 441,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56072,
      "integrity_level": "medium",
      "started_at": "2025-09-08 23:51:20"
    },
    {
      "id": 442,
      "session_id": 17,
      "endpoint_id": 19,
      "parent_pid": 7447,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7940,
      "integrity_level": "high",
      "started_at": "2025-09-09 23:31:18"
    },
    {
      "id": 443,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7017,
      "integrity_level": "low",
      "started_at": "2025-09-11 14:09:52"
    },
    {
      "id": 444,
      "session_id": 96,
      "endpoint_id": 9,
      "parent_pid": 9109,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 28259,
      "integrity_level": "medium",
      "started_at": "2025-09-12 07:58:53"
    },
    {
      "id": 445,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 8609,
      "integrity_level": "low",
      "started_at": "2025-09-12 19:50:14"
    },
    {
      "id": 446,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 43909,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:39:57"
    },
    {
      "id": 447,
      "session_id": 14,
      "endpoint_id": 20,
      "parent_pid": 5631,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 64946,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:25:12"
    },
    {
      "id": 448,
      "session_id": 101,
      "endpoint_id": 25,
      "parent_pid": 7446,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24095,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:56:12"
    },
    {
      "id": 449,
      "session_id": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7351,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:27:21"
    },
    {
      "id": 450,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 52592,
      "integrity_level": "low",
      "started_at": "2025-09-11 22:28:05"
    },
    {
      "id": 451,
      "session_id": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18454,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:38:49"
    },
    {
      "id": 452,
      "session_id": 84,
      "endpoint_id": 29,
      "parent_pid": 6330,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 15071,
      "integrity_level": "medium",
      "started_at": "2025-09-11 19:02:44"
    },
    {
      "id": 453,
      "session_id": 82,
      "endpoint_id": 7,
      "parent_pid": 3087,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 31800,
      "integrity_level": "medium",
      "started_at": "2025-09-08 18:18:47"
    },
    {
      "id": 454,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44332,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:24:23"
    },
    {
      "id": 455,
      "session_id": 87,
      "endpoint_id": 8,
      "parent_pid": 9087,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 28274,
      "integrity_level": "low",
      "started_at": "2025-09-11 20:51:20"
    },
    {
      "id": 456,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 45910,
      "integrity_level": "low",
      "started_at": "2025-09-08 21:41:30"
    },
    {
      "id": 457,
      "session_id": 123,
      "endpoint_id": 4,
      "parent_pid": 9605,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60738,
      "integrity_level": "low",
      "started_at": "2025-09-10 21:09:03"
    },
    {
      "id": 458,
      "session_id": 5,
      "endpoint_id": 9,
      "parent_pid": 4092,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 33005,
      "integrity_level": "medium",
      "started_at": "2025-09-12 21:50:35"
    },
    {
      "id": 459,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 15459,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:26:48"
    },
    {
      "id": 460,
      "session_id": 40,
      "endpoint_id": 18,
      "parent_pid": 9039,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17152,
      "integrity_level": "medium",
      "started_at": "2025-09-08 14:51:38"
    },
    {
      "id": 461,
      "session_id": 86,
      "endpoint_id": 24,
      "parent_pid": 4959,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 3614,
      "integrity_level": "low",
      "started_at": "2025-09-12 10:37:32"
    },
    {
      "id": 462,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 1160,
      "integrity_level": "medium",
      "started_at": "2025-09-10 20:35:20"
    },
    {
      "id": 463,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3725,
      "integrity_level": "medium",
      "started_at": "2025-09-13 02:51:32"
    },
    {
      "id": 464,
      "session_id": 97,
      "endpoint_id": 1,
      "parent_pid": 3764,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16918,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:28:10"
    },
    {
      "id": 465,
      "session_id": 78,
      "endpoint_id": 28,
      "parent_pid": 4336,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61135,
      "integrity_level": "medium",
      "started_at": "2025-09-12 13:53:17"
    },
    {
      "id": 466,
      "session_id": 48,
      "endpoint_id": 10,
      "parent_pid": 1271,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 33595,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:33:55"
    },
    {
      "id": 467,
      "session_id": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36899,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:16:25"
    },
    {
      "id": 468,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50480,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:53:12"
    },
    {
      "id": 469,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 29343,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:10:14"
    },
    {
      "id": 470,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 11266,
      "integrity_level": "medium",
      "started_at": "2025-09-12 23:13:57"
    },
    {
      "id": 471,
      "session_id": 10,
      "endpoint_id": 18,
      "parent_pid": 6676,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 3932,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:24:11"
    },
    {
      "id": 472,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 50693,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:55:48"
    },
    {
      "id": 473,
      "session_id": 98,
      "endpoint_id": 17,
      "parent_pid": 8504,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 982,
      "integrity_level": "medium",
      "started_at": "2025-09-09 01:02:41"
    },
    {
      "id": 474,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46432,
      "integrity_level": "low",
      "started_at": "2025-09-11 14:16:12"
    },
    {
      "id": 475,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6333,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:53:57"
    },
    {
      "id": 476,
      "session_id": 22,
      "endpoint_id": 16,
      "parent_pid": 3475,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56343,
      "integrity_level": "medium",
      "started_at": "2025-09-10 20:23:15"
    },
    {
      "id": 477,
      "session_id": 30,
      "endpoint_id": 5,
      "parent_pid": 5435,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 7825,
      "integrity_level": "low",
      "started_at": "2025-09-09 17:37:49"
    },
    {
      "id": 478,
      "session_id": 39,
      "endpoint_id": 12,
      "parent_pid": 4269,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44850,
      "integrity_level": "medium",
      "started_at": "2025-09-09 19:04:15"
    },
    {
      "id": 479,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20100,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:38:40"
    },
    {
      "id": 480,
      "session_id": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62992,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:31:36"
    },
    {
      "id": 481,
      "session_id": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 56274,
      "integrity_level": "low",
      "started_at": "2025-09-08 16:56:55"
    },
    {
      "id": 482,
      "session_id": 121,
      "endpoint_id": 5,
      "parent_pid": 6355,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 64717,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:45:44"
    },
    {
      "id": 483,
      "session_id": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 12492,
      "integrity_level": "medium",
      "started_at": "2025-09-12 11:44:14"
    },
    {
      "id": 484,
      "session_id": 125,
      "endpoint_id": 10,
      "parent_pid": 6716,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 32968,
      "integrity_level": "medium",
      "started_at": "2025-09-08 13:41:44"
    },
    {
      "id": 485,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45501,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:18:13"
    },
    {
      "id": 486,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44392,
      "integrity_level": "medium",
      "started_at": "2025-09-13 00:20:46"
    },
    {
      "id": 487,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44974,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:45:04"
    },
    {
      "id": 488,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61473,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:27:31"
    },
    {
      "id": 489,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 22003,
      "integrity_level": "low",
      "started_at": "2025-09-10 22:41:08"
    },
    {
      "id": 490,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51639,
      "integrity_level": "low",
      "started_at": "2025-09-08 23:36:35"
    },
    {
      "id": 491,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5519,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:25:43"
    },
    {
      "id": 492,
      "session_id": 15,
      "endpoint_id": 26,
      "parent_pid": 1207,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 9231,
      "integrity_level": "medium",
      "started_at": "2025-09-09 17:42:34"
    },
    {
      "id": 493,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50019,
      "integrity_level": "high",
      "started_at": "2025-09-11 18:12:09"
    },
    {
      "id": 494,
      "session_id": 83,
      "endpoint_id": 26,
      "parent_pid": 8003,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9289,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:49:51"
    },
    {
      "id": 495,
      "session_id": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57344,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:27:22"
    },
    {
      "id": 496,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28484,
      "integrity_level": "medium",
      "started_at": "2025-09-09 20:21:27"
    },
    {
      "id": 497,
      "session_id": 106,
      "endpoint_id": 12,
      "parent_pid": 8968,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34077,
      "integrity_level": "medium",
      "started_at": "2025-09-08 22:12:50"
    },
    {
      "id": 498,
      "session_id": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25642,
      "integrity_level": "medium",
      "started_at": "2025-09-12 12:44:58"
    },
    {
      "id": 499,
      "session_id": 53,
      "endpoint_id": 23,
      "parent_pid": 5187,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28518,
      "integrity_level": "medium",
      "started_at": "2025-09-10 18:44:21"
    },
    {
      "id": 500,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 56378,
      "integrity_level": "medium",
      "started_at": "2025-09-12 23:37:05"
    },
    {
      "id": 501,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21386,
      "integrity_level": "low",
      "started_at": "2025-09-10 15:38:38"
    },
    {
      "id": 502,
      "session_id": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain_id": 14,
      "process_name": "cmd.exe",
      "child_process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 55238,
      "integrity_level": "low",
      "started_at": "2025-09-11 01:12:20"
    },
    {
      "id": 503,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58254,
      "integrity_level": "medium",
      "started_at": "2025-09-10 21:46:44"
    },
    {
      "id": 504,
      "session_id": 73,
      "endpoint_id": 15,
      "parent_pid": 2342,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34957,
      "integrity_level": "medium",
      "started_at": "2025-09-08 21:23:46"
    },
    {
      "id": 505,
      "session_id": 102,
      "endpoint_id": 6,
      "parent_pid": 2779,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53794,
      "integrity_level": "medium",
      "started_at": "2025-09-10 14:14:19"
    },
    {
      "id": 506,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10074,
      "integrity_level": "low",
      "started_at": "2025-09-08 20:36:18"
    },
    {
      "id": 507,
      "session_id": 45,
      "endpoint_id": 11,
      "parent_pid": 8295,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24155,
      "integrity_level": "medium",
      "started_at": "2025-09-12 18:23:00"
    },
    {
      "id": 508,
      "session_id": 31,
      "endpoint_id": 17,
      "parent_pid": 9042,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56082,
      "integrity_level": "medium",
      "started_at": "2025-09-11 11:38:30"
    },
    {
      "id": 509,
      "session_id": 105,
      "endpoint_id": 18,
      "parent_pid": 9411,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6233,
      "integrity_level": "medium",
      "started_at": "2025-09-12 15:31:32"
    },
    {
      "id": 510,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 41236,
      "integrity_level": "low",
      "started_at": "2025-09-10 17:17:42"
    },
    {
      "id": 511,
      "session_id": 113,
      "endpoint_id": 22,
      "parent_pid": 4002,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21581,
      "integrity_level": "medium",
      "started_at": "2025-09-09 11:47:44"
    },
    {
      "id": 512,
      "session_id": 96,
      "endpoint_id": 9,
      "parent_pid": 9109,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13102,
      "integrity_level": "medium",
      "started_at": "2025-09-12 09:30:09"
    },
    {
      "id": 513,
      "session_id": 60,
      "endpoint_id": 25,
      "parent_pid": 1935,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4995,
      "integrity_level": "low",
      "started_at": "2025-09-11 02:06:22"
    },
    {
      "id": 514,
      "session_id": 108,
      "endpoint_id": 1,
      "parent_pid": 9857,
      "launch_chain_id": 11,
      "process_name": "outlook.exe",
      "child_process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 25807,
      "integrity_level": "low",
      "started_at": "2025-09-13 03:32:47"
    },
    {
      "id": 515,
      "session_id": 67,
      "endpoint_id": 19,
      "parent_pid": 9805,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36077,
      "integrity_level": "medium",
      "started_at": "2025-09-10 16:41:47"
    },
    {
      "id": 516,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1617,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:44:15"
    },
    {
      "id": 517,
      "session_id": 56,
      "endpoint_id": 30,
      "parent_pid": 2847,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57726,
      "integrity_level": "high",
      "started_at": "2025-09-11 19:14:18"
    },
    {
      "id": 518,
      "session_id": 50,
      "endpoint_id": 17,
      "parent_pid": 2098,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 39724,
      "integrity_level": "low",
      "started_at": "2025-09-09 20:41:56"
    },
    {
      "id": 519,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28678,
      "integrity_level": "medium",
      "started_at": "2025-09-09 22:36:30"
    },
    {
      "id": 520,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57289,
      "integrity_level": "low",
      "started_at": "2025-09-10 18:35:51"
    },
    {
      "id": 521,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 10497,
      "integrity_level": "medium",
      "started_at": "2025-09-08 21:14:03"
    },
    {
      "id": 522,
      "session_id": 65,
      "endpoint_id": 28,
      "parent_pid": 2048,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 51499,
      "integrity_level": "medium",
      "started_at": "2025-09-08 19:52:39"
    },
    {
      "id": 523,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 41324,
      "integrity_level": "low",
      "started_at": "2025-09-10 23:14:47"
    },
    {
      "id": 524,
      "session_id": 70,
      "endpoint_id": 14,
      "parent_pid": 9033,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 64374,
      "integrity_level": "medium",
      "started_at": "2025-09-10 17:16:07"
    },
    {
      "id": 525,
      "session_id": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9432,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:19:45"
    },
    {
      "id": 526,
      "session_id": 69,
      "endpoint_id": 14,
      "parent_pid": 807,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13520,
      "integrity_level": "medium",
      "started_at": "2025-09-11 15:42:16"
    },
    {
      "id": 527,
      "session_id": 63,
      "endpoint_id": 20,
      "parent_pid": 6555,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25250,
      "integrity_level": "medium",
      "started_at": "2025-09-08 20:40:23"
    },
    {
      "id": 528,
      "session_id": 120,
      "endpoint_id": 9,
      "parent_pid": 5090,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 37202,
      "integrity_level": "low",
      "started_at": "2025-09-10 23:54:01"
    },
    {
      "id": 529,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 52105,
      "integrity_level": "medium",
      "started_at": "2025-09-12 21:11:11"
    },
    {
      "id": 530,
      "session_id": 59,
      "endpoint_id": 2,
      "parent_pid": 3499,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 46255,
      "integrity_level": "medium",
      "started_at": "2025-09-09 00:55:37"
    },
    {
      "id": 531,
      "session_id": 68,
      "endpoint_id": 26,
      "parent_pid": 3905,
      "launch_chain_id": 15,
      "process_name": "powershell.exe",
      "child_process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 56848,
      "integrity_level": "medium",
      "started_at": "2025-09-08 17:34:41"
    },
    {
      "id": 532,
      "session_id": 16,
      "endpoint_id": 11,
      "parent_pid": 5993,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27202,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:06:30"
    },
    {
      "id": 533,
      "session_id": 80,
      "endpoint_id": 1,
      "parent_pid": 5566,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 44023,
      "integrity_level": "high",
      "started_at": "2025-09-10 16:40:11"
    },
    {
      "id": 534,
      "session_id": 111,
      "endpoint_id": 25,
      "parent_pid": 4893,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63803,
      "integrity_level": "medium",
      "started_at": "2025-09-11 10:29:49"
    },
    {
      "id": 535,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 12,
      "process_name": "excel.exe",
      "child_process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 12682,
      "integrity_level": "medium",
      "started_at": "2025-09-13 00:00:14"
    },
    {
      "id": 536,
      "session_id": 109,
