// EDR Process Tree Logs with Labelled Launch Chains (edr-process-tree-logs-with-labelled-launch-chains) v1 — Prisma seed // Synthetic sample data, CC0-1.0. Generated deterministically; re-running the // generator with the same spec and seed reproduces this file exactly. // // Delegates are named after the tables (prisma.endpoints), which assumes models // mapped to those table names. Rename the delegates if your models differ. import { PrismaClient } from '@prisma/client'; const prisma = new PrismaClient(); async function main() { await prisma.endpoints.createMany({ data: [ { id: 1, hostname: "EP-9773", operating_system: "windows_11", department: "Sales", agent_version: "4.14.0" }, { id: 2, hostname: "EP-2488", operating_system: "windows_10", department: "Operations", agent_version: "3.10.10" }, { id: 3, hostname: "EP-4551", operating_system: "windows_10", department: "Engineering", agent_version: "0.11.13" }, { id: 4, hostname: "EP-8522", operating_system: "windows_11", department: "Finance", agent_version: "8.11.15" }, { id: 5, hostname: "EP-8604", operating_system: "windows_11", department: "Sales", agent_version: "5.12.11" }, { id: 6, hostname: "EP-9325", operating_system: "windows_10", department: "Engineering", agent_version: "3.19.14" }, { id: 7, hostname: "EP-3383", operating_system: "windows_10", department: "Finance", agent_version: "2.3.10" }, { id: 8, hostname: "EP-3132", operating_system: "windows_11", department: "Sales", agent_version: "7.16.16" }, { id: 9, hostname: "EP-0115", operating_system: "windows_11", department: "Engineering", agent_version: "9.14.16" }, { id: 10, hostname: "EP-3198", operating_system: "windows_11", department: "Finance", agent_version: "0.1.15" }, { id: 11, hostname: "EP-1551", operating_system: "windows_11", department: "Sales", agent_version: "7.18.4" }, { id: 12, hostname: "EP-3197", operating_system: "windows_server_2022", department: "Operations", agent_version: "2.8.12" }, { id: 13, hostname: "EP-5750", operating_system: "windows_10", department: "Engineering", agent_version: "7.20.5" }, { id: 14, hostname: "EP-5055", operating_system: "windows_server_2022", department: "Sales", agent_version: "1.16.9" }, { id: 15, hostname: "EP-9122", operating_system: "windows_11", department: "Finance", agent_version: "4.5.6" }, { id: 16, hostname: "EP-4422", operating_system: "windows_10", department: "Finance", agent_version: "2.11.3" }, { id: 17, hostname: "EP-6451", operating_system: "windows_10", department: "Engineering", agent_version: "8.10.19" }, { id: 18, hostname: "EP-5661", operating_system: "windows_10", department: "Support", agent_version: "3.0.5" }, { id: 19, hostname: "EP-8904", operating_system: "windows_10", department: "Sales", agent_version: "5.20.6" }, { id: 20, hostname: "EP-9842", operating_system: "windows_10", department: "Engineering", agent_version: "9.14.5" }, { id: 21, hostname: "EP-5663", operating_system: "windows_11", department: "Sales", agent_version: "5.9.4" }, { id: 22, hostname: "EP-6111", operating_system: "windows_11", department: "Support", agent_version: "8.6.19" }, { id: 23, hostname: "EP-8476", operating_system: "windows_server_2022", department: "Support", agent_version: "1.2.8" }, { id: 24, hostname: "EP-3816", operating_system: "windows_11", department: "Engineering", agent_version: "6.7.18" }, { id: 25, hostname: "EP-6756", operating_system: "windows_10", department: "Support", agent_version: "1.18.20" }, { id: 26, hostname: "EP-4063", operating_system: "windows_server_2022", department: "Finance", agent_version: "5.16.13" }, { id: 27, hostname: "EP-7962", operating_system: "windows_11", department: "Support", agent_version: "0.11.14" }, { id: 28, hostname: "EP-3578", operating_system: "windows_11", department: "Engineering", agent_version: "2.20.7" }, { id: 29, hostname: "EP-5311", operating_system: "windows_11", department: "Engineering", agent_version: "1.2.18" }, { id: 30, hostname: "EP-0194", operating_system: "windows_11", department: "Sales", agent_version: "2.10.12" }, ], }); await prisma.launch_chains.createMany({ data: [ { id: 1, catalogue: "chains-v1", app_process: "msedge.exe", child_process: "msedgewebview2.exe", category: "browsing", detection_label: "none" }, { id: 