      "endpoint_id": 1,
      "parent_pid": 9809,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37531,
      "integrity_level": "medium",
      "started_at": "2025-09-09 15:26:14"
    },
    {
      "id": 537,
      "session_id": 37,
      "endpoint_id": 2,
      "parent_pid": 2950,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40163,
      "integrity_level": "medium",
      "started_at": "2025-09-11 22:27:18"
    },
    {
      "id": 538,
      "session_id": 47,
      "endpoint_id": 30,
      "parent_pid": 8438,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 3478,
      "integrity_level": "low",
      "started_at": "2025-09-10 18:02:33"
    },
    {
      "id": 539,
      "session_id": 29,
      "endpoint_id": 30,
      "parent_pid": 4443,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 38696,
      "integrity_level": "low",
      "started_at": "2025-09-10 20:19:48"
    },
    {
      "id": 540,
      "session_id": 55,
      "endpoint_id": 19,
      "parent_pid": 4258,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18596,
      "integrity_level": "medium",
      "started_at": "2025-09-09 13:13:26"
    },
    {
      "id": 541,
      "session_id": 61,
      "endpoint_id": 29,
      "parent_pid": 6985,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 50925,
      "integrity_level": "low",
      "started_at": "2025-09-11 15:23:35"
    },
    {
      "id": 542,
      "session_id": 18,
      "endpoint_id": 19,
      "parent_pid": 5353,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42031,
      "integrity_level": "medium",
      "started_at": "2025-09-09 14:58:31"
    },
    {
      "id": 543,
      "session_id": 110,
      "endpoint_id": 5,
      "parent_pid": 4857,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 14472,
      "integrity_level": "high",
      "started_at": "2025-09-10 16:56:47"
    },
    {
      "id": 544,
      "session_id": 9,
      "endpoint_id": 14,
      "parent_pid": 5882,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 56307,
      "integrity_level": "high",
      "started_at": "2025-09-08 21:16:54"
    },
    {
      "id": 545,
      "session_id": 76,
      "endpoint_id": 17,
      "parent_pid": 7760,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17648,
      "integrity_level": "medium",
      "started_at": "2025-09-11 15:25:05"
    },
    {
      "id": 546,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21296,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:05:32"
    },
    {
      "id": 547,
      "session_id": 31,
      "endpoint_id": 17,
      "parent_pid": 9042,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 20376,
      "integrity_level": "high",
      "started_at": "2025-09-11 12:44:33"
    },
    {
      "id": 548,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26369,
      "integrity_level": "medium",
      "started_at": "2025-09-10 19:18:04"
    },
    {
      "id": 549,
      "session_id": 99,
      "endpoint_id": 9,
      "parent_pid": 8717,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54109,
      "integrity_level": "medium",
      "started_at": "2025-09-08 22:52:45"
    },
    {
      "id": 550,
      "session_id": 11,
      "endpoint_id": 7,
      "parent_pid": 2105,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33263,
      "integrity_level": "medium",
      "started_at": "2025-09-12 17:15:29"
    },
    {
      "id": 551,
      "session_id": 118,
      "endpoint_id": 18,
      "parent_pid": 4211,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42543,
      "integrity_level": "medium",
      "started_at": "2025-09-11 00:02:57"
    },
    {
      "id": 552,
      "session_id": 115,
      "endpoint_id": 28,
      "parent_pid": 6071,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58514,
      "integrity_level": "medium",
      "started_at": "2025-09-12 13:59:04"
    },
    {
      "id": 553,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 850,
      "integrity_level": "low",
      "started_at": "2025-09-13 00:42:00"
    },
    {
      "id": 554,
      "session_id": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 2524,
      "integrity_level": "low",
      "started_at": "2025-09-09 14:54:43"
    },
    {
      "id": 555,
      "session_id": 4,
      "endpoint_id": 10,
      "parent_pid": 9279,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9809,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:58:53"
    },
    {
      "id": 556,
      "session_id": 93,
      "endpoint_id": 1,
      "parent_pid": 9342,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 44299,
      "integrity_level": "low",
      "started_at": "2025-09-10 19:23:29"
    },
    {
      "id": 557,
      "session_id": 19,
      "endpoint_id": 30,
      "parent_pid": 5838,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51424,
      "integrity_level": "low",
      "started_at": "2025-09-12 04:18:54"
    },
    {
      "id": 558,
      "session_id": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57792,
      "integrity_level": "medium",
      "started_at": "2025-09-12 14:08:11"
    },
    {
      "id": 559,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 8,
      "process_name": "explorer.exe",
      "child_process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 45335,
      "integrity_level": "low",
      "started_at": "2025-09-12 20:21:17"
    },
    {
      "id": 560,
      "session_id": 20,
      "endpoint_id": 12,
      "parent_pid": 2248,
      "launch_chain_id": 5,
      "process_name": "code.exe",
      "child_process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18770,
      "integrity_level": "medium",
      "started_at": "2025-09-13 01:57:40"
    },
    {
      "id": 561,
      "session_id": 2,
      "endpoint_id": 16,
      "parent_pid": 9253,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 31827,
      "integrity_level": "medium",
      "started_at": "2025-09-12 20:33:08"
    },
    {
      "id": 562,
      "session_id": 51,
      "endpoint_id": 24,
      "parent_pid": 3525,
      "launch_chain_id": 3,
      "process_name": "winword.exe",
      "child_process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58496,
      "integrity_level": "high",
      "started_at": "2025-09-08 17:27:59"
    },
    {
      "id": 563,
      "session_id": 62,
      "endpoint_id": 14,
      "parent_pid": 5166,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62900,
      "integrity_level": "medium",
      "started_at": "2025-09-10 15:55:33"
    },
    {
      "id": 564,
      "session_id": 79,
      "endpoint_id": 24,
      "parent_pid": 1688,
      "launch_chain_id": 4,
      "process_name": "excel.exe",
      "child_process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20441,
      "integrity_level": "medium",
      "started_at": "2025-09-09 15:38:40"
    },
    {
      "id": 565,
      "session_id": 77,
      "endpoint_id": 11,
      "parent_pid": 6081,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59866,
      "integrity_level": "medium",
      "started_at": "2025-09-12 14:43:13"
    },
    {
      "id": 566,
      "session_id": 114,
      "endpoint_id": 26,
      "parent_pid": 1599,
      "launch_chain_id": 6,
      "process_name": "outlook.exe",
      "child_process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 18059,
      "integrity_level": "medium",
      "started_at": "2025-09-08 16:35:19"
    },
    {
      "id": 567,
      "session_id": 1,
      "endpoint_id": 30,
      "parent_pid": 1223,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 25903,
      "integrity_level": "low",
      "started_at": "2025-09-10 19:52:11"
    },
    {
      "id": 568,
      "session_id": 128,
      "endpoint_id": 10,
      "parent_pid": 3770,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2260,
      "integrity_level": "medium",
      "started_at": "2025-09-09 15:49:19"
    },
    {
      "id": 569,
      "session_id": 74,
      "endpoint_id": 8,
      "parent_pid": 8020,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10941,
      "integrity_level": "low",
      "started_at": "2025-09-11 19:03:32"
    },
    {
      "id": 570,
      "session_id": 112,
      "endpoint_id": 3,
      "parent_pid": 8684,
      "launch_chain_id": 9,
      "process_name": "cmd.exe",
      "child_process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 37692,
      "integrity_level": "high",
      "started_at": "2025-09-11 22:49:28"
    },
    {
      "id": 571,
      "session_id": 24,
      "endpoint_id": 11,
      "parent_pid": 4927,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7435,
      "integrity_level": "medium",
      "started_at": "2025-09-13 01:11:41"
    },
    {
      "id": 572,
      "session_id": 103,
      "endpoint_id": 13,
      "parent_pid": 3347,
      "launch_chain_id": 10,
      "process_name": "winword.exe",
      "child_process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 17893,
      "integrity_level": "medium",
      "started_at": "2025-09-09 19:05:26"
    },
    {
      "id": 573,
      "session_id": 132,
      "endpoint_id": 5,
      "parent_pid": 9527,
      "launch_chain_id": 7,
      "process_name": "teams.exe",
      "child_process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 28951,
      "integrity_level": "low",
      "started_at": "2025-09-11 18:29:02"
    },
    {
      "id": 574,
      "session_id": 46,
      "endpoint_id": 15,
      "parent_pid": 1692,
      "launch_chain_id": 13,
      "process_name": "cmd.exe",
      "child_process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 56518,
      "integrity_level": "medium",
      "started_at": "2025-09-12 22:58:34"
    },
    {
      "id": 575,
      "session_id": 64,
      "endpoint_id": 4,
      "parent_pid": 2187,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42950,
      "integrity_level": "low",
      "started_at": "2025-09-11 20:52:07"
    },
    {
      "id": 576,
      "session_id": 58,
      "endpoint_id": 7,
      "parent_pid": 5507,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9308,
      "integrity_level": "low",
      "started_at": "2025-09-09 19:14:37"
    },
    {
      "id": 577,
      "session_id": 116,
      "endpoint_id": 9,
      "parent_pid": 1596,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50253,
      "integrity_level": "medium",
      "started_at": "2025-09-10 13:56:34"
    },
    {
      "id": 578,
      "session_id": 49,
      "endpoint_id": 13,
      "parent_pid": 7754,
      "launch_chain_id": 2,
      "process_name": "chrome.exe",
      "child_process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37119,
      "integrity_level": "medium",
      "started_at": "2025-09-09 23:02:25"
    },
    {
      "id": 579,
      "session_id": 100,
      "endpoint_id": 13,
      "parent_pid": 4103,
      "launch_chain_id": 1,
      "process_name": "msedge.exe",
      "child_process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24394,
      "integrity_level": "high",
      "started_at": "2025-09-08 16:35:19"
    }
  ],
  "child_processes": [
    {
      "id": 1,
      "app_process_id": 419,
      "endpoint_id": 14,
      "parent_pid": 6165,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 8349,
      "command_source": "local_disk",
      "started_at": "2025-09-11 13:48:10"
    },
    {
      "id": 2,
      "app_process_id": 146,
      "endpoint_id": 15,
      "parent_pid": 25240,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32092,
      "command_source": "local_disk",
      "started_at": "2025-09-12 18:47:06"
    },
    {
      "id": 3,
      "app_process_id": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 41696,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 17:15:22"
    },
    {
      "id": 4,
      "app_process_id": 142,
      "endpoint_id": 17,
      "parent_pid": 53142,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57847,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:33:11"
    },
    {
      "id": 5,
      "app_process_id": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11652,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:40:41"
    },
    {
      "id": 6,
      "app_process_id": 438,
      "endpoint_id": 19,
      "parent_pid": 39388,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56438,
      "command_source": "local_disk",
      "started_at": "2025-09-09 22:20:17"
    },
    {
      "id": 7,
      "app_process_id": 250,
      "endpoint_id": 14,
      "parent_pid": 35738,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53327,
      "command_source": "user_profile",
      "started_at": "2025-09-09 09:27:16"
    },
    {
      "id": 8,
      "app_process_id": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 5608,
      "command_source": "user_profile",
      "started_at": "2025-09-11 23:31:47"
    },
    {
      "id": 9,
      "app_process_id": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 22059,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 17:38:40"
    },
    {
      "id": 10,
      "app_process_id": 454,
      "endpoint_id": 24,
      "parent_pid": 44332,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58536,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 17:25:47"
    },
    {
      "id": 11,
      "app_process_id": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 56489,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:34:51"
    },
    {
      "id": 12,
      "app_process_id": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 40588,
      "command_source": "network_path",
      "started_at": "2025-09-11 21:30:38"
    },
    {
      "id": 13,
      "app_process_id": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64348,
      "command_source": "network_path",
      "started_at": "2025-09-11 23:32:28"
    },
    {
      "id": 14,
      "app_process_id": 44,
      "endpoint_id": 28,
      "parent_pid": 34278,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30253,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:09:41"
    },
    {
      "id": 15,
      "app_process_id": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20465,
      "command_source": "local_disk",
      "started_at": "2025-09-11 08:59:48"
    },
    {
      "id": 16,
      "app_process_id": 262,
      "endpoint_id": 17,
      "parent_pid": 3605,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48987,
      "command_source": "local_disk",
      "started_at": "2025-09-09 18:36:36"
    },
    {
      "id": 17,
      "app_process_id": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 30439,
      "command_source": "local_disk",
      "started_at": "2025-09-11 21:32:12"
    },
    {
      "id": 18,
      "app_process_id": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17607,
      "command_source": "local_disk",
      "started_at": "2025-09-13 00:22:10"
    },
    {
      "id": 19,
      "app_process_id": 404,
      "endpoint_id": 1,
      "parent_pid": 1270,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 44864,
      "command_source": "local_disk",
      "started_at": "2025-09-09 15:56:36"
    },
    {
      "id": 20,
      "app_process_id": 280,
      "endpoint_id": 24,
      "parent_pid": 42237,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42362,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 15:05:32"
    },
    {
      "id": 21,
      "app_process_id": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11797,
      "command_source": "local_disk",
      "started_at": "2025-09-11 10:31:23"
    },
    {
      "id": 22,
      "app_process_id": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 11435,
      "command_source": "user_profile",
      "started_at": "2025-09-10 12:38:07"
    },
    {
      "id": 23,
      "app_process_id": 416,
      "endpoint_id": 2,
      "parent_pid": 64425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47384,
      "command_source": "local_disk",
      "started_at": "2025-09-11 21:26:21"
    },
    {
      "id": 24,
      "app_process_id": 489,
      "endpoint_id": 18,
      "parent_pid": 22003,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 33056,
      "command_source": "local_disk",
      "started_at": "2025-09-10 22:41:40"
    },
    {
      "id": 25,
      "app_process_id": 360,
      "endpoint_id": 16,
      "parent_pid": 2848,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 41048,
      "command_source": "local_disk",
      "started_at": "2025-09-12 18:07:11"
    },
    {
      "id": 26,
      "app_process_id": 104,
      "endpoint_id": 3,
      "parent_pid": 53814,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 24023,
      "command_source": "local_disk",
      "started_at": "2025-09-11 17:39:42"
    },
    {
      "id": 27,
      "app_process_id": 355,
      "endpoint_id": 19,
      "parent_pid": 12494,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 26192,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:37:26"
    },
    {
      "id": 28,
      "app_process_id": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 55130,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 16:24:52"
    },
    {
      "id": 29,
      "app_process_id": 56,
      "endpoint_id": 10,
      "parent_pid": 61151,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 22662,
      "command_source": "local_disk",
      "started_at": "2025-09-08 08:00:13"
    },
    {
      "id": 30,
      "app_process_id": 31,
      "endpoint_id": 1,
      "parent_pid": 14661,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63918,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 13:01:43"
    },
    {
      "id": 31,
      "app_process_id": 215,
      "endpoint_id": 26,
      "parent_pid": 39630,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 1795,
      "command_source": "local_disk",
      "started_at": "2025-09-09 12:09:29"
    },
    {
      "id": 32,
      "app_process_id": 192,
      "endpoint_id": 1,
      "parent_pid": 3940,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 50476,
      "command_source": "local_disk",
      "started_at": "2025-09-09 14:29:04"
    },
    {
      "id": 33,
      "app_process_id": 416,
      "endpoint_id": 2,
      "parent_pid": 64425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 23623,
      "command_source": "local_disk",
      "started_at": "2025-09-11 21:26:37"
    },
    {
      "id": 34,
      "app_process_id": 561,
      "endpoint_id": 16,
      "parent_pid": 31827,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 58601,
      "command_source": "local_disk",
      "started_at": "2025-09-12 20:33:41"
    },
    {
      "id": 35,
      "app_process_id": 52,
      "endpoint_id": 30,
      "parent_pid": 34765,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 42438,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:59:08"
    },
    {
      "id": 36,
      "app_process_id": 90,
      "endpoint_id": 14,
      "parent_pid": 62491,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16591,
      "command_source": "user_profile",
      "started_at": "2025-09-10 11:58:03"
    },
    {
      "id": 37,
      "app_process_id": 21,
      "endpoint_id": 29,
      "parent_pid": 33716,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28380,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 11:01:14"
    },
    {
      "id": 38,
      "app_process_id": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 48111,
      "command_source": "local_disk",
      "started_at": "2025-09-11 09:00:47"
    },
    {
      "id": 39,
      "app_process_id": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51314,
      "command_source": "user_profile",
      "started_at": "2025-09-09 12:32:31"
    },
    {
      "id": 40,
      "app_process_id": 3,
      "endpoint_id": 8,
      "parent_pid": 43396,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53442,
      "command_source": "local_disk",
      "started_at": "2025-09-12 11:23:34"
    },
    {
      "id": 41,
      "app_process_id": 490,
      "endpoint_id": 2,
      "parent_pid": 51639,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29964,
      "command_source": "local_disk",
      "started_at": "2025-09-08 23:38:03"
    },
    {
      "id": 42,
      "app_process_id": 152,
      "endpoint_id": 9,
      "parent_pid": 31558,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 15403,
      "command_source": "local_disk",
      "started_at": "2025-09-12 18:06:34"
    },
    {
      "id": 43,
      "app_process_id": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57013,
      "command_source": "user_profile",
      "started_at": "2025-09-10 19:29:12"
    },
    {
      "id": 44,
      "app_process_id": 195,
      "endpoint_id": 9,
      "parent_pid": 54269,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62735,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 18:22:10"
    },
    {
      "id": 45,
      "app_process_id": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22079,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 16:47:51"
    },
    {
      "id": 46,
      "app_process_id": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55298,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:03:49"
    },
    {
      "id": 47,
      "app_process_id": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48708,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:27:29"
    },
    {
      "id": 48,
      "app_process_id": 500,
      "endpoint_id": 11,
      "parent_pid": 56378,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 32335,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 23:38:14"
    },
    {
      "id": 49,
      "app_process_id": 10,
      "endpoint_id": 12,
      "parent_pid": 39319,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51816,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:08:49"
    },
    {
      "id": 50,
      "app_process_id": 88,
      "endpoint_id": 12,
      "parent_pid": 9701,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 19801,
      "command_source": "user_profile",
      "started_at": "2025-09-09 11:46:27"
    },
    {
      "id": 51,
      "app_process_id": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 62136,
      "command_source": "local_disk",
      "started_at": "2025-09-09 12:47:03"
    },
    {
      "id": 52,
      "app_process_id": 293,
      "endpoint_id": 1,
      "parent_pid": 46403,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40901,
      "command_source": "temp_folder",
      "started_at": "2025-09-13 01:02:51"
    },
    {
      "id": 53,
      "app_process_id": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5457,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:08:47"
    },
    {
      "id": 54,
      "app_process_id": 438,
      "endpoint_id": 19,
      "parent_pid": 39388,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43256,
      "command_source": "local_disk",
      "started_at": "2025-09-09 22:20:43"
    },
    {
      "id": 55,
      "app_process_id": 162,
      "endpoint_id": 29,
      "parent_pid": 4295,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 32472,
      "command_source": "user_profile",
      "started_at": "2025-09-11 13:33:52"
    },
    {
      "id": 56,
      "app_process_id": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 39507,
      "command_source": "network_path",
      "started_at": "2025-09-08 19:53:13"
    },
    {
      "id": 57,
      "app_process_id": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23633,
      "command_source": "user_profile",
      "started_at": "2025-09-09 15:57:09"
    },
    {
      "id": 58,
      "app_process_id": 543,
      "endpoint_id": 5,
      "parent_pid": 14472,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 10035,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:58:09"
    },
    {
      "id": 59,
      "app_process_id": 230,
      "endpoint_id": 19,
      "parent_pid": 40314,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 56323,
      "command_source": "local_disk",
      "started_at": "2025-09-12 10:35:35"
    },
    {
      "id": 60,
      "app_process_id": 284,
      "endpoint_id": 10,
      "parent_pid": 25670,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57665,
      "command_source": "local_disk",
      "started_at": "2025-09-08 10:21:24"
    },
    {
      "id": 61,
      "app_process_id": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 11673,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:42:35"
    },
    {
      "id": 62,
      "app_process_id": 385,
      "endpoint_id": 5,
      "parent_pid": 19298,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 32560,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 22:52:57"
    },
    {
      "id": 63,
      "app_process_id": 413,
      "endpoint_id": 18,
      "parent_pid": 15396,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 37668,
      "command_source": "user_profile",
      "started_at": "2025-09-10 21:29:58"
    },
    {
      "id": 64,
      "app_process_id": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19943,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:14:42"
    },
    {
      "id": 65,
      "app_process_id": 120,
      "endpoint_id": 15,
      "parent_pid": 29798,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34225,
      "command_source": "network_path",
      "started_at": "2025-09-08 15:15:58"
    },
    {
      "id": 66,
      "app_process_id": 349,
      "endpoint_id": 19,
      "parent_pid": 20688,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18561,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:30:39"
    },
    {
      "id": 67,
      "app_process_id": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19867,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:06:49"
    },
    {
      "id": 68,
      "app_process_id": 403,
      "endpoint_id": 10,
      "parent_pid": 37069,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 49014,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:15:36"
    },
    {
      "id": 69,
      "app_process_id": 261,
      "endpoint_id": 27,
      "parent_pid": 8522,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 55239,
      "command_source": "user_profile",
      "started_at": "2025-09-11 15:09:03"
    },
    {
      "id": 70,
      "app_process_id": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 48159,
      "command_source": "local_disk",
      "started_at": "2025-09-09 01:03:41"
    },
    {
      "id": 71,
      "app_process_id": 132,
      "endpoint_id": 10,
      "parent_pid": 54687,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53544,
      "command_source": "local_disk",
      "started_at": "2025-09-08 09:34:22"
    },
    {
      "id": 72,
      "app_process_id": 95,
      "endpoint_id": 5,
      "parent_pid": 6543,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 19550,
      "command_source": "user_profile",
      "started_at": "2025-09-10 17:51:08"
    },
    {
      "id": 73,
      "app_process_id": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 41382,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:12:29"
    },
    {
      "id": 74,
      "app_process_id": 341,
      "endpoint_id": 14,
      "parent_pid": 28515,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62547,
      "command_source": "user_profile",
      "started_at": "2025-09-11 12:07:33"
    },
    {
      "id": 75,
      "app_process_id": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32784,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:57:57"
    },
    {
      "id": 76,
      "app_process_id": 414,
      "endpoint_id": 12,
      "parent_pid": 61129,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 4981,
      "command_source": "network_path",
      "started_at": "2025-09-09 18:44:40"
    },
    {
      "id": 77,
      "app_process_id": 191,
      "endpoint_id": 18,
      "parent_pid": 7221,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 2424,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:47:15"
    },
    {
      "id": 78,
      "app_process_id": 330,
      "endpoint_id": 19,
      "parent_pid": 3831,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50028,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 21:58:54"
    },
    {
      "id": 79,
      "app_process_id": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 59197,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:13:18"
    },
    {
      "id": 80,
      "app_process_id": 322,
      "endpoint_id": 18,
      "parent_pid": 45116,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1197,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:52:49"
    },
    {
      "id": 81,
      "app_process_id": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20666,
      "command_source": "user_profile",
      "started_at": "2025-09-11 20:08:16"
    },
    {
      "id": 82,
      "app_process_id": 127,
      "endpoint_id": 15,
      "parent_pid": 54190,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16153,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:24:08"
    },
    {
      "id": 83,
      "app_process_id": 413,
      "endpoint_id": 18,
      "parent_pid": 15396,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 35845,
      "command_source": "local_disk",
      "started_at": "2025-09-10 21:31:00"
    },
    {
      "id": 84,
      "app_process_id": 156,
      "endpoint_id": 22,
      "parent_pid": 8336,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32720,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:17:49"
    },
    {
      "id": 85,
      "app_process_id": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24093,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:30:29"
    },
    {
      "id": 86,
      "app_process_id": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 12517,
      "command_source": "local_disk",
      "started_at": "2025-09-11 22:24:29"
    },
    {
      "id": 87,
      "app_process_id": 380,
      "endpoint_id": 26,
      "parent_pid": 16118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6205,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 11:36:15"
    },
    {
      "id": 88,
      "app_process_id": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 47945,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:03:22"
    },
    {
      "id": 89,
      "app_process_id": 163,
      "endpoint_id": 9,
      "parent_pid": 49369,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 25132,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:35:09"
    },
    {
      "id": 90,
      "app_process_id": 288,
      "endpoint_id": 30,
      "parent_pid": 43147,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60299,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 01:07:01"
    },
    {
      "id": 91,
      "app_process_id": 332,
      "endpoint_id": 8,
      "parent_pid": 14407,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 12847,
      "command_source": "local_disk",
      "started_at": "2025-09-12 12:33:49"
    },
    {
      "id": 92,
      "app_process_id": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27929,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:48:13"
    },
    {
      "id": 93,
      "app_process_id": 563,
      "endpoint_id": 14,
      "parent_pid": 62900,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 58209,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:57:04"
    },
    {
      "id": 94,
      "app_process_id": 518,
      "endpoint_id": 17,
      "parent_pid": 39724,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 13723,
      "command_source": "local_disk",
      "started_at": "2025-09-09 20:42:26"
    },
    {
      "id": 95,
      "app_process_id": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 27509,
      "command_source": "user_profile",
      "started_at": "2025-09-09 15:57:47"
    },
    {
      "id": 96,
      "app_process_id": 451,
      "endpoint_id": 22,
      "parent_pid": 18454,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45475,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:39:59"
    },
    {
      "id": 97,
      "app_process_id": 160,
      "endpoint_id": 12,
      "parent_pid": 46776,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 36668,
      "command_source": "user_profile",
      "started_at": "2025-09-09 12:12:05"
    },
    {
      "id": 98,
      "app_process_id": 71,
      "endpoint_id": 14,
      "parent_pid": 20163,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 28025,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 10:24:04"
    },
    {
      "id": 99,
      "app_process_id": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21572,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:35:49"
    },
    {
      "id": 100,
      "app_process_id": 355,
      "endpoint_id": 19,
      "parent_pid": 12494,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 35449,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:38:20"
    },
    {
      "id": 101,
      "app_process_id": 175,
      "endpoint_id": 15,
      "parent_pid": 45523,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42582,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 19:14:55"
    },
    {
      "id": 102,
      "app_process_id": 210,
      "endpoint_id": 2,
      "parent_pid": 28766,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42752,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:29:44"
    },
    {
      "id": 103,
      "app_process_id": 477,
      "endpoint_id": 5,
      "parent_pid": 7825,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 37925,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:38:08"
    },
    {
      "id": 104,
      "app_process_id": 384,
      "endpoint_id": 14,
      "parent_pid": 59974,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 58288,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:52:17"
    },
    {
      "id": 105,
      "app_process_id": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44465,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:48:57"
    },
    {
      "id": 106,
      "app_process_id": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58533,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:30:15"
    },
    {
      "id": 107,
      "app_process_id": 167,
      "endpoint_id": 5,
      "parent_pid": 5361,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 14190,
      "command_source": "local_disk",
      "started_at": "2025-09-10 20:02:00"
    },
    {
      "id": 108,
      "app_process_id": 23,
      "endpoint_id": 29,
      "parent_pid": 21327,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14242,
      "command_source": "local_disk",
      "started_at": "2025-09-11 10:16:42"
    },
    {
      "id": 109,
      "app_process_id": 254,
      "endpoint_id": 18,
      "parent_pid": 56120,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15299,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:46:37"
    },
    {
      "id": 110,
      "app_process_id": 535,
      "endpoint_id": 11,
      "parent_pid": 12682,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 58444,
      "command_source": "local_disk",
      "started_at": "2025-09-13 00:01:31"
    },
    {
      "id": 111,
      "app_process_id": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 18087,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:25:27"
    },
    {
      "id": 112,
      "app_process_id": 21,
      "endpoint_id": 29,
      "parent_pid": 33716,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63700,
      "command_source": "user_profile",
      "started_at": "2025-09-11 11:02:20"
    },
    {
      "id": 113,
      "app_process_id": 231,
      "endpoint_id": 30,
      "parent_pid": 54292,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62647,
      "command_source": "user_profile",
      "started_at": "2025-09-10 15:57:25"
    },
    {
      "id": 114,
      "app_process_id": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 18970,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 18:13:59"
    },
    {
      "id": 115,
      "app_process_id": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 57332,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:11:55"
    },
    {
      "id": 116,
      "app_process_id": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 62514,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:28:34"
    },
    {
      "id": 117,
      "app_process_id": 389,
      "endpoint_id": 23,
      "parent_pid": 1834,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 57982,
      "command_source": "user_profile",
      "started_at": "2025-09-10 18:30:24"
    },
    {
      "id": 118,
      "app_process_id": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34309,
      "command_source": "local_disk",
      "started_at": "2025-09-08 21:17:42"
    },
    {
      "id": 119,
      "app_process_id": 125,
      "endpoint_id": 15,
      "parent_pid": 54123,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 2794,
      "command_source": "local_disk",
      "started_at": "2025-09-08 15:19:19"
    },
    {
      "id": 120,
      "app_process_id": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 42642,
      "command_source": "network_path",
      "started_at": "2025-09-13 00:14:33"
    },
    {
      "id": 121,
      "app_process_id": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32063,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:35:20"
    },
    {
      "id": 122,
      "app_process_id": 550,
      "endpoint_id": 7,
      "parent_pid": 33263,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59623,
      "command_source": "user_profile",
      "started_at": "2025-09-12 17:16:08"
    },
    {
      "id": 123,
      "app_process_id": 163,
      "endpoint_id": 9,
      "parent_pid": 49369,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 39980,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:36:10"
    },
    {
      "id": 124,
      "app_process_id": 540,
      "endpoint_id": 19,
      "parent_pid": 18596,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23120,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:13:45"
    },
    {
      "id": 125,
      "app_process_id": 155,
      "endpoint_id": 11,
      "parent_pid": 1398,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46351,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:41:49"
    },
    {
      "id": 126,
      "app_process_id": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28540,
      "command_source": "local_disk",
      "started_at": "2025-09-11 22:25:03"
    },
    {
      "id": 127,
      "app_process_id": 153,
      "endpoint_id": 1,
      "parent_pid": 61558,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 31826,
      "command_source": "local_disk",