2, catalogue: "chains-v1", app_process: "chrome.exe", child_process: "chrome.exe", category: "browsing", detection_label: "none" }, { id: 3, catalogue: "chains-v1", app_process: "winword.exe", child_process: "splwow64.exe", category: "office", detection_label: "none" }, { id: 4, catalogue: "chains-v1", app_process: "excel.exe", child_process: "excelcnv.exe", category: "office", detection_label: "none" }, { id: 5, catalogue: "chains-v1", app_process: "code.exe", child_process: "node.exe", category: "development", detection_label: "none" }, { id: 6, catalogue: "chains-v1", app_process: "outlook.exe", child_process: "olk.exe", category: "email", detection_label: "none" }, { id: 7, catalogue: "chains-v1", app_process: "teams.exe", child_process: "teams.exe", category: "collaboration", detection_label: "none" }, { id: 8, catalogue: "chains-v1", app_process: "explorer.exe", child_process: "notepad.exe", category: "file_management", detection_label: "none" }, { id: 9, catalogue: "chains-v1", app_process: "cmd.exe", child_process: "conhost.exe", category: "shell", detection_label: "none" }, { id: 10, catalogue: "chains-v1", app_process: "winword.exe", child_process: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child" }, { id: 11, catalogue: "chains-v1", app_process: "outlook.exe", child_process: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child" }, { id: 12, catalogue: "chains-v1", app_process: "excel.exe", child_process: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load" }, { id: 13, catalogue: "chains-v1", app_process: "cmd.exe", child_process: "whoami.exe", category: "account_discovery", detection_label: "discovery_command" }, { id: 14, catalogue: "chains-v1", app_process: "cmd.exe", child_process: "certutil.exe", category: "file_download_utility", detection_label: "download_utility" }, { id: 15, catalogue: "chains-v1", app_process: "powershell.exe", child_process: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task" }, ], }); await prisma.sessions.createMany({ data: [ { id: 1, endpoint_id: 30, hostname: "EP-0194", logon_user: "Leda.Bergnaum99", root_pid: 1223, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:50:16Z") }, { id: 2, endpoint_id: 16, hostname: "EP-4422", logon_user: "Floyd.Kerluke8", root_pid: 9253, root_process: "explorer.exe", logon_at: new Date("2025-09-12T14:01:25Z") }, { id: 3, endpoint_id: 8, hostname: "EP-3132", logon_user: "Madaline_Koepp", root_pid: 3588, root_process: "explorer.exe", logon_at: new Date("2025-09-08T09:39:24Z") }, { id: 4, endpoint_id: 10, hostname: "EP-3198", logon_user: "Raven.Rempel82", root_pid: 9279, root_process: "explorer.exe", logon_at: new Date("2025-09-10T13:35:16Z") }, { id: 5, endpoint_id: 9, hostname: "EP-0115", logon_user: "Megane.Ryan58", root_pid: 4092, root_process: "explorer.exe", logon_at: new Date("2025-09-12T13:52:52Z") }, { id: 6, endpoint_id: 19, hostname: "EP-8904", logon_user: "Bernhard.Legros", root_pid: 2205, root_process: "explorer.exe", logon_at: new Date("2025-09-08T14:40:47Z") }, { id: 7, endpoint_id: 1, hostname: "EP-9773", logon_user: "Efren_Walsh", root_pid: 777, root_process: "explorer.exe", logon_at: new Date("2025-09-08T12:04:44Z") }, { id: 8, endpoint_id: 14, hostname: "EP-5055", logon_user: "Roberto.Blanda", root_pid: 8148, root_process: "explorer.exe", logon_at: new Date("2025-09-09T09:18:05Z") }, { id: 9, endpoint_id: 14, hostname: "EP-5055", logon_user: "Kelly_Wiegand", root_pid: 5882, root_process: "explorer.exe", logon_at: new Date("2025-09-08T15:47:13Z") }, { id: 10, endpoint_id: 18, hostname: "EP-5661", logon_user: "Bertram.Langworth-Satterfield8", root_pid: 6676, root_process: "explorer.exe", logon_at: new Date("2025-09-08T17:22:19Z") }, { id: 11, endpoint_id: 7, hostname: "EP-3383", logon_user: "Sierra.Grant", root_pid: 2105, root_process: "explorer.exe", logon_at: new Date("2025-09-12T15:23:02Z") }, { id: 12, endpoint_id: 21, hostname: "EP-5663", logon_user: "Rusty_Considine", root_pid: 4059, root_process: "explorer.exe", logon_at: new Date("2025-09-12T16:45:44Z") }, { id: 13, endpoint_id: 22, hostname: "EP-6111", logon_user: "Rashad.Lueilwitz", root_pid: 6372, root_process: "explorer.exe", logon_at: new Date("2025-09-08T12:33:57Z") }, { id: 14, endpoint_id: 