      "started_at": "2025-09-08 21:43:32"
    },
    {
      "id": 128,
      "app_process_id": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13658,
      "command_source": "user_profile",
      "started_at": "2025-09-13 00:29:40"
    },
    {
      "id": 129,
      "app_process_id": 505,
      "endpoint_id": 6,
      "parent_pid": 53794,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9870,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:15:45"
    },
    {
      "id": 130,
      "app_process_id": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41911,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 17:54:08"
    },
    {
      "id": 131,
      "app_process_id": 161,
      "endpoint_id": 13,
      "parent_pid": 38072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57241,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:46:52"
    },
    {
      "id": 132,
      "app_process_id": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41698,
      "command_source": "network_path",
      "started_at": "2025-09-09 13:29:43"
    },
    {
      "id": 133,
      "app_process_id": 262,
      "endpoint_id": 17,
      "parent_pid": 3605,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 27298,
      "command_source": "local_disk",
      "started_at": "2025-09-09 18:38:37"
    },
    {
      "id": 134,
      "app_process_id": 257,
      "endpoint_id": 11,
      "parent_pid": 17170,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18349,
      "command_source": "local_disk",
      "started_at": "2025-09-12 17:31:49"
    },
    {
      "id": 135,
      "app_process_id": 410,
      "endpoint_id": 14,
      "parent_pid": 52011,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 57872,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:57:04"
    },
    {
      "id": 136,
      "app_process_id": 480,
      "endpoint_id": 10,
      "parent_pid": 62992,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42078,
      "command_source": "user_profile",
      "started_at": "2025-09-10 15:32:56"
    },
    {
      "id": 137,
      "app_process_id": 393,
      "endpoint_id": 1,
      "parent_pid": 15421,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 55647,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:34:59"
    },
    {
      "id": 138,
      "app_process_id": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 22649,
      "command_source": "user_profile",
      "started_at": "2025-09-13 00:31:01"
    },
    {
      "id": 139,
      "app_process_id": 229,
      "endpoint_id": 15,
      "parent_pid": 27407,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53469,
      "command_source": "local_disk",
      "started_at": "2025-09-08 18:07:59"
    },
    {
      "id": 140,
      "app_process_id": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 4189,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:57:37"
    },
    {
      "id": 141,
      "app_process_id": 520,
      "endpoint_id": 1,
      "parent_pid": 57289,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 21334,
      "command_source": "local_disk",
      "started_at": "2025-09-10 18:36:43"
    },
    {
      "id": 142,
      "app_process_id": 316,
      "endpoint_id": 9,
      "parent_pid": 64565,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 15003,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 13:08:25"
    },
    {
      "id": 143,
      "app_process_id": 154,
      "endpoint_id": 2,
      "parent_pid": 57288,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59509,
      "command_source": "network_path",
      "started_at": "2025-09-08 12:07:42"
    },
    {
      "id": 144,
      "app_process_id": 531,
      "endpoint_id": 26,
      "parent_pid": 56848,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 30252,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:35:49"
    },
    {
      "id": 145,
      "app_process_id": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48637,
      "command_source": "user_profile",
      "started_at": "2025-09-10 13:59:10"
    },
    {
      "id": 146,
      "app_process_id": 378,
      "endpoint_id": 22,
      "parent_pid": 14900,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 37072,
      "command_source": "local_disk",
      "started_at": "2025-09-08 13:42:25"
    },
    {
      "id": 147,
      "app_process_id": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 49679,
      "command_source": "user_profile",
      "started_at": "2025-09-09 17:39:53"
    },
    {
      "id": 148,
      "app_process_id": 267,
      "endpoint_id": 2,
      "parent_pid": 37820,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 23922,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:13:23"
    },
    {
      "id": 149,
      "app_process_id": 496,
      "endpoint_id": 17,
      "parent_pid": 28484,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5767,
      "command_source": "local_disk",
      "started_at": "2025-09-09 20:22:46"
    },
    {
      "id": 150,
      "app_process_id": 4,
      "endpoint_id": 10,
      "parent_pid": 13733,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45620,
      "command_source": "user_profile",
      "started_at": "2025-09-10 13:41:53"
    },
    {
      "id": 151,
      "app_process_id": 253,
      "endpoint_id": 2,
      "parent_pid": 55668,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 42773,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:40:58"
    },
    {
      "id": 152,
      "app_process_id": 450,
      "endpoint_id": 3,
      "parent_pid": 52592,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 32316,
      "command_source": "local_disk",
      "started_at": "2025-09-11 22:29:48"
    },
    {
      "id": 153,
      "app_process_id": 371,
      "endpoint_id": 12,
      "parent_pid": 36076,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 39357,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:41:43"
    },
    {
      "id": 154,
      "app_process_id": 325,
      "endpoint_id": 30,
      "parent_pid": 20469,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32301,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:24:05"
    },
    {
      "id": 155,
      "app_process_id": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 3432,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:59:12"
    },
    {
      "id": 156,
      "app_process_id": 260,
      "endpoint_id": 2,
      "parent_pid": 12286,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 35571,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 13:50:21"
    },
    {
      "id": 157,
      "app_process_id": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59399,
      "command_source": "network_path",
      "started_at": "2025-09-11 18:59:49"
    },
    {
      "id": 158,
      "app_process_id": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50455,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 14:24:54"
    },
    {
      "id": 159,
      "app_process_id": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20820,
      "command_source": "network_path",
      "started_at": "2025-09-13 00:23:20"
    },
    {
      "id": 160,
      "app_process_id": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22164,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:00:54"
    },
    {
      "id": 161,
      "app_process_id": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51929,
      "command_source": "network_path",
      "started_at": "2025-09-09 13:16:51"
    },
    {
      "id": 162,
      "app_process_id": 312,
      "endpoint_id": 11,
      "parent_pid": 58917,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22010,
      "command_source": "local_disk",
      "started_at": "2025-09-12 12:14:37"
    },
    {
      "id": 163,
      "app_process_id": 52,
      "endpoint_id": 30,
      "parent_pid": 34765,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 4275,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:59:51"
    },
    {
      "id": 164,
      "app_process_id": 65,
      "endpoint_id": 30,
      "parent_pid": 32057,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2699,
      "command_source": "local_disk",
      "started_at": "2025-09-11 22:25:49"
    },
    {
      "id": 165,
      "app_process_id": 319,
      "endpoint_id": 5,
      "parent_pid": 9012,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7656,
      "command_source": "user_profile",
      "started_at": "2025-09-09 14:34:38"
    },
    {
      "id": 166,
      "app_process_id": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49010,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:19:05"
    },
    {
      "id": 167,
      "app_process_id": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51826,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:48:21"
    },
    {
      "id": 168,
      "app_process_id": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 5536,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:34:41"
    },
    {
      "id": 169,
      "app_process_id": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11749,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 12:33:51"
    },
    {
      "id": 170,
      "app_process_id": 145,
      "endpoint_id": 2,
      "parent_pid": 11876,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 3164,
      "command_source": "user_profile",
      "started_at": "2025-09-10 12:24:14"
    },
    {
      "id": 171,
      "app_process_id": 455,
      "endpoint_id": 8,
      "parent_pid": 28274,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 61064,
      "command_source": "network_path",
      "started_at": "2025-09-11 20:52:00"
    },
    {
      "id": 172,
      "app_process_id": 1,
      "endpoint_id": 5,
      "parent_pid": 59762,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 21300,
      "command_source": "local_disk",
      "started_at": "2025-09-10 11:51:32"
    },
    {
      "id": 173,
      "app_process_id": 108,
      "endpoint_id": 12,
      "parent_pid": 25979,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 61855,
      "command_source": "local_disk",
      "started_at": "2025-09-12 20:37:09"
    },
    {
      "id": 174,
      "app_process_id": 335,
      "endpoint_id": 16,
      "parent_pid": 48395,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56733,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 16:51:01"
    },
    {
      "id": 175,
      "app_process_id": 299,
      "endpoint_id": 5,
      "parent_pid": 40090,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 48172,
      "command_source": "user_profile",
      "started_at": "2025-09-10 14:55:48"
    },
    {
      "id": 176,
      "app_process_id": 59,
      "endpoint_id": 30,
      "parent_pid": 53339,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 53100,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 18:32:17"
    },
    {
      "id": 177,
      "app_process_id": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55169,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:51:32"
    },
    {
      "id": 178,
      "app_process_id": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 28119,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:36:45"
    },
    {
      "id": 179,
      "app_process_id": 441,
      "endpoint_id": 17,
      "parent_pid": 56072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 16208,
      "command_source": "local_disk",
      "started_at": "2025-09-08 23:52:58"
    },
    {
      "id": 180,
      "app_process_id": 486,
      "endpoint_id": 12,
      "parent_pid": 44392,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34061,
      "command_source": "local_disk",
      "started_at": "2025-09-13 00:25:03"
    },
    {
      "id": 181,
      "app_process_id": 433,
      "endpoint_id": 8,
      "parent_pid": 49560,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40639,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 20:17:39"
    },
    {
      "id": 182,
      "app_process_id": 420,
      "endpoint_id": 27,
      "parent_pid": 47194,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 8820,
      "command_source": "user_profile",
      "started_at": "2025-09-11 17:04:11"
    },
    {
      "id": 183,
      "app_process_id": 8,
      "endpoint_id": 9,
      "parent_pid": 27161,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25934,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 16:48:30"
    },
    {
      "id": 184,
      "app_process_id": 430,
      "endpoint_id": 29,
      "parent_pid": 14673,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47191,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 12:50:05"
    },
    {
      "id": 185,
      "app_process_id": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50340,
      "command_source": "local_disk",
      "started_at": "2025-09-12 14:26:38"
    },
    {
      "id": 186,
      "app_process_id": 241,
      "endpoint_id": 10,
      "parent_pid": 32223,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30415,
      "command_source": "local_disk",
      "started_at": "2025-09-09 14:09:13"
    },
    {
      "id": 187,
      "app_process_id": 564,
      "endpoint_id": 24,
      "parent_pid": 20441,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14955,
      "command_source": "local_disk",
      "started_at": "2025-09-09 15:39:37"
    },
    {
      "id": 188,
      "app_process_id": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 36612,
      "command_source": "local_disk",
      "started_at": "2025-09-10 20:10:02"
    },
    {
      "id": 189,
      "app_process_id": 449,
      "endpoint_id": 6,
      "parent_pid": 7351,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 42612,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:28:41"
    },
    {
      "id": 190,
      "app_process_id": 354,
      "endpoint_id": 8,
      "parent_pid": 42988,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 47393,
      "command_source": "local_disk",
      "started_at": "2025-09-08 13:26:35"
    },
    {
      "id": 191,
      "app_process_id": 62,
      "endpoint_id": 30,
      "parent_pid": 13633,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 26603,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:26:54"
    },
    {
      "id": 192,
      "app_process_id": 576,
      "endpoint_id": 7,
      "parent_pid": 9308,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 63629,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 19:15:30"
    },
    {
      "id": 193,
      "app_process_id": 225,
      "endpoint_id": 19,
      "parent_pid": 60709,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51651,
      "command_source": "user_profile",
      "started_at": "2025-09-09 11:46:11"
    },
    {
      "id": 194,
      "app_process_id": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 50831,
      "command_source": "local_disk",
      "started_at": "2025-09-12 11:07:19"
    },
    {
      "id": 195,
      "app_process_id": 164,
      "endpoint_id": 13,
      "parent_pid": 44115,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14436,
      "command_source": "local_disk",
      "started_at": "2025-09-09 18:19:39"
    },
    {
      "id": 196,
      "app_process_id": 565,
      "endpoint_id": 11,
      "parent_pid": 59866,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53258,
      "command_source": "user_profile",
      "started_at": "2025-09-12 14:44:25"
    },
    {
      "id": 197,
      "app_process_id": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 51841,
      "command_source": "network_path",
      "started_at": "2025-09-09 20:18:25"
    },
    {
      "id": 198,
      "app_process_id": 232,
      "endpoint_id": 2,
      "parent_pid": 32167,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26563,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:35:12"
    },
    {
      "id": 199,
      "app_process_id": 23,
      "endpoint_id": 29,
      "parent_pid": 21327,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9025,
      "command_source": "user_profile",
      "started_at": "2025-09-11 10:17:50"
    },
    {
      "id": 200,
      "app_process_id": 139,
      "endpoint_id": 27,
      "parent_pid": 13534,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62314,
      "command_source": "local_disk",
      "started_at": "2025-09-11 13:44:52"
    },
    {
      "id": 201,
      "app_process_id": 398,
      "endpoint_id": 12,
      "parent_pid": 31853,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52141,
      "command_source": "local_disk",
      "started_at": "2025-09-12 22:47:59"
    },
    {
      "id": 202,
      "app_process_id": 437,
      "endpoint_id": 5,
      "parent_pid": 45963,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49554,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:57:46"
    },
    {
      "id": 203,
      "app_process_id": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41894,
      "command_source": "user_profile",
      "started_at": "2025-09-08 16:57:17"
    },
    {
      "id": 204,
      "app_process_id": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 51038,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:16:43"
    },
    {
      "id": 205,
      "app_process_id": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18956,
      "command_source": "user_profile",
      "started_at": "2025-09-11 12:30:39"
    },
    {
      "id": 206,
      "app_process_id": 432,
      "endpoint_id": 20,
      "parent_pid": 58174,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 64523,
      "command_source": "local_disk",
      "started_at": "2025-09-08 18:51:09"
    },
    {
      "id": 207,
      "app_process_id": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 63233,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:14:53"
    },
    {
      "id": 208,
      "app_process_id": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 31548,
      "command_source": "local_disk",
      "started_at": "2025-09-08 15:43:08"
    },
    {
      "id": 209,
      "app_process_id": 204,
      "endpoint_id": 24,
      "parent_pid": 15665,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 20424,
      "command_source": "local_disk",
      "started_at": "2025-09-08 10:51:35"
    },
    {
      "id": 210,
      "app_process_id": 546,
      "endpoint_id": 15,
      "parent_pid": 21296,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60117,
      "command_source": "local_disk",
      "started_at": "2025-09-12 22:06:35"
    },
    {
      "id": 211,
      "app_process_id": 530,
      "endpoint_id": 2,
      "parent_pid": 46255,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47334,
      "command_source": "local_disk",
      "started_at": "2025-09-09 00:57:00"
    },
    {
      "id": 212,
      "app_process_id": 314,
      "endpoint_id": 17,
      "parent_pid": 7325,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 35275,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 19:20:51"
    },
    {
      "id": 213,
      "app_process_id": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1164,
      "command_source": "local_disk",
      "started_at": "2025-09-12 00:52:40"
    },
    {
      "id": 214,
      "app_process_id": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60294,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 13:58:36"
    },
    {
      "id": 215,