20, hostname: "EP-9842", logon_user: "Lawson.Ledner4", root_pid: 5631, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:34:02Z") }, { id: 15, endpoint_id: 26, hostname: "EP-4063", logon_user: "Randal.McLaughlin", root_pid: 1207, root_process: "explorer.exe", logon_at: new Date("2025-09-09T13:13:27Z") }, { id: 16, endpoint_id: 11, hostname: "EP-1551", logon_user: "Brionna.Fay", root_pid: 5993, root_process: "explorer.exe", logon_at: new Date("2025-09-08T10:47:10Z") }, { id: 17, endpoint_id: 19, hostname: "EP-8904", logon_user: "Berry.Stehr70", root_pid: 7447, root_process: "explorer.exe", logon_at: new Date("2025-09-09T17:20:33Z") }, { id: 18, endpoint_id: 19, hostname: "EP-8904", logon_user: "Wilhelm_Fisher", root_pid: 5353, root_process: "explorer.exe", logon_at: new Date("2025-09-09T13:43:36Z") }, { id: 19, endpoint_id: 30, hostname: "EP-0194", logon_user: "Chelsea_Spinka-OReilly", root_pid: 5838, root_process: "explorer.exe", logon_at: new Date("2025-09-11T19:42:29Z") }, { id: 20, endpoint_id: 12, hostname: "EP-3197", logon_user: "Antonina_Kihn", root_pid: 2248, root_process: "explorer.exe", logon_at: new Date("2025-09-12T18:53:08Z") }, { id: 21, endpoint_id: 8, hostname: "EP-3132", logon_user: "Jayda.Gulgowski82", root_pid: 1578, root_process: "explorer.exe", logon_at: new Date("2025-09-08T11:47:42Z") }, { id: 22, endpoint_id: 16, hostname: "EP-4422", logon_user: "Kaley_Langosh40", root_pid: 3475, root_process: "explorer.exe", logon_at: new Date("2025-09-10T15:16:16Z") }, { id: 23, endpoint_id: 20, hostname: "EP-9842", logon_user: "Jan.Watsica50", root_pid: 3826, root_process: "explorer.exe", logon_at: new Date("2025-09-12T09:46:14Z") }, { id: 24, endpoint_id: 11, hostname: "EP-1551", logon_user: "Christian.Ortiz97", root_pid: 4927, root_process: "explorer.exe", logon_at: new Date("2025-09-12T17:05:37Z") }, { id: 25, endpoint_id: 2, hostname: "EP-2488", logon_user: "Gillian_Hoppe31", root_pid: 3737, root_process: "explorer.exe", logon_at: new Date("2025-09-08T10:47:51Z") }, { id: 26, endpoint_id: 2, hostname: "EP-2488", logon_user: "Cloyd.Renner", root_pid: 3041, root_process: "explorer.exe", logon_at: new Date("2025-09-12T14:53:11Z") }, { id: 27, endpoint_id: 1, hostname: "EP-9773", logon_user: "Alexander_Rippin95", root_pid: 6515, root_process: "explorer.exe", logon_at: new Date("2025-09-09T12:19:48Z") }, { id: 28, endpoint_id: 29, hostname: "EP-5311", logon_user: "Nikko_Cormier-Schmeler36", root_pid: 1782, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:00:55Z") }, { id: 29, endpoint_id: 30, hostname: "EP-0194", logon_user: "Lyle_Bergstrom", root_pid: 4443, root_process: "explorer.exe", logon_at: new Date("2025-09-10T15:51:06Z") }, { id: 30, endpoint_id: 5, hostname: "EP-8604", logon_user: "Jaylin_Bradtke83", root_pid: 5435, root_process: "explorer.exe", logon_at: new Date("2025-09-09T16:43:42Z") }, { id: 31, endpoint_id: 17, hostname: "EP-6451", logon_user: "Van_Wyman14", root_pid: 9042, root_process: "explorer.exe", logon_at: new Date("2025-09-11T10:37:53Z") }, { id: 32, endpoint_id: 20, hostname: "EP-9842", logon_user: "Felipa_Feil51", root_pid: 7143, root_process: "explorer.exe", logon_at: new Date("2025-09-12T19:05:27Z") }, { id: 33, endpoint_id: 26, hostname: "EP-4063", logon_user: "Leonard.Funk", root_pid: 3235, root_process: "explorer.exe", logon_at: new Date("2025-09-08T08:57:48Z") }, { id: 34, endpoint_id: 30, hostname: "EP-0194", logon_user: "Casimer.Beahan", root_pid: 9204, root_process: "explorer.exe", logon_at: new Date("2025-09-08T16:00:03Z") }, { id: 35, endpoint_id: 26, hostname: "EP-4063", logon_user: "Jerrell.Dare87", root_pid: 5419, root_process: "explorer.exe", logon_at: new Date("2025-09-08T11:26:23Z") }, { id: 36, endpoint_id: 20, hostname: "EP-9842", logon_user: "Randy.Kunze86", root_pid: 4428, root_process: "explorer.exe", logon_at: new Date("2025-09-09T16:55:52Z") }, { id: 37, endpoint_id: 2, hostname: "EP-2488", logon_user: "Taurean_Ortiz61", root_pid: 2950, root_process: "explorer.exe", logon_at: new Date("2025-09-11T16:10:28Z") }, { id: 38, endpoint_id: 21, hostname: "EP-5663", logon_user: "Mozell.Williamson", root_pid: 8575, root_process: "explorer.exe", logon_at: new Date("2025-09-08T07:37:27Z") }, { id: 39, endpoint_id: 12, hostname: "EP-3197", logon_user: "Leonardo.Kulas", root_pid: 4269, root_process: "explorer.exe", logon_at: new Date("2025-09-09T10:44:09Z") }, { id: 40, endpoint_id: 18, hostname: "EP-5661", logon_user: "Ayana_Okuneva", root_pid: 9039, root_process: "explorer.exe", logon_at: new Date("2025-09-08T13:26:06Z") }, { id: 41, endpoint_id: 19, hostname: "EP-8904", logon_user: "Ambrose_Johnston", root_pid: 5450, root_process: "explorer.exe", logon_at: new Date("2025-09-08T05:39:23Z") }, { id: 42, endpoint_id: 20, hostname: "EP-9842", logon_user: "Shelly.Crist", root_pid: 5987, root_process: "explorer.exe", logon_at: new Date("2025-09-09T13:32:39Z") }, { id: 43, endpoint_id: 5, hostname: "EP-8604", logon_user: "Felipe.Hayes87", root_pid: 2202, root_process: "explorer.exe", logon_at: new Date("2025-09-10T16:38:58Z") }, { id: 44, endpoint_id: 6, hostname: "EP-9325", logon_user: "Roma.Cole", root_pid: 2524, root_process: "explorer.exe", logon_at: new Date("2025-09-12T07:49:08Z") }, { id: 45, endpoint_id: 11, hostname: "EP-1551", logon_user: "Taylor.Prosacco", root_pid: 8295, root_process: "explorer.exe", logon_at: new Date("2025-09-12T17:25:33Z") }, { id: 46, endpoint_id: 15, hostname: "EP-9122", logon_user: "Lauryn.Moore65", root_pid: 1692, root_process: "explorer.exe", logon_at: new Date("2025-09-12T18:19:26Z") }, { id: 47, endpoint_id: 30, hostname: "EP-0194", logon_user: "Jarrett.Wiegand", root_pid: 8438, root_process: "explorer.exe", logon_at: new Date("2025-09-10T16:03:21Z") }, { id: 48, endpoint_id: 10, hostname: "EP-3198", logon_user: "Aric.Altenwerth2", root_pid: 1271, root_process: "explorer.exe", logon_at: new Date("2025-09-08T06:31:31Z") }, { id: 49, endpoint_id: 13, hostname: "EP-5750", logon_user: "Cierra_Franecki48", root_pid: 7754, root_process: "explorer.exe", logon_at: new Date("2025-09-09T15:46:14Z") }, { id: 50, endpoint_id: 17, hostname: "EP-6451", logon_user: "Margarett.Russel", root_pid: 2098, root_process: "explorer.exe", logon_at: new Date("2025-09-09T16:38:52Z") }, { id: 51, endpoint_id: 24, hostname: "EP-3816", logon_user: "Joesph_Kreiger9", root_pid: 3525, root_process: "explorer.exe", logon_at: new Date("2025-09-08T10:18:42Z") }, { id: 52, endpoint_id: 28, hostname: "EP-3578", logon_user: "Lolita.Treutel73", root_pid: 2323, root_process: "explorer.exe", logon_at: new Date("2025-09-08T17:20:07Z") }, { id: 53, endpoint_id: 23, hostname: "EP-8476", logon_user: "Roosevelt.Collins47", root_pid: 5187, root_process: "explorer.exe", logon_at: new Date("2025-09-10T14:51:06Z") }, { id: 54, endpoint_id: 7, hostname: "EP-3383", logon_user: "Brook.Yost", root_pid: 2990, root_process: "explorer.exe", logon_at: new Date("2025-09-12T14:15:22Z") }, { id: 55, endpoint_id: 19, hostname: "EP-8904", logon_user: "Adolf_Lakin15", root_pid: 4258, root_process: "explorer.exe", logon_at: new Date("2025-09-09T10:27:15Z") }, { id: 56, endpoint_id: 30, hostname: "EP-0194", logon_user: "Uriel.Hansen", root_pid: 2847, root_process: "explorer.exe", logon_at: new Date("2025-09-11T17:25:09Z") }, { id: 57, endpoint_id: 27, hostname: "EP-7962", logon_user: "Jeannette.OKeefe70", root_pid: 8454, root_process: "explorer.exe", logon_at: new Date("2025-09-12T15:47:54Z") }, { id: 58, endpoint_id: 7, hostname: "EP-3383", logon_user: "Fred_Howell32", root_pid: 5507, root_process: "explorer.exe", logon_at: new Date("2025-09-09T17:52:23Z") }, { id: 59, endpoint_id: 2, hostname: "EP-2488", logon_user: "Kameron.Kautzer", root_pid: 3499, root_process: "explorer.exe", logon_at: new Date("2025-09-08T13:53:20Z") }, { id: 60, endpoint_id: 25, hostname: "EP-6756", logon_user: "Nicolas_Hammes", root_pid: 1935, root_process: "explorer.exe", logon_at: new Date("2025-09-10T23:22:02Z") }, { id: 61, endpoint_id: 29, hostname: "EP-5311", logon_user: "Solon.Rohan47", root_pid: 6985, root_process: "explorer.exe", logon_at: new Date("2025-09-11T08:45:10Z") }, { id: 62, endpoint_id: 14, hostname: "EP-5055", logon_user: "Myrna_Orn", root_pid: 5166, root_process: "explorer.exe", logon_at: new Date("2025-09-10T13:42:42Z") }, { id: 63, endpoint_id: 20, hostname: "EP-9842", logon_user: "Mitchell.Glover-Kuhic", root_pid: 6555, root_process: "explorer.exe", logon_at: new Date("2025-09-08T16:25:05Z") }, { id: 