      "app_process_id": 380,
      "endpoint_id": 26,
      "parent_pid": 16118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 38785,
      "command_source": "local_disk",
      "started_at": "2025-09-08 11:36:42"
    },
    {
      "id": 216,
      "app_process_id": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9359,
      "command_source": "local_disk",
      "started_at": "2025-09-10 12:39:10"
    },
    {
      "id": 217,
      "app_process_id": 458,
      "endpoint_id": 9,
      "parent_pid": 33005,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32321,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:51:21"
    },
    {
      "id": 218,
      "app_process_id": 12,
      "endpoint_id": 8,
      "parent_pid": 52296,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 20052,
      "command_source": "local_disk",
      "started_at": "2025-09-11 14:10:44"
    },
    {
      "id": 219,
      "app_process_id": 554,
      "endpoint_id": 24,
      "parent_pid": 2524,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 9205,
      "command_source": "local_disk",
      "started_at": "2025-09-09 14:55:09"
    },
    {
      "id": 220,
      "app_process_id": 464,
      "endpoint_id": 1,
      "parent_pid": 16918,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40999,
      "command_source": "user_profile",
      "started_at": "2025-09-08 17:29:39"
    },
    {
      "id": 221,
      "app_process_id": 264,
      "endpoint_id": 17,
      "parent_pid": 6071,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 25061,
      "command_source": "user_profile",
      "started_at": "2025-09-11 14:55:25"
    },
    {
      "id": 222,
      "app_process_id": 451,
      "endpoint_id": 22,
      "parent_pid": 18454,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 44563,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:41:21"
    },
    {
      "id": 223,
      "app_process_id": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 27781,
      "command_source": "user_profile",
      "started_at": "2025-09-09 12:47:48"
    },
    {
      "id": 224,
      "app_process_id": 443,
      "endpoint_id": 29,
      "parent_pid": 7017,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 14180,
      "command_source": "local_disk",
      "started_at": "2025-09-11 14:11:49"
    },
    {
      "id": 225,
      "app_process_id": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 30097,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 13:02:16"
    },
    {
      "id": 226,
      "app_process_id": 420,
      "endpoint_id": 27,
      "parent_pid": 47194,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 24640,
      "command_source": "network_path",
      "started_at": "2025-09-11 17:05:24"
    },
    {
      "id": 227,
      "app_process_id": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 55244,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 12:15:23"
    },
    {
      "id": 228,
      "app_process_id": 388,
      "endpoint_id": 29,
      "parent_pid": 29144,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22005,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:01:43"
    },
    {
      "id": 229,
      "app_process_id": 377,
      "endpoint_id": 8,
      "parent_pid": 27111,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 30427,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:54:05"
    },
    {
      "id": 230,
      "app_process_id": 32,
      "endpoint_id": 6,
      "parent_pid": 6449,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22511,
      "command_source": "network_path",
      "started_at": "2025-09-10 12:39:59"
    },
    {
      "id": 231,
      "app_process_id": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 31301,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:16:28"
    },
    {
      "id": 232,
      "app_process_id": 567,
      "endpoint_id": 30,
      "parent_pid": 25903,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 32355,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:53:31"
    },
    {
      "id": 233,
      "app_process_id": 92,
      "endpoint_id": 4,
      "parent_pid": 49989,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 38098,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:14:27"
    },
    {
      "id": 234,
      "app_process_id": 71,
      "endpoint_id": 14,
      "parent_pid": 20163,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 29804,
      "command_source": "local_disk",
      "started_at": "2025-09-11 10:24:24"
    },
    {
      "id": 235,
      "app_process_id": 437,
      "endpoint_id": 5,
      "parent_pid": 45963,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1654,
      "command_source": "user_profile",
      "started_at": "2025-09-10 14:59:46"
    },
    {
      "id": 236,
      "app_process_id": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 21573,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:41:00"
    },
    {
      "id": 237,
      "app_process_id": 197,
      "endpoint_id": 26,
      "parent_pid": 39816,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32565,
      "command_source": "local_disk",
      "started_at": "2025-09-09 15:59:36"
    },
    {
      "id": 238,
      "app_process_id": 376,
      "endpoint_id": 8,
      "parent_pid": 13354,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23600,
      "command_source": "user_profile",
      "started_at": "2025-09-08 14:35:10"
    },
    {
      "id": 239,
      "app_process_id": 503,
      "endpoint_id": 9,
      "parent_pid": 58254,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 64715,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 21:47:43"
    },
    {
      "id": 240,
      "app_process_id": 179,
      "endpoint_id": 12,
      "parent_pid": 41425,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57671,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 21:59:11"
    },
    {
      "id": 241,
      "app_process_id": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 12122,
      "command_source": "user_profile",
      "started_at": "2025-09-12 15:52:57"
    },
    {
      "id": 242,
      "app_process_id": 464,
      "endpoint_id": 1,
      "parent_pid": 16918,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57971,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:29:49"
    },
    {
      "id": 243,
      "app_process_id": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 1729,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 15:59:38"
    },
    {
      "id": 244,
      "app_process_id": 132,
      "endpoint_id": 10,
      "parent_pid": 54687,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11111,
      "command_source": "local_disk",
      "started_at": "2025-09-08 09:34:52"
    },
    {
      "id": 245,
      "app_process_id": 237,
      "endpoint_id": 24,
      "parent_pid": 14924,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13239,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:40:58"
    },
    {
      "id": 246,
      "app_process_id": 379,
      "endpoint_id": 10,
      "parent_pid": 6542,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36390,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 14:07:52"
    },
    {
      "id": 247,
      "app_process_id": 404,
      "endpoint_id": 1,
      "parent_pid": 1270,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 36715,
      "command_source": "user_profile",
      "started_at": "2025-09-09 15:57:34"
    },
    {
      "id": 248,
      "app_process_id": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 26572,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:03:23"
    },
    {
      "id": 249,
      "app_process_id": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25415,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:10:30"
    },
    {
      "id": 250,
      "app_process_id": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 60016,
      "command_source": "user_profile",
      "started_at": "2025-09-12 15:34:56"
    },
    {
      "id": 251,
      "app_process_id": 62,
      "endpoint_id": 30,
      "parent_pid": 13633,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 48711,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:28:37"
    },
    {
      "id": 252,
      "app_process_id": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 3603,
      "command_source": "local_disk",
      "started_at": "2025-09-09 01:05:14"
    },
    {
      "id": 253,
      "app_process_id": 80,
      "endpoint_id": 14,
      "parent_pid": 5293,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40023,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 16:10:39"
    },
    {
      "id": 254,
      "app_process_id": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 49295,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:57:41"
    },
    {
      "id": 255,
      "app_process_id": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 58155,
      "command_source": "local_disk",
      "started_at": "2025-09-12 15:53:35"
    },
    {
      "id": 256,
      "app_process_id": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 38598,
      "command_source": "local_disk",
      "started_at": "2025-09-12 17:46:52"
    },
    {
      "id": 257,
      "app_process_id": 366,
      "endpoint_id": 4,
      "parent_pid": 38325,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29704,
      "command_source": "user_profile",
      "started_at": "2025-09-11 09:30:31"
    },
    {
      "id": 258,
      "app_process_id": 348,
      "endpoint_id": 14,
      "parent_pid": 36455,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 15922,
      "command_source": "user_profile",
      "started_at": "2025-09-10 15:21:42"
    },
    {
      "id": 259,
      "app_process_id": 69,
      "endpoint_id": 2,
      "parent_pid": 34591,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 55151,
      "command_source": "user_profile",
      "started_at": "2025-09-11 17:38:46"
    },
    {
      "id": 260,
      "app_process_id": 44,
      "endpoint_id": 28,
      "parent_pid": 34278,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61890,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:11:16"
    },
    {
      "id": 261,
      "app_process_id": 412,
      "endpoint_id": 8,
      "parent_pid": 2537,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 35144,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:48:13"
    },
    {
      "id": 262,
      "app_process_id": 68,
      "endpoint_id": 30,
      "parent_pid": 28650,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 49643,
      "command_source": "local_disk",
      "started_at": "2025-09-10 17:46:49"
    },
    {
      "id": 263,
      "app_process_id": 236,
      "endpoint_id": 3,
      "parent_pid": 19597,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17769,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:38:00"
    },
    {
      "id": 264,
      "app_process_id": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15100,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 10:40:16"
    },
    {
      "id": 265,
      "app_process_id": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 64321,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:39:14"
    },
    {
      "id": 266,
      "app_process_id": 308,
      "endpoint_id": 1,
      "parent_pid": 39176,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36227,
      "command_source": "local_disk",
      "started_at": "2025-09-08 13:27:14"
    },
    {
      "id": 267,
      "app_process_id": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 40481,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:12:42"
    },
    {
      "id": 268,
      "app_process_id": 398,
      "endpoint_id": 12,
      "parent_pid": 31853,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 6531,
      "command_source": "local_disk",
      "started_at": "2025-09-12 22:49:25"
    },
    {
      "id": 269,
      "app_process_id": 221,
      "endpoint_id": 25,
      "parent_pid": 36353,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51335,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:44:21"
    },
    {
      "id": 270,
      "app_process_id": 508,
      "endpoint_id": 17,
      "parent_pid": 56082,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22611,
      "command_source": "user_profile",
      "started_at": "2025-09-11 11:39:20"
    },
    {
      "id": 271,
      "app_process_id": 191,
      "endpoint_id": 18,
      "parent_pid": 7221,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 28096,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:48:44"
    },
    {
      "id": 272,
      "app_process_id": 454,
      "endpoint_id": 24,
      "parent_pid": 44332,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59285,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 17:27:14"
    },
    {
      "id": 273,
      "app_process_id": 79,
      "endpoint_id": 7,
      "parent_pid": 32308,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32749,
      "command_source": "network_path",
      "started_at": "2025-09-09 09:47:31"
    },
    {
      "id": 274,
      "app_process_id": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 21245,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:19:53"
    },
    {
      "id": 275,
      "app_process_id": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 55324,
      "command_source": "local_disk",
      "started_at": "2025-09-09 16:41:09"
    },
    {
      "id": 276,
      "app_process_id": 4,
      "endpoint_id": 10,
      "parent_pid": 13733,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11243,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:43:31"
    },
    {
      "id": 277,
      "app_process_id": 472,
      "endpoint_id": 1,
      "parent_pid": 50693,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 58788,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:01:25"
    },
    {
      "id": 278,
      "app_process_id": 474,
      "endpoint_id": 14,
      "parent_pid": 46432,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44687,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 14:17:31"
    },
    {
      "id": 279,
      "app_process_id": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 61570,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 11:09:19"
    },
    {
      "id": 280,
      "app_process_id": 236,
      "endpoint_id": 3,
      "parent_pid": 19597,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53586,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:38:36"
    },
    {
      "id": 281,
      "app_process_id": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 51509,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 20:11:01"
    },
    {
      "id": 282,
      "app_process_id": 47,
      "endpoint_id": 28,
      "parent_pid": 26066,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34472,
      "command_source": "local_disk",
      "started_at": "2025-09-08 18:35:33"
    },
    {
      "id": 283,
      "app_process_id": 212,
      "endpoint_id": 4,
      "parent_pid": 61892,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26873,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:43:05"
    },
    {
      "id": 284,
      "app_process_id": 445,
      "endpoint_id": 16,
      "parent_pid": 8609,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45608,
      "command_source": "local_disk",
      "started_at": "2025-09-12 19:51:59"
    },
    {
      "id": 285,
      "app_process_id": 349,
      "endpoint_id": 19,
      "parent_pid": 20688,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 59177,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:32:24"
    },
    {
      "id": 286,
      "app_process_id": 352,
      "endpoint_id": 18,
      "parent_pid": 39809,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18022,
      "command_source": "user_profile",
      "started_at": "2025-09-10 19:58:28"
    },
    {
      "id": 287,
      "app_process_id": 389,
      "endpoint_id": 23,
      "parent_pid": 1834,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 46842,
      "command_source": "network_path",
      "started_at": "2025-09-10 18:30:53"
    },
    {
      "id": 288,
      "app_process_id": 56,
      "endpoint_id": 10,
      "parent_pid": 61151,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 16846,
      "command_source": "local_disk",
      "started_at": "2025-09-08 08:02:04"
    },
    {
      "id": 289,
      "app_process_id": 145,
      "endpoint_id": 2,
      "parent_pid": 11876,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64062,
      "command_source": "local_disk",
      "started_at": "2025-09-10 12:24:36"
    },
    {
      "id": 290,
      "app_process_id": 443,
      "endpoint_id": 29,
      "parent_pid": 7017,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 6071,
      "command_source": "local_disk",
      "started_at": "2025-09-11 14:12:19"
    },
    {
      "id": 291,
      "app_process_id": 187,
      "endpoint_id": 3,
      "parent_pid": 56528,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 11089,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 19:06:37"
    },
    {
      "id": 292,
      "app_process_id": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17881,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:29:57"
    },
    {
      "id": 293,
      "app_process_id": 577,
      "endpoint_id": 9,
      "parent_pid": 50253,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23133,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:59:17"
    },
    {
      "id": 294,
      "app_process_id": 103,
      "endpoint_id": 16,
      "parent_pid": 37100,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 2152,
      "command_source": "local_disk",
      "started_at": "2025-09-12 15:35:44"
    },
    {
      "id": 295,
      "app_process_id": 456,
      "endpoint_id": 12,
      "parent_pid": 45910,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 37910,
      "command_source": "local_disk",
      "started_at": "2025-09-08 21:42:20"
    },
    {
      "id": 296,
      "app_process_id": 423,
      "endpoint_id": 16,
      "parent_pid": 29523,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12747,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 19:34:25"
    },
    {
      "id": 297,
      "app_process_id": 549,
      "endpoint_id": 9,
      "parent_pid": 54109,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 54251,
      "command_source": "network_path",
      "started_at": "2025-09-08 22:54:06"
    },
    {
      "id": 298,
      "app_process_id": 557,
      "endpoint_id": 30,
      "parent_pid": 51424,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 44477,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 04:19:19"
    },
    {
      "id": 299,
      "app_process_id": 525,
      "endpoint_id": 24,
      "parent_pid": 9432,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15415,
      "command_source": "local_disk",
      "started_at": "2025-09-09 14:20:46"
    },
    {
      "id": 300,
      "app_process_id": 570,
      "endpoint_id": 3,
      "parent_pid": 37692,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 3681,
      "command_source": "user_profile",
      "started_at": "2025-09-11 22:49:31"
    },
    {
      "id": 301,
      "app_process_id": 476,
      "endpoint_id": 16,