64, endpoint_id: 4, hostname: "EP-8522", logon_user: "Jacey_Nienow73", root_pid: 2187, root_process: "explorer.exe", logon_at: new Date("2025-09-11T17:46:02Z") }, { id: 65, endpoint_id: 28, hostname: "EP-3578", logon_user: "Malachi.Tremblay12", root_pid: 2048, root_process: "explorer.exe", logon_at: new Date("2025-09-08T11:49:50Z") }, { id: 66, endpoint_id: 25, hostname: "EP-6756", logon_user: "Cristopher.Ankunding", root_pid: 2140, root_process: "explorer.exe", logon_at: new Date("2025-09-08T10:09:34Z") }, { id: 67, endpoint_id: 19, hostname: "EP-8904", logon_user: "Lionel_Bosco", root_pid: 9805, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:54:10Z") }, { id: 68, endpoint_id: 26, hostname: "EP-4063", logon_user: "Andreane.Cartwright30", root_pid: 3905, root_process: "explorer.exe", logon_at: new Date("2025-09-08T14:58:41Z") }, { id: 69, endpoint_id: 14, hostname: "EP-5055", logon_user: "Lelah.Okuneva", root_pid: 807, root_process: "explorer.exe", logon_at: new Date("2025-09-11T09:36:41Z") }, { id: 70, endpoint_id: 14, hostname: "EP-5055", logon_user: "Vince.Johns", root_pid: 9033, root_process: "explorer.exe", logon_at: new Date("2025-09-10T10:57:01Z") }, { id: 71, endpoint_id: 2, hostname: "EP-2488", logon_user: "Jules_Hettinger56", root_pid: 9165, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:21:00Z") }, { id: 72, endpoint_id: 23, hostname: "EP-8476", logon_user: "Name_Walter57", root_pid: 9273, root_process: "explorer.exe", logon_at: new Date("2025-09-08T10:53:20Z") }, { id: 73, endpoint_id: 15, hostname: "EP-9122", logon_user: "Mae_Jones", root_pid: 2342, root_process: "explorer.exe", logon_at: new Date("2025-09-08T15:02:44Z") }, { id: 74, endpoint_id: 8, hostname: "EP-3132", logon_user: "Emerald.Stehr7", root_pid: 8020, root_process: "explorer.exe", logon_at: new Date("2025-09-11T13:21:33Z") }, { id: 75, endpoint_id: 26, hostname: "EP-4063", logon_user: "Palma_Schuppe", root_pid: 799, root_process: "explorer.exe", logon_at: new Date("2025-09-08T11:12:44Z") }, { id: 76, endpoint_id: 17, hostname: "EP-6451", logon_user: "Ellis.Parker", root_pid: 7760, root_process: "explorer.exe", logon_at: new Date("2025-09-11T11:04:29Z") }, { id: 77, endpoint_id: 11, hostname: "EP-1551", logon_user: "Idell.Mitchell", root_pid: 6081, root_process: "explorer.exe", logon_at: new Date("2025-09-12T10:34:42Z") }, { id: 78, endpoint_id: 28, hostname: "EP-3578", logon_user: "Charlene_MacGyver", root_pid: 4336, root_process: "explorer.exe", logon_at: new Date("2025-09-12T13:09:16Z") }, { id: 79, endpoint_id: 24, hostname: "EP-3816", logon_user: "Chelsea.Rath9", root_pid: 1688, root_process: "explorer.exe", logon_at: new Date("2025-09-09T14:01:46Z") }, { id: 80, endpoint_id: 1, hostname: "EP-9773", logon_user: "Johnpaul.Feil", root_pid: 5566, root_process: "explorer.exe", logon_at: new Date("2025-09-10T13:56:21Z") }, { id: 81, endpoint_id: 14, hostname: "EP-5055", logon_user: "Lewis.Torp", root_pid: 1248, root_process: "explorer.exe", logon_at: new Date("2025-09-11T16:50:43Z") }, { id: 82, endpoint_id: 7, hostname: "EP-3383", logon_user: "Kristian.Fadel", root_pid: 3087, root_process: "explorer.exe", logon_at: new Date("2025-09-08T14:45:58Z") }, { id: 83, endpoint_id: 26, hostname: "EP-4063", logon_user: "Meda.Dibbert50", root_pid: 8003, root_process: "explorer.exe", logon_at: new Date("2025-09-09T09:20:21Z") }, { id: 84, endpoint_id: 29, hostname: "EP-5311", logon_user: "Summer_Bartell64", root_pid: 6330, root_process: "explorer.exe", logon_at: new Date("2025-09-11T10:38:51Z") }, { id: 85, endpoint_id: 9, hostname: "EP-0115", logon_user: "Filiberto_Abbott", root_pid: 7128, root_process: "explorer.exe", logon_at: new Date("2025-09-10T15:15:37Z") }, { id: 86, endpoint_id: 24, hostname: "EP-3816", logon_user: "Darryl.Kuhlman", root_pid: 4959, root_process: "explorer.exe", logon_at: new Date("2025-09-12T10:03:06Z") }, { id: 87, endpoint_id: 8, hostname: "EP-3132", logon_user: "Lelah_Raynor10", root_pid: 9087, root_process: "explorer.exe", logon_at: new Date("2025-09-11T14:51:53Z") }, { id: 88, endpoint_id: 27, hostname: "EP-7962", logon_user: "Isabelle_Kub", root_pid: 4101, root_process: "explorer.exe", logon_at: new Date("2025-09-11T09:28:50Z") }, { id: 89, endpoint_id: 