      "parent_pid": 56343,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 24563,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 20:24:06"
    },
    {
      "id": 302,
      "app_process_id": 92,
      "endpoint_id": 4,
      "parent_pid": 49989,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9180,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:16:26"
    },
    {
      "id": 303,
      "app_process_id": 348,
      "endpoint_id": 14,
      "parent_pid": 36455,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 42246,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:23:25"
    },
    {
      "id": 304,
      "app_process_id": 511,
      "endpoint_id": 22,
      "parent_pid": 21581,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 11738,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:50:46"
    },
    {
      "id": 305,
      "app_process_id": 533,
      "endpoint_id": 1,
      "parent_pid": 44023,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25135,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:42:06"
    },
    {
      "id": 306,
      "app_process_id": 254,
      "endpoint_id": 18,
      "parent_pid": 56120,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27568,
      "command_source": "user_profile",
      "started_at": "2025-09-10 15:47:05"
    },
    {
      "id": 307,
      "app_process_id": 387,
      "endpoint_id": 28,
      "parent_pid": 13027,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18296,
      "command_source": "network_path",
      "started_at": "2025-09-08 19:00:36"
    },
    {
      "id": 308,
      "app_process_id": 38,
      "endpoint_id": 23,
      "parent_pid": 52701,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61360,
      "command_source": "local_disk",
      "started_at": "2025-09-10 15:48:41"
    },
    {
      "id": 309,
      "app_process_id": 12,
      "endpoint_id": 8,
      "parent_pid": 52296,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 2764,
      "command_source": "user_profile",
      "started_at": "2025-09-11 14:12:30"
    },
    {
      "id": 310,
      "app_process_id": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9990,
      "command_source": "user_profile",
      "started_at": "2025-09-11 12:21:00"
    },
    {
      "id": 311,
      "app_process_id": 523,
      "endpoint_id": 9,
      "parent_pid": 41324,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 39904,
      "command_source": "network_path",
      "started_at": "2025-09-10 23:16:37"
    },
    {
      "id": 312,
      "app_process_id": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 17374,
      "command_source": "local_disk",
      "started_at": "2025-09-12 23:14:25"
    },
    {
      "id": 313,
      "app_process_id": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 49530,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:41:55"
    },
    {
      "id": 314,
      "app_process_id": 88,
      "endpoint_id": 12,
      "parent_pid": 9701,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 7157,
      "command_source": "network_path",
      "started_at": "2025-09-09 11:47:51"
    },
    {
      "id": 315,
      "app_process_id": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61084,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:44:28"
    },
    {
      "id": 316,
      "app_process_id": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25409,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:57:49"
    },
    {
      "id": 317,
      "app_process_id": 285,
      "endpoint_id": 18,
      "parent_pid": 64241,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60884,
      "command_source": "local_disk",
      "started_at": "2025-09-12 14:26:41"
    },
    {
      "id": 318,
      "app_process_id": 100,
      "endpoint_id": 2,
      "parent_pid": 54664,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 12786,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:13:56"
    },
    {
      "id": 319,
      "app_process_id": 259,
      "endpoint_id": 29,
      "parent_pid": 1192,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 24121,
      "command_source": "local_disk",
      "started_at": "2025-09-10 12:04:50"
    },
    {
      "id": 320,
      "app_process_id": 302,
      "endpoint_id": 14,
      "parent_pid": 21968,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 9286,
      "command_source": "network_path",
      "started_at": "2025-09-08 17:16:37"
    },
    {
      "id": 321,
      "app_process_id": 239,
      "endpoint_id": 23,
      "parent_pid": 3544,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10671,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:31:24"
    },
    {
      "id": 322,
      "app_process_id": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47075,
      "command_source": "user_profile",
      "started_at": "2025-09-08 21:17:52"
    },
    {
      "id": 323,
      "app_process_id": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 29428,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:37:17"
    },
    {
      "id": 324,
      "app_process_id": 557,
      "endpoint_id": 30,
      "parent_pid": 51424,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10452,
      "command_source": "local_disk",
      "started_at": "2025-09-12 04:19:58"
    },
    {
      "id": 325,
      "app_process_id": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18947,
      "command_source": "local_disk",
      "started_at": "2025-09-12 00:54:19"
    },
    {
      "id": 326,
      "app_process_id": 280,
      "endpoint_id": 24,
      "parent_pid": 42237,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 23642,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 15:06:49"
    },
    {
      "id": 327,
      "app_process_id": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 25589,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 17:48:40"
    },
    {
      "id": 328,
      "app_process_id": 579,
      "endpoint_id": 13,
      "parent_pid": 24394,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41697,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:38:10"
    },
    {
      "id": 329,
      "app_process_id": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 47419,
      "command_source": "user_profile",
      "started_at": "2025-09-09 16:41:11"
    },
    {
      "id": 330,
      "app_process_id": 473,
      "endpoint_id": 17,
      "parent_pid": 982,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 57718,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 01:07:06"
    },
    {
      "id": 331,
      "app_process_id": 275,
      "endpoint_id": 27,
      "parent_pid": 50379,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18698,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:32:25"
    },
    {
      "id": 332,
      "app_process_id": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22027,
      "command_source": "user_profile",
      "started_at": "2025-09-10 14:04:59"
    },
    {
      "id": 333,
      "app_process_id": 303,
      "endpoint_id": 7,
      "parent_pid": 60717,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59737,
      "command_source": "local_disk",
      "started_at": "2025-09-10 22:22:11"
    },
    {
      "id": 334,
      "app_process_id": 326,
      "endpoint_id": 8,
      "parent_pid": 23781,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33463,
      "command_source": "local_disk",
      "started_at": "2025-09-11 17:50:13"
    },
    {
      "id": 335,
      "app_process_id": 563,
      "endpoint_id": 14,
      "parent_pid": 62900,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 28152,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 15:57:30"
    },
    {
      "id": 336,
      "app_process_id": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 45925,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:05:25"
    },
    {
      "id": 337,
      "app_process_id": 201,
      "endpoint_id": 12,
      "parent_pid": 63883,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 50103,
      "command_source": "user_profile",
      "started_at": "2025-09-09 13:30:33"
    },
    {
      "id": 338,
      "app_process_id": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 60354,
      "command_source": "temp_folder",
      "started_at": "2025-09-13 00:16:07"
    },
    {
      "id": 339,
      "app_process_id": 70,
      "endpoint_id": 20,
      "parent_pid": 7497,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18447,
      "command_source": "local_disk",
      "started_at": "2025-09-12 20:23:42"
    },
    {
      "id": 340,
      "app_process_id": 144,
      "endpoint_id": 18,
      "parent_pid": 57322,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 13091,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:39:39"
    },
    {
      "id": 341,
      "app_process_id": 522,
      "endpoint_id": 28,
      "parent_pid": 51499,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 13177,
      "command_source": "network_path",
      "started_at": "2025-09-08 19:52:55"
    },
    {
      "id": 342,
      "app_process_id": 225,
      "endpoint_id": 19,
      "parent_pid": 60709,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45960,
      "command_source": "local_disk",
      "started_at": "2025-09-09 11:48:12"
    },
    {
      "id": 343,
      "app_process_id": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40560,
      "command_source": "local_disk",
      "started_at": "2025-09-08 15:52:04"
    },
    {
      "id": 344,
      "app_process_id": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43942,
      "command_source": "local_disk",
      "started_at": "2025-09-09 20:19:57"
    },
    {
      "id": 345,
      "app_process_id": 319,
      "endpoint_id": 5,
      "parent_pid": 9012,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 26755,
      "command_source": "local_disk",
      "started_at": "2025-09-09 14:34:47"
    },
    {
      "id": 346,
      "app_process_id": 449,
      "endpoint_id": 6,
      "parent_pid": 7351,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 5719,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 13:28:52"
    },
    {
      "id": 347,
      "app_process_id": 532,
      "endpoint_id": 11,
      "parent_pid": 27202,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40037,
      "command_source": "user_profile",
      "started_at": "2025-09-08 16:06:59"
    },
    {
      "id": 348,
      "app_process_id": 515,
      "endpoint_id": 19,
      "parent_pid": 36077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 23389,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 16:41:53"
    },
    {
      "id": 349,
      "app_process_id": 481,
      "endpoint_id": 26,
      "parent_pid": 56274,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 22128,
      "command_source": "user_profile",
      "started_at": "2025-09-08 16:58:45"
    },
    {
      "id": 350,
      "app_process_id": 314,
      "endpoint_id": 17,
      "parent_pid": 7325,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 18978,
      "command_source": "local_disk",
      "started_at": "2025-09-09 19:21:37"
    },
    {
      "id": 351,
      "app_process_id": 456,
      "endpoint_id": 12,
      "parent_pid": 45910,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 14819,
      "command_source": "local_disk",
      "started_at": "2025-09-08 21:42:34"
    },
    {
      "id": 352,
      "app_process_id": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 19944,
      "command_source": "local_disk",
      "started_at": "2025-09-08 18:15:04"
    },
    {
      "id": 353,
      "app_process_id": 356,
      "endpoint_id": 16,
      "parent_pid": 54721,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 38745,
      "command_source": "local_disk",
      "started_at": "2025-09-10 18:23:43"
    },
    {
      "id": 354,
      "app_process_id": 322,
      "endpoint_id": 18,
      "parent_pid": 45116,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 37192,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:54:48"
    },
    {
      "id": 355,
      "app_process_id": 252,
      "endpoint_id": 4,
      "parent_pid": 47675,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 7207,
      "command_source": "user_profile",
      "started_at": "2025-09-10 18:41:27"
    },
    {
      "id": 356,
      "app_process_id": 425,
      "endpoint_id": 11,
      "parent_pid": 28405,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62331,
      "command_source": "local_disk",
      "started_at": "2025-09-08 15:53:46"
    },
    {
      "id": 357,
      "app_process_id": 11,
      "endpoint_id": 13,
      "parent_pid": 25035,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 37690,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:12:22"
    },
    {
      "id": 358,
      "app_process_id": 45,
      "endpoint_id": 29,
      "parent_pid": 10542,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 788,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:32:39"
    },
    {
      "id": 359,
      "app_process_id": 310,
      "endpoint_id": 27,
      "parent_pid": 31168,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 25178,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:46:09"
    },
    {
      "id": 360,
      "app_process_id": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42080,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:36:22"
    },
    {
      "id": 361,
      "app_process_id": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48953,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:29:23"
    },
    {
      "id": 362,
      "app_process_id": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 7566,
      "command_source": "local_disk",
      "started_at": "2025-09-08 19:54:58"
    },
    {
      "id": 363,
      "app_process_id": 219,
      "endpoint_id": 19,
      "parent_pid": 30347,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40145,
      "command_source": "local_disk",
      "started_at": "2025-09-09 20:21:38"
    },
    {
      "id": 364,
      "app_process_id": 568,
      "endpoint_id": 10,
      "parent_pid": 2260,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33834,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 15:49:27"
    },
    {
      "id": 365,
      "app_process_id": 442,
      "endpoint_id": 19,
      "parent_pid": 7940,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 45537,
      "command_source": "local_disk",
      "started_at": "2025-09-09 23:31:41"
    },
    {
      "id": 366,
      "app_process_id": 5,
      "endpoint_id": 27,
      "parent_pid": 4607,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54289,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 15:55:09"
    },
    {
      "id": 367,
      "app_process_id": 298,
      "endpoint_id": 2,
      "parent_pid": 40165,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5447,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:52:51"
    },
    {
      "id": 368,
      "app_process_id": 2,
      "endpoint_id": 4,
      "parent_pid": 36180,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 57299,
      "command_source": "user_profile",
      "started_at": "2025-09-11 08:16:49"
    },
    {
      "id": 369,
      "app_process_id": 417,
      "endpoint_id": 29,
      "parent_pid": 7857,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 42628,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:37:37"
    },
    {
      "id": 370,
      "app_process_id": 324,
      "endpoint_id": 8,
      "parent_pid": 30035,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 34000,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:25:42"
    },
    {
      "id": 371,
      "app_process_id": 11,
      "endpoint_id": 13,
      "parent_pid": 25035,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 41579,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:13:40"
    },
    {
      "id": 372,
      "app_process_id": 127,
      "endpoint_id": 15,
      "parent_pid": 54190,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 47838,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:25:01"
    },
    {
      "id": 373,
      "app_process_id": 376,
      "endpoint_id": 8,
      "parent_pid": 13354,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 48102,
      "command_source": "local_disk",
      "started_at": "2025-09-08 14:35:41"
    },
    {
      "id": 374,
      "app_process_id": 561,
      "endpoint_id": 16,
      "parent_pid": 31827,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 19878,
      "command_source": "local_disk",
      "started_at": "2025-09-12 20:35:13"
    },
    {
      "id": 375,
      "app_process_id": 248,
      "endpoint_id": 4,
      "parent_pid": 60865,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 61982,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:42:46"
    },
    {
      "id": 376,
      "app_process_id": 396,
      "endpoint_id": 19,
      "parent_pid": 22514,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58420,
      "command_source": "local_disk",
      "started_at": "2025-09-09 22:08:14"
    },
    {
      "id": 377,
      "app_process_id": 517,
      "endpoint_id": 30,
      "parent_pid": 57726,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 64130,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:18:08"
    },
    {
      "id": 378,
      "app_process_id": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33597,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 15:19:29"
    },
    {
      "id": 379,
      "app_process_id": 532,
      "endpoint_id": 11,
      "parent_pid": 27202,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 9815,
      "command_source": "user_profile",
      "started_at": "2025-09-08 16:07:32"
    },
    {
      "id": 380,
      "app_process_id": 195,
      "endpoint_id": 9,
      "parent_pid": 54269,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 51187,
      "command_source": "user_profile",
      "started_at": "2025-09-12 18:22:28"
    },
    {
      "id": 381,
      "app_process_id": 72,
      "endpoint_id": 3,
      "parent_pid": 15433,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57075,
      "command_source": "user_profile",
      "started_at": "2025-09-11 18:42:48"
    },
    {
      "id": 382,
      "app_process_id": 114,
      "endpoint_id": 27,
      "parent_pid": 58166,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 51952,
      "command_source": "local_disk",
      "started_at": "2025-09-12 17:49:35"
    },
    {
      "id": 383,
      "app_process_id": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 9382,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:58:52"
    },
    {
      "id": 384,
      "app_process_id": 365,
      "endpoint_id": 30,
      "parent_pid": 2077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 51724,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:59:08"
    },
    {
      "id": 385,
      "app_process_id": 265,
      "endpoint_id": 14,
      "parent_pid": 932,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 16388,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 11:38:09"
    },
    {
      "id": 386,
      "app_process_id": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 27036,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:16:03"
    },
    {
      "id": 387,