18, hostname: "EP-5661", logon_user: "Sonia.Stamm60", root_pid: 7044, root_process: "explorer.exe", logon_at: new Date("2025-09-10T14:54:34Z") }, { id: 90, endpoint_id: 14, hostname: "EP-5055", logon_user: "Anjali.Moore67", root_pid: 5514, root_process: "explorer.exe", logon_at: new Date("2025-09-11T08:40:22Z") }, { id: 91, endpoint_id: 19, hostname: "EP-8904", logon_user: "Stanton.Grady49", root_pid: 7689, root_process: "explorer.exe", logon_at: new Date("2025-09-12T09:45:51Z") }, { id: 92, endpoint_id: 29, hostname: "EP-5311", logon_user: "Mark.Hegmann84", root_pid: 7465, root_process: "explorer.exe", logon_at: new Date("2025-09-08T17:05:06Z") }, { id: 93, endpoint_id: 1, hostname: "EP-9773", logon_user: "Christina_Kunze55", root_pid: 9342, root_process: "explorer.exe", logon_at: new Date("2025-09-10T13:37:29Z") }, { id: 94, endpoint_id: 4, hostname: "EP-8522", logon_user: "Guillermo.Brakus", root_pid: 8955, root_process: "explorer.exe", logon_at: new Date("2025-09-11T07:05:56Z") }, { id: 95, endpoint_id: 7, hostname: "EP-3383", logon_user: "Pete.Bednar", root_pid: 9803, root_process: "explorer.exe", logon_at: new Date("2025-09-10T20:13:45Z") }, { id: 96, endpoint_id: 9, hostname: "EP-0115", logon_user: "Marielle.Leuschke", root_pid: 9109, root_process: "explorer.exe", logon_at: new Date("2025-09-12T07:52:01Z") }, { id: 97, endpoint_id: 1, hostname: "EP-9773", logon_user: "Shea_Deckow35", root_pid: 3764, root_process: "explorer.exe", logon_at: new Date("2025-09-08T15:43:48Z") }, { id: 98, endpoint_id: 17, hostname: "EP-6451", logon_user: "Katrina.Dach21", root_pid: 8504, root_process: "explorer.exe", logon_at: new Date("2025-09-08T16:11:44Z") }, { id: 99, endpoint_id: 9, hostname: "EP-0115", logon_user: "Zackary.Dickinson53", root_pid: 8717, root_process: "explorer.exe", logon_at: new Date("2025-09-08T21:39:40Z") }, { id: 100, endpoint_id: 13, hostname: "EP-5750", logon_user: "Denis_Kunde98", root_pid: 4103, root_process: "explorer.exe", logon_at: new Date("2025-09-08T15:13:20Z") }, { id: 101, endpoint_id: 25, hostname: "EP-6756", logon_user: "Garry_Nicolas", root_pid: 7446, root_process: "explorer.exe", logon_at: new Date("2025-09-10T12:55:46Z") }, { id: 102, endpoint_id: 6, hostname: "EP-9325", logon_user: "Jo.Wilderman68", root_pid: 2779, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:45:52Z") }, { id: 103, endpoint_id: 13, hostname: "EP-5750", logon_user: "Newell_Rippin71", root_pid: 3347, root_process: "explorer.exe", logon_at: new Date("2025-09-09T15:29:21Z") }, { id: 104, endpoint_id: 21, hostname: "EP-5663", logon_user: "Florence.Hackett5", root_pid: 7548, root_process: "explorer.exe", logon_at: new Date("2025-09-09T10:32:09Z") }, { id: 105, endpoint_id: 18, hostname: "EP-5661", logon_user: "Gavin.Windler", root_pid: 9411, root_process: "explorer.exe", logon_at: new Date("2025-09-12T10:34:49Z") }, { id: 106, endpoint_id: 12, hostname: "EP-3197", logon_user: "Junior.Haley31", root_pid: 8968, root_process: "explorer.exe", logon_at: new Date("2025-09-08T13:43:23Z") }, { id: 107, endpoint_id: 11, hostname: "EP-1551", logon_user: "Nellie_Senger", root_pid: 7525, root_process: "explorer.exe", logon_at: new Date("2025-09-12T11:50:39Z") }, { id: 108, endpoint_id: 1, hostname: "EP-9773", logon_user: "Fern.Boehm92", root_pid: 9857, root_process: "explorer.exe", logon_at: new Date("2025-09-12T18:52:32Z") }, { id: 109, endpoint_id: 1, hostname: "EP-9773", logon_user: "Vicki.Glover23", root_pid: 9809, root_process: "explorer.exe", logon_at: new Date("2025-09-09T13:09:52Z") }, { id: 110, endpoint_id: 5, hostname: "EP-8604", logon_user: "Brenna.Huels79", root_pid: 4857, root_process: "explorer.exe", logon_at: new Date("2025-09-10T11:41:38Z") }, { id: 111, endpoint_id: 25, hostname: "EP-6756", logon_user: "Estell_Conroy", root_pid: 4893, root_process: "explorer.exe", logon_at: new Date("2025-09-11T10:16:51Z") }, { id: 112, endpoint_id: 3, hostname: "EP-4551", logon_user: "Hubert_Bergnaum", root_pid: 8684, root_process: "explorer.exe", logon_at: new Date("2025-09-11T15:28:27Z") }, { id: 113, endpoint_id: 22, hostname: "EP-6111", logon_user: "Kris.Roob60", root_pid: 4002, root_process: "explorer.exe", logon_at: new Date("2025-09-09T11:05:51Z") }, { id: 114, endpoint_id: 