      "app_process_id": 198,
      "endpoint_id": 5,
      "parent_pid": 48079,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 60734,
      "command_source": "local_disk",
      "started_at": "2025-09-10 21:31:06"
    },
    {
      "id": 388,
      "app_process_id": 455,
      "endpoint_id": 8,
      "parent_pid": 28274,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 5593,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 20:52:05"
    },
    {
      "id": 389,
      "app_process_id": 468,
      "endpoint_id": 20,
      "parent_pid": 50480,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28686,
      "command_source": "local_disk",
      "started_at": "2025-09-08 19:55:57"
    },
    {
      "id": 390,
      "app_process_id": 222,
      "endpoint_id": 14,
      "parent_pid": 28924,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 1144,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:31:12"
    },
    {
      "id": 391,
      "app_process_id": 42,
      "endpoint_id": 27,
      "parent_pid": 43487,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2753,
      "command_source": "user_profile",
      "started_at": "2025-09-11 12:25:43"
    },
    {
      "id": 392,
      "app_process_id": 333,
      "endpoint_id": 14,
      "parent_pid": 7215,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 31836,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 18:15:14"
    },
    {
      "id": 393,
      "app_process_id": 211,
      "endpoint_id": 14,
      "parent_pid": 5420,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 34454,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 09:32:08"
    },
    {
      "id": 394,
      "app_process_id": 308,
      "endpoint_id": 1,
      "parent_pid": 39176,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22945,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 13:29:03"
    },
    {
      "id": 395,
      "app_process_id": 221,
      "endpoint_id": 25,
      "parent_pid": 36353,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 2690,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:45:45"
    },
    {
      "id": 396,
      "app_process_id": 291,
      "endpoint_id": 1,
      "parent_pid": 24759,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 35574,
      "command_source": "local_disk",
      "started_at": "2025-09-13 00:32:39"
    },
    {
      "id": 397,
      "app_process_id": 146,
      "endpoint_id": 15,
      "parent_pid": 25240,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62976,
      "command_source": "local_disk",
      "started_at": "2025-09-12 18:47:34"
    },
    {
      "id": 398,
      "app_process_id": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 32866,
      "command_source": "local_disk",
      "started_at": "2025-09-09 17:54:09"
    },
    {
      "id": 399,
      "app_process_id": 363,
      "endpoint_id": 2,
      "parent_pid": 16048,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32246,
      "command_source": "user_profile",
      "started_at": "2025-09-12 16:29:28"
    },
    {
      "id": 400,
      "app_process_id": 139,
      "endpoint_id": 27,
      "parent_pid": 13534,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30629,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 13:46:21"
    },
    {
      "id": 401,
      "app_process_id": 282,
      "endpoint_id": 21,
      "parent_pid": 25431,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 5995,
      "command_source": "user_profile",
      "started_at": "2025-09-09 10:53:18"
    },
    {
      "id": 402,
      "app_process_id": 259,
      "endpoint_id": 29,
      "parent_pid": 1192,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 64519,
      "command_source": "local_disk",
      "started_at": "2025-09-10 12:04:52"
    },
    {
      "id": 403,
      "app_process_id": 560,
      "endpoint_id": 12,
      "parent_pid": 18770,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54426,
      "command_source": "user_profile",
      "started_at": "2025-09-13 01:59:00"
    },
    {
      "id": 404,
      "app_process_id": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 29843,
      "command_source": "user_profile",
      "started_at": "2025-09-12 15:36:57"
    },
    {
      "id": 405,
      "app_process_id": 66,
      "endpoint_id": 30,
      "parent_pid": 47490,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 45716,
      "command_source": "local_disk",
      "started_at": "2025-09-11 23:32:45"
    },
    {
      "id": 406,
      "app_process_id": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45962,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:43:37"
    },
    {
      "id": 407,
      "app_process_id": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 41437,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:20:01"
    },
    {
      "id": 408,
      "app_process_id": 217,
      "endpoint_id": 23,
      "parent_pid": 61419,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42529,
      "command_source": "local_disk",
      "started_at": "2025-09-10 17:42:09"
    },
    {
      "id": 409,
      "app_process_id": 503,
      "endpoint_id": 9,
      "parent_pid": 58254,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57005,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 21:49:14"
    },
    {
      "id": 410,
      "app_process_id": 97,
      "endpoint_id": 13,
      "parent_pid": 10964,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 63419,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 17:35:36"
    },
    {
      "id": 411,
      "app_process_id": 1,
      "endpoint_id": 5,
      "parent_pid": 59762,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 16568,
      "command_source": "local_disk",
      "started_at": "2025-09-10 11:52:53"
    },
    {
      "id": 412,
      "app_process_id": 130,
      "endpoint_id": 14,
      "parent_pid": 62677,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 29898,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:59:24"
    },
    {
      "id": 413,
      "app_process_id": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 34929,
      "command_source": "user_profile",
      "started_at": "2025-09-08 13:03:16"
    },
    {
      "id": 414,
      "app_process_id": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 22148,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:42:39"
    },
    {
      "id": 415,
      "app_process_id": 325,
      "endpoint_id": 30,
      "parent_pid": 20469,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 53441,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:25:20"
    },
    {
      "id": 416,
      "app_process_id": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 32671,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:30:42"
    },
    {
      "id": 417,
      "app_process_id": 385,
      "endpoint_id": 5,
      "parent_pid": 19298,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 27953,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 22:54:40"
    },
    {
      "id": 418,
      "app_process_id": 435,
      "endpoint_id": 7,
      "parent_pid": 42046,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 36056,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:36:10"
    },
    {
      "id": 419,
      "app_process_id": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 1287,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 10:40:47"
    },
    {
      "id": 420,
      "app_process_id": 489,
      "endpoint_id": 18,
      "parent_pid": 22003,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 41581,
      "command_source": "local_disk",
      "started_at": "2025-09-10 22:43:02"
    },
    {
      "id": 421,
      "app_process_id": 13,
      "endpoint_id": 12,
      "parent_pid": 63035,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 9672,
      "command_source": "user_profile",
      "started_at": "2025-09-08 16:28:37"
    },
    {
      "id": 422,
      "app_process_id": 462,
      "endpoint_id": 9,
      "parent_pid": 1160,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 8626,
      "command_source": "local_disk",
      "started_at": "2025-09-10 20:35:59"
    },
    {
      "id": 423,
      "app_process_id": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 58521,
      "command_source": "user_profile",
      "started_at": "2025-09-09 13:18:48"
    },
    {
      "id": 424,
      "app_process_id": 36,
      "endpoint_id": 8,
      "parent_pid": 26578,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 13750,
      "command_source": "user_profile",
      "started_at": "2025-09-08 10:19:21"
    },
    {
      "id": 425,
      "app_process_id": 458,
      "endpoint_id": 9,
      "parent_pid": 33005,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 26208,
      "command_source": "user_profile",
      "started_at": "2025-09-12 21:52:40"
    },
    {
      "id": 426,
      "app_process_id": 69,
      "endpoint_id": 2,
      "parent_pid": 34591,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 63087,
      "command_source": "network_path",
      "started_at": "2025-09-11 17:39:46"
    },
    {
      "id": 427,
      "app_process_id": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 35789,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 16:38:36"
    },
    {
      "id": 428,
      "app_process_id": 202,
      "endpoint_id": 23,
      "parent_pid": 43291,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 50742,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 11:44:09"
    },
    {
      "id": 429,
      "app_process_id": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 28227,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 13:40:20"
    },
    {
      "id": 430,
      "app_process_id": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60323,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 21:12:41"
    },
    {
      "id": 431,
      "app_process_id": 531,
      "endpoint_id": 26,
      "parent_pid": 56848,
      "process_name": "schtasks.exe",
      "category": "scheduled_task_creation",
      "detection_label": "persistence_task",
      "pid": 55347,
      "command_source": "user_profile",
      "started_at": "2025-09-08 17:37:44"
    },
    {
      "id": 432,
      "app_process_id": 533,
      "endpoint_id": 1,
      "parent_pid": 44023,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 42562,
      "command_source": "user_profile",
      "started_at": "2025-09-10 16:43:19"
    },
    {
      "id": 433,
      "app_process_id": 158,
      "endpoint_id": 23,
      "parent_pid": 11402,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 50804,
      "command_source": "local_disk",
      "started_at": "2025-09-10 17:24:37"
    },
    {
      "id": 434,
      "app_process_id": 183,
      "endpoint_id": 3,
      "parent_pid": 57760,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 36419,
      "command_source": "user_profile",
      "started_at": "2025-09-11 20:08:56"
    },
    {
      "id": 435,
      "app_process_id": 450,
      "endpoint_id": 3,
      "parent_pid": 52592,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 59120,
      "command_source": "local_disk",
      "started_at": "2025-09-11 22:30:49"
    },
    {
      "id": 436,
      "app_process_id": 292,
      "endpoint_id": 30,
      "parent_pid": 43343,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 42834,
      "command_source": "local_disk",
      "started_at": "2025-09-12 01:46:54"
    },
    {
      "id": 437,
      "app_process_id": 395,
      "endpoint_id": 26,
      "parent_pid": 43857,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 50986,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 13:04:50"
    },
    {
      "id": 438,
      "app_process_id": 396,
      "endpoint_id": 19,
      "parent_pid": 22514,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 62045,
      "command_source": "local_disk",
      "started_at": "2025-09-09 22:08:26"
    },
    {
      "id": 439,
      "app_process_id": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40738,
      "command_source": "local_disk",
      "started_at": "2025-09-11 15:19:57"
    },
    {
      "id": 440,
      "app_process_id": 300,
      "endpoint_id": 26,
      "parent_pid": 13451,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 42535,
      "command_source": "local_disk",
      "started_at": "2025-09-09 16:41:22"
    },
    {
      "id": 441,
      "app_process_id": 507,
      "endpoint_id": 11,
      "parent_pid": 24155,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 33961,
      "command_source": "local_disk",
      "started_at": "2025-09-12 18:24:34"
    },
    {
      "id": 442,
      "app_process_id": 433,
      "endpoint_id": 8,
      "parent_pid": 49560,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6330,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:18:52"
    },
    {
      "id": 443,
      "app_process_id": 113,
      "endpoint_id": 14,
      "parent_pid": 32416,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 60327,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:36:35"
    },
    {
      "id": 444,
      "app_process_id": 550,
      "endpoint_id": 7,
      "parent_pid": 33263,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17342,
      "command_source": "network_path",
      "started_at": "2025-09-12 17:16:43"
    },
    {
      "id": 445,
      "app_process_id": 253,
      "endpoint_id": 2,
      "parent_pid": 55668,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 11470,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:42:40"
    },
    {
      "id": 446,
      "app_process_id": 49,
      "endpoint_id": 5,
      "parent_pid": 44112,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 14939,
      "command_source": "local_disk",
      "started_at": "2025-09-10 12:49:29"
    },
    {
      "id": 447,
      "app_process_id": 295,
      "endpoint_id": 16,
      "parent_pid": 49610,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 24948,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 16:35:25"
    },
    {
      "id": 448,
      "app_process_id": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 27297,
      "command_source": "local_disk",
      "started_at": "2025-09-09 21:14:37"
    },
    {
      "id": 449,
      "app_process_id": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 14400,
      "command_source": "user_profile",
      "started_at": "2025-09-09 21:15:42"
    },
    {
      "id": 450,
      "app_process_id": 419,
      "endpoint_id": 14,
      "parent_pid": 6165,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 59971,
      "command_source": "local_disk",
      "started_at": "2025-09-11 13:49:53"
    },
    {
      "id": 451,
      "app_process_id": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2999,
      "command_source": "user_profile",
      "started_at": "2025-09-11 10:31:30"
    },
    {
      "id": 452,
      "app_process_id": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25118,
      "command_source": "user_profile",
      "started_at": "2025-09-11 12:42:00"
    },
    {
      "id": 453,
      "app_process_id": 137,
      "endpoint_id": 25,
      "parent_pid": 14030,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 62691,
      "command_source": "local_disk",
      "started_at": "2025-09-10 23:53:06"
    },
    {
      "id": 454,
      "app_process_id": 283,
      "endpoint_id": 19,
      "parent_pid": 31200,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 12381,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 12:48:28"
    },
    {
      "id": 455,
      "app_process_id": 481,
      "endpoint_id": 26,
      "parent_pid": 56274,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 39143,
      "command_source": "local_disk",
      "started_at": "2025-09-08 16:59:30"
    },
    {
      "id": 456,
      "app_process_id": 3,
      "endpoint_id": 8,
      "parent_pid": 43396,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 36925,
      "command_source": "local_disk",
      "started_at": "2025-09-12 11:25:09"
    },
    {
      "id": 457,
      "app_process_id": 414,
      "endpoint_id": 12,
      "parent_pid": 61129,
      "process_name": "rundll32.exe",
      "category": "office_library_load",
      "detection_label": "suspicious_library_load",
      "pid": 7849,
      "command_source": "local_disk",
      "started_at": "2025-09-09 18:45:26"
    },
    {
      "id": 458,
      "app_process_id": 14,
      "endpoint_id": 2,
      "parent_pid": 45424,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19962,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:03:46"
    },
    {
      "id": 459,
      "app_process_id": 212,
      "endpoint_id": 4,
      "parent_pid": 61892,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 24152,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:43:33"
    },
    {
      "id": 460,
      "app_process_id": 107,
      "endpoint_id": 1,
      "parent_pid": 22672,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 54275,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:30:48"
    },
    {
      "id": 461,
      "app_process_id": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 19698,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 23:15:32"
    },
    {
      "id": 462,
      "app_process_id": 567,
      "endpoint_id": 30,
      "parent_pid": 25903,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 7572,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:54:19"
    },
    {
      "id": 463,
      "app_process_id": 287,
      "endpoint_id": 17,
      "parent_pid": 31309,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2604,
      "command_source": "local_disk",
      "started_at": "2025-09-09 19:01:58"
    },
    {
      "id": 464,
      "app_process_id": 290,
      "endpoint_id": 20,
      "parent_pid": 58314,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7884,
      "command_source": "local_disk",
      "started_at": "2025-09-12 11:11:18"
    },
    {
      "id": 465,
      "app_process_id": 409,
      "endpoint_id": 3,
      "parent_pid": 60471,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 11073,
      "command_source": "local_disk",
      "started_at": "2025-09-11 21:32:31"
    },
    {
      "id": 466,
      "app_process_id": 260,
      "endpoint_id": 2,
      "parent_pid": 12286,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14040,
      "command_source": "local_disk",
      "started_at": "2025-09-08 13:51:37"
    },
    {
      "id": 467,
      "app_process_id": 227,
      "endpoint_id": 24,
      "parent_pid": 48805,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 60186,
      "command_source": "user_profile",
      "started_at": "2025-09-08 12:16:33"
    },
    {
      "id": 468,
      "app_process_id": 331,
      "endpoint_id": 4,
      "parent_pid": 58772,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 27212,
      "command_source": "local_disk",
      "started_at": "2025-09-11 20:44:49"
    },
    {
      "id": 469,
      "app_process_id": 304,
      "endpoint_id": 23,
      "parent_pid": 33428,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 62295,
      "command_source": "network_path",
      "started_at": "2025-09-08 13:03:53"
    },
    {
      "id": 470,
      "app_process_id": 196,
      "endpoint_id": 7,
      "parent_pid": 40860,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 48336,
      "command_source": "local_disk",
      "started_at": "2025-09-12 15:37:27"
    },
    {
      "id": 471,
      "app_process_id": 37,
      "endpoint_id": 10,
      "parent_pid": 64176,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 1177,
      "command_source": "user_profile",
      "started_at": "2025-09-09 12:35:05"
    },
    {
      "id": 472,
      "app_process_id": 470,
      "endpoint_id": 12,
      "parent_pid": 11266,
      "process_name": "certutil.exe",
      "category": "file_download_utility",
      "detection_label": "download_utility",
      "pid": 4171,
      "command_source": "local_disk",
      "started_at": "2025-09-12 23:15:42"
    },
    {
      "id": 473,
      "app_process_id": 328,
      "endpoint_id": 8,
      "parent_pid": 60534,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57301,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 19:02:38"
    },
    {
      "id": 474,
      "app_process_id": 379,
      "endpoint_id": 10,
      "parent_pid": 6542,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 52577,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 14:08:36"
    },
    {
      "id": 475,
      "app_process_id": 239,
      "endpoint_id": 23,
      "parent_pid": 3544,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 5674,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:32:27"
    },
    {
      "id": 476,
      "app_process_id": 508,
      "endpoint_id": 17,
      "parent_pid": 56082,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 30113,
      "command_source": "local_disk",
      "started_at": "2025-09-11 11:39:33"
    },
    {
      "id": 477,
      "app_process_id": 176,
      "endpoint_id": 12,
      "parent_pid": 33369,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59287,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:27:38"
    },
    {
      "id": 478,
      "app_process_id": 232,
      "endpoint_id": 2,
      "parent_pid": 32167,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 10769,
      "command_source": "local_disk",
      "started_at": "2025-09-08 12:36:56"
    },
    {
      "id": 479,
      "app_process_id": 233,
      "endpoint_id": 1,
      "parent_pid": 46600,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 45316,
      "command_source": "local_disk",
      "started_at": "2025-09-13 00:17:43"
    },
    {
      "id": 480,
      "app_process_id": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 53545,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:43:33"
    },
    {
      "id": 481,
      "app_process_id": 474,
      "endpoint_id": 14,
      "parent_pid": 46432,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7765,
      "command_source": "local_disk",
      "started_at": "2025-09-11 14:19:19"
    },
    {
      "id": 482,
      "app_process_id": 475,
      "endpoint_id": 19,
      "parent_pid": 6333,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26737,
      "command_source": "local_disk",
      "started_at": "2025-09-10 14:55:16"
    },
    {
      "id": 483,
      "app_process_id": 268,
      "endpoint_id": 9,
      "parent_pid": 1833,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 2361,
      "command_source": "network_path",
      "started_at": "2025-09-10 20:33:11"
    },
    {
      "id": 484,
      "app_process_id": 332,
      "endpoint_id": 8,
      "parent_pid": 14407,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 63497,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 12:35:35"
    },
    {
      "id": 485,
      "app_process_id": 266,
      "endpoint_id": 29,
      "parent_pid": 56419,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19328,
      "command_source": "local_disk",
      "started_at": "2025-09-11 14:57:32"
    },
    {
      "id": 486,
      "app_process_id": 402,
      "endpoint_id": 20,
      "parent_pid": 3576,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 14135,
      "command_source": "local_disk",
      "started_at": "2025-09-10 13:59:13"
    },
    {
      "id": 487,
      "app_process_id": 359,
      "endpoint_id": 17,
      "parent_pid": 34261,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 53930,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 20:52:49"
    },
    {
      "id": 488,
      "app_process_id": 136,
      "endpoint_id": 30,
      "parent_pid": 45127,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 57792,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:05:41"
    },
    {
      "id": 489,
      "app_process_id": 189,
      "endpoint_id": 5,
      "parent_pid": 26077,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 1537,
      "command_source": "user_profile",
      "started_at": "2025-09-10 20:11:10"
    },
    {
      "id": 490,
      "app_process_id": 265,
      "endpoint_id": 14,
      "parent_pid": 932,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 15438,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 11:39:30"
    },
    {
      "id": 491,
      "app_process_id": 176,
      "endpoint_id": 12,
      "parent_pid": 33369,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 30177,
      "command_source": "temp_folder",
      "started_at": "2025-09-12 21:28:28"
    },
    {
      "id": 492,
      "app_process_id": 543,
      "endpoint_id": 5,
      "parent_pid": 14472,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 29057,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:59:29"
    },
    {
      "id": 493,
      "app_process_id": 54,
      "endpoint_id": 5,
      "parent_pid": 14883,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 19121,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:03:46"
    },
    {
      "id": 494,
      "app_process_id": 534,
      "endpoint_id": 25,
      "parent_pid": 63803,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 13427,
      "command_source": "local_disk",
      "started_at": "2025-09-11 10:31:44"
    },
    {
      "id": 495,
      "app_process_id": 178,
      "endpoint_id": 4,
      "parent_pid": 53009,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 26313,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:09:28"
    },
    {
      "id": 496,
      "app_process_id": 570,
      "endpoint_id": 3,
      "parent_pid": 37692,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 5968,
      "command_source": "temp_folder",
      "started_at": "2025-09-11 22:49:40"
    },
    {
      "id": 497,
      "app_process_id": 94,
      "endpoint_id": 30,
      "parent_pid": 23005,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 46203,
      "command_source": "user_profile",
      "started_at": "2025-09-12 00:56:13"
    },
    {
      "id": 498,
      "app_process_id": 383,
      "endpoint_id": 11,
      "parent_pid": 42906,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 60752,
      "command_source": "local_disk",
      "started_at": "2025-09-12 21:38:22"
    },
    {
      "id": 499,
      "app_process_id": 357,
      "endpoint_id": 13,
      "parent_pid": 17802,
      "process_name": "powershell.exe",
      "category": "office_script_host",
      "detection_label": "suspicious_office_child",
      "pid": 58932,
      "command_source": "local_disk",
      "started_at": "2025-09-09 21:17:21"
    },
    {
      "id": 500,
      "app_process_id": 15,
      "endpoint_id": 12,
      "parent_pid": 32021,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 44121,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:38:22"
    },
    {
      "id": 501,
      "app_process_id": 281,
      "endpoint_id": 5,
      "parent_pid": 44118,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 22254,
      "command_source": "local_disk",
      "started_at": "2025-09-11 15:20:19"
    },
    {
      "id": 502,
      "app_process_id": 529,
      "endpoint_id": 15,
      "parent_pid": 52105,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48233,
      "command_source": "user_profile",
      "started_at": "2025-09-12 21:12:42"
    },
    {
      "id": 503,
      "app_process_id": 210,
      "endpoint_id": 2,
      "parent_pid": 28766,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 4285,
      "command_source": "local_disk",
      "started_at": "2025-09-11 18:30:48"
    },
    {
      "id": 504,
      "app_process_id": 98,
      "endpoint_id": 1,
      "parent_pid": 41939,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 55758,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:21:33"
    },
    {
      "id": 505,
      "app_process_id": 136,
      "endpoint_id": 30,
      "parent_pid": 45127,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 4410,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:07:11"
    },
    {
      "id": 506,
      "app_process_id": 564,
      "endpoint_id": 24,
      "parent_pid": 20441,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 20515,
      "command_source": "local_disk",
      "started_at": "2025-09-09 15:39:42"
    },
    {
      "id": 507,
      "app_process_id": 41,
      "endpoint_id": 17,
      "parent_pid": 37138,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 6478,
      "command_source": "network_path",
      "started_at": "2025-09-09 17:55:47"
    },
    {
      "id": 508,
      "app_process_id": 43,
      "endpoint_id": 3,
      "parent_pid": 57823,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 38648,
      "command_source": "local_disk",
      "started_at": "2025-09-11 16:40:15"
    },
    {
      "id": 509,
      "app_process_id": 120,
      "endpoint_id": 15,
      "parent_pid": 29798,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41150,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:16:29"
    },
    {
      "id": 510,
      "app_process_id": 247,
      "endpoint_id": 9,
      "parent_pid": 49419,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 5944,
      "command_source": "local_disk",
      "started_at": "2025-09-10 10:42:41"
    },
    {
      "id": 511,
      "app_process_id": 104,
      "endpoint_id": 3,
      "parent_pid": 53814,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 57857,
      "command_source": "user_profile",
      "started_at": "2025-09-11 17:41:41"
    },
    {
      "id": 512,
      "app_process_id": 64,
      "endpoint_id": 26,
      "parent_pid": 27918,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 5172,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:42:07"
    },
    {
      "id": 513,
      "app_process_id": 10,
      "endpoint_id": 12,
      "parent_pid": 39319,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 54310,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:09:14"
    },
    {
      "id": 514,
      "app_process_id": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 17491,
      "command_source": "user_profile",
      "started_at": "2025-09-10 14:05:25"
    },
    {
      "id": 515,
      "app_process_id": 368,
      "endpoint_id": 14,
      "parent_pid": 18083,
      "process_name": "mshta.exe",
      "category": "email_script_host",
      "detection_label": "suspicious_email_child",
      "pid": 16824,
      "command_source": "local_disk",
      "started_at": "2025-09-10 16:15:44"
    },
    {
      "id": 516,
      "app_process_id": 345,
      "endpoint_id": 29,
      "parent_pid": 30315,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 62947,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:22:29"
    },
    {
      "id": 517,
      "app_process_id": 20,
      "endpoint_id": 29,
      "parent_pid": 31578,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 41123,
      "command_source": "local_disk",
      "started_at": "2025-09-11 09:00:57"
    },
    {
      "id": 518,
      "app_process_id": 288,
      "endpoint_id": 30,
      "parent_pid": 43147,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 12040,
      "command_source": "local_disk",
      "started_at": "2025-09-12 01:07:43"
    },
    {
      "id": 519,
      "app_process_id": 137,
      "endpoint_id": 25,
      "parent_pid": 14030,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 48662,
      "command_source": "local_disk",
      "started_at": "2025-09-10 23:53:43"
    },
    {
      "id": 520,
      "app_process_id": 417,
      "endpoint_id": 29,
      "parent_pid": 7857,
      "process_name": "teams.exe",
      "category": "collaboration",
      "detection_label": "none",
      "pid": 61765,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:38:53"
    },
    {
      "id": 521,
      "app_process_id": 7,
      "endpoint_id": 16,
      "parent_pid": 41495,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 50159,
      "command_source": "local_disk",
      "started_at": "2025-09-12 15:31:22"
    },
    {
      "id": 522,
      "app_process_id": 293,
      "endpoint_id": 1,
      "parent_pid": 46403,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 59866,
      "command_source": "temp_folder",
      "started_at": "2025-09-13 01:04:49"
    },
    {
      "id": 523,
      "app_process_id": 68,
      "endpoint_id": 30,
      "parent_pid": 28650,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 53691,
      "command_source": "user_profile",
      "started_at": "2025-09-10 17:47:00"
    },
    {
      "id": 524,
      "app_process_id": 430,
      "endpoint_id": 29,
      "parent_pid": 14673,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 43398,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:51:11"
    },
    {
      "id": 525,
      "app_process_id": 312,
      "endpoint_id": 11,
      "parent_pid": 58917,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 47650,
      "command_source": "network_path",
      "started_at": "2025-09-12 12:15:22"
    },
    {
      "id": 526,
      "app_process_id": 235,
      "endpoint_id": 5,
      "parent_pid": 34266,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36964,
      "command_source": "user_profile",
      "started_at": "2025-09-10 14:05:33"
    },
    {
      "id": 527,
      "app_process_id": 274,
      "endpoint_id": 18,
      "parent_pid": 8488,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 18729,
      "command_source": "temp_folder",
      "started_at": "2025-09-10 19:30:32"
    },
    {
      "id": 528,
      "app_process_id": 33,
      "endpoint_id": 26,
      "parent_pid": 6437,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 56161,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 15:42:09"
    },
    {
      "id": 529,
      "app_process_id": 148,
      "endpoint_id": 7,
      "parent_pid": 54781,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 17609,
      "command_source": "user_profile",
      "started_at": "2025-09-08 15:44:12"
    },
    {
      "id": 530,
      "app_process_id": 544,
      "endpoint_id": 14,
      "parent_pid": 56307,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 40131,
      "command_source": "user_profile",
      "started_at": "2025-09-08 21:19:02"
    },
    {
      "id": 531,
      "app_process_id": 362,
      "endpoint_id": 12,
      "parent_pid": 53635,
      "process_name": "conhost.exe",
      "category": "shell",
      "detection_label": "none",
      "pid": 19543,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 19:28:40"
    },
    {
      "id": 532,
      "app_process_id": 240,
      "endpoint_id": 12,
      "parent_pid": 32551,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 25659,
      "command_source": "user_profile",
      "started_at": "2025-09-09 14:34:08"
    },
    {
      "id": 533,
      "app_process_id": 477,
      "endpoint_id": 5,
      "parent_pid": 7825,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 59066,
      "command_source": "temp_folder",
      "started_at": "2025-09-09 17:38:57"
    },
    {
      "id": 534,
      "app_process_id": 560,
      "endpoint_id": 12,
      "parent_pid": 18770,
      "process_name": "node.exe",
      "category": "development",
      "detection_label": "none",
      "pid": 32766,
      "command_source": "user_profile",
      "started_at": "2025-09-13 02:00:13"
    },
    {
      "id": 535,
      "app_process_id": 408,
      "endpoint_id": 29,
      "parent_pid": 29568,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 26148,
      "command_source": "local_disk",
      "started_at": "2025-09-11 12:42:46"
    },
    {
      "id": 536,
      "app_process_id": 569,
      "endpoint_id": 8,
      "parent_pid": 10941,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 2445,
      "command_source": "local_disk",
      "started_at": "2025-09-11 19:05:51"
    },
    {
      "id": 537,
      "app_process_id": 403,
      "endpoint_id": 10,
      "parent_pid": 37069,
      "process_name": "olk.exe",
      "category": "email",
      "detection_label": "none",
      "pid": 57618,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 12:16:38"
    },
    {
      "id": 538,
      "app_process_id": 229,
      "endpoint_id": 15,
      "parent_pid": 27407,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 34097,
      "command_source": "local_disk",
      "started_at": "2025-09-08 18:09:45"
    },
    {
      "id": 539,
      "app_process_id": 562,
      "endpoint_id": 24,
      "parent_pid": 58496,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 18995,
      "command_source": "local_disk",
      "started_at": "2025-09-08 17:32:43"
    },
    {
      "id": 540,
      "app_process_id": 421,
      "endpoint_id": 30,
      "parent_pid": 27717,
      "process_name": "whoami.exe",
      "category": "account_discovery",
      "detection_label": "discovery_command",
      "pid": 30739,
      "command_source": "local_disk",
      "started_at": "2025-09-12 03:11:52"
    },
    {
      "id": 541,
      "app_process_id": 523,
      "endpoint_id": 9,
      "parent_pid": 41324,
      "process_name": "notepad.exe",
      "category": "file_management",
      "detection_label": "none",
      "pid": 56709,
      "command_source": "local_disk",
      "started_at": "2025-09-10 23:17:30"
    },
    {
      "id": 542,
      "app_process_id": 401,
      "endpoint_id": 4,
      "parent_pid": 22532,
      "process_name": "splwow64.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 28812,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:44:48"
    },
    {
      "id": 543,
      "app_process_id": 53,
      "endpoint_id": 26,
      "parent_pid": 62824,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 7487,
      "command_source": "local_disk",
      "started_at": "2025-09-09 13:19:53"
    },
    {
      "id": 544,
      "app_process_id": 441,
      "endpoint_id": 17,
      "parent_pid": 56072,
      "process_name": "msedgewebview2.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 40497,
      "command_source": "temp_folder",
      "started_at": "2025-09-08 23:54:11"
    },
    {
      "id": 545,
      "app_process_id": 571,
      "endpoint_id": 11,
      "parent_pid": 7435,
      "process_name": "chrome.exe",
      "category": "browsing",
      "detection_label": "none",
      "pid": 36946,
      "command_source": "local_disk",
      "started_at": "2025-09-13 01:12:13"
    },
    {
      "id": 546,
      "app_process_id": 352,
      "endpoint_id": 18,
      "parent_pid": 39809,
      "process_name": "excelcnv.exe",
      "category": "office",
      "detection_label": "none",
      "pid": 45022,
      "command_source": "local_disk",
      "started_at": "2025-09-10 19:59:12"
    }
  ]
}