26, hostname: "EP-4063", logon_user: "Kathy_Beahan54", root_pid: 1599, root_process: "explorer.exe", logon_at: new Date("2025-09-08T15:46:23Z") }, { id: 115, endpoint_id: 28, hostname: "EP-3578", logon_user: "Antonia_Stamm13", root_pid: 6071, root_process: "explorer.exe", logon_at: new Date("2025-09-12T13:24:36Z") }, { id: 116, endpoint_id: 9, hostname: "EP-0115", logon_user: "Herminio.Cummings26", root_pid: 1596, root_process: "explorer.exe", logon_at: new Date("2025-09-10T10:34:41Z") }, { id: 117, endpoint_id: 25, hostname: "EP-6756", logon_user: "Roberta_Wintheiser8", root_pid: 6672, root_process: "explorer.exe", logon_at: new Date("2025-09-12T18:57:04Z") }, { id: 118, endpoint_id: 18, hostname: "EP-5661", logon_user: "Fletcher_Zulauf", root_pid: 4211, root_process: "explorer.exe", logon_at: new Date("2025-09-10T15:40:57Z") }, { id: 119, endpoint_id: 21, hostname: "EP-5663", logon_user: "Kacie_Quitzon", root_pid: 6808, root_process: "explorer.exe", logon_at: new Date("2025-09-10T19:29:09Z") }, { id: 120, endpoint_id: 9, hostname: "EP-0115", logon_user: "Billy_Cartwright88", root_pid: 5090, root_process: "explorer.exe", logon_at: new Date("2025-09-10T15:39:46Z") }, { id: 121, endpoint_id: 5, hostname: "EP-8604", logon_user: "Heath_Adams", root_pid: 6355, root_process: "explorer.exe", logon_at: new Date("2025-09-09T13:09:08Z") }, { id: 122, endpoint_id: 17, hostname: "EP-6451", logon_user: "Tami.Ritchie79", root_pid: 6690, root_process: "explorer.exe", logon_at: new Date("2025-09-10T12:51:30Z") }, { id: 123, endpoint_id: 4, hostname: "EP-8522", logon_user: "Osborne.Schuster", root_pid: 9605, root_process: "explorer.exe", logon_at: new Date("2025-09-10T14:09:48Z") }, { id: 124, endpoint_id: 7, hostname: "EP-3383", logon_user: "Margarete_Von49", root_pid: 3310, root_process: "explorer.exe", logon_at: new Date("2025-09-09T08:55:54Z") }, { id: 125, endpoint_id: 10, hostname: "EP-3198", logon_user: "Sim_Schimmel62", root_pid: 6716, root_process: "explorer.exe", logon_at: new Date("2025-09-08T12:54:49Z") }, { id: 126, endpoint_id: 12, hostname: "EP-3197", logon_user: "Lacy_Stehr16", root_pid: 9993, root_process: "explorer.exe", logon_at: new Date("2025-09-12T14:00:45Z") }, { id: 127, endpoint_id: 22, hostname: "EP-6111", logon_user: "Sonia_Cormier7", root_pid: 1504, root_process: "explorer.exe", logon_at: new Date("2025-09-11T09:36:38Z") }, { id: 128, endpoint_id: 10, hostname: "EP-3198", logon_user: "Gardner_Hagenes85", root_pid: 3770, root_process: "explorer.exe", logon_at: new Date("2025-09-09T11:34:32Z") }, { id: 129, endpoint_id: 1, hostname: "EP-9773", logon_user: "Corbin_Kassulke", root_pid: 5131, root_process: "explorer.exe", logon_at: new Date("2025-09-08T18:51:47Z") }, { id: 130, endpoint_id: 8, hostname: "EP-3132", logon_user: "Rashad.Shields", root_pid: 6080, root_process: "explorer.exe", logon_at: new Date("2025-09-12T10:07:23Z") }, { id: 131, endpoint_id: 3, hostname: "EP-4551", logon_user: "Gunner_Mayer16", root_pid: 807, root_process: "explorer.exe", logon_at: new Date("2025-09-11T15:46:39Z") }, { id: 132, endpoint_id: 5, hostname: "EP-8604", logon_user: "Lorna.Cummerata71", root_pid: 9527, root_process: "explorer.exe", logon_at: new Date("2025-09-11T11:55:58Z") }, ], }); await prisma.app_processes.createMany({ data: [ { id: 1, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 59762, integrity_level: "medium", started_at: new Date("2025-09-10T11:50:44Z") }, { id: 2, session_id: 94, endpoint_id: 4, parent_pid: 8955, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 36180, integrity_level: "medium", started_at: new Date("2025-09-11T08:15:16Z") }, { id: 3, session_id: 130, endpoint_id: 8, parent_pid: 6080, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 43396, integrity_level: "medium", started_at: new Date("2025-09-12T11:22:06Z") }, { id: 4, session_id: 4, endpoint_id: 10, parent_pid: 9279, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 13733, integrity_level: "medium", started_at: new Date("2025-09-10T13:41:50Z") }, { id: 5, session_id: 57, endpoint_id: 27, parent_pid: 8454, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 4607, integrity_level: "medium", started_at: new Date("2025-09-12T15:51:29Z") }, { id: 6, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 26184, integrity_level: "medium", started_at: new Date("2025-09-11T17:14:40Z") }, { id: 7, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 41495, integrity_level: "medium", started_at: new Date("2025-09-12T15:30:38Z") }, { id: 8, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 27161, integrity_level: "medium", started_at: new Date("2025-09-10T16:47:02Z") }, { id: 9, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 51181, integrity_level: "medium", started_at: new Date("2025-09-12T11:03:31Z") }, { id: 10, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 39319, integrity_level: "medium", started_at: new Date("2025-09-08T15:07:14Z") }, { id: 11, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 25035, integrity_level: "medium", started_at: new Date("2025-09-09T17:12:19Z") }, { id: 12, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 52296, integrity_level: "medium", started_at: new Date("2025-09-11T14:10:33Z") }, { id: 13, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 63035, integrity_level: "low", started_at: new Date("2025-09-08T16:27:00Z") }, { id: 14, session_id: 25, endpoint_id: 2, parent_pid: 3737, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 45424, integrity_level: "high", started_at: new Date("2025-09-08T12:01:56Z") }, { id: 15, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 32021, integrity_level: "low", started_at: new Date("2025-09-08T17:36:36Z") }, { id: 16, session_id: 130, endpoint_id: 8, parent_pid: 6080, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 16776, integrity_level: "low", started_at: new Date("2025-09-12T12:29:32Z") }, { id: 17, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 45058, integrity_level: "low", started_at: new Date("2025-09-08T06:55:37Z") }, { id: 18, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 39435, integrity_level: "medium", started_at: new Date("2025-09-08T13:09:17Z") }, { id: 19, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 44084, integrity_level: "medium", started_at: new Date("2025-09-11T10:45:33Z") }, { id: 20, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 31578, integrity_level: "medium", started_at: new Date("2025-09-11T08:58:20Z") }, { id: 21, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 33716, integrity_level: "medium", started_at: new Date("2025-09-11T10:59:47Z") }, { id: 22, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 5433, integrity_level: "medium", started_at: new Date("2025-09-09T11:07:23Z") }, { id: 23, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 21327, integrity_level: "medium", started_at: new Date("2025-09-11T10:16:03Z") }, { id: 24, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 45339, integrity_level: "medium", started_at: new Date("2025-09-11T16:11:23Z") }, { id: 25, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 8704, integrity_level: "medium", started_at: new Date("2025-09-09T18:50:04Z") }, { id: 26, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28134, integrity_level: "medium", started_at: new Date("2025-09-12T17:43:34Z") }, { id: 27, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 31659, integrity_level: "low", started_at: new Date("2025-09-12T19:53:08Z") }, { id: 28, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 55377, integrity_level: "medium", started_at: new Date("2025-09-10T18:10:11Z") }, { id: 29, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 10195, integrity_level: "low", started_at: new Date("2025-09-10T13:25:51Z") }, { id: 30, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 52146, integrity_level: "medium", started_at: new Date("2025-09-11T11:45:07Z") }, { id: 31, session_id: 27, endpoint_id: 1, parent_pid: 6515, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 14661, integrity_level: "low", started_at: new Date("2025-09-09T13:00:56Z") }, { id: 32, session_id: 102, endpoint_id: 6, parent_pid: 2779, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 6449, integrity_level: "medium", started_at: new Date("2025-09-10T12:37:11Z") }, { id: 33, session_id: 68, endpoint_id: 26, parent_pid: 3905, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6437, integrity_level: "high", started_at: new Date("2025-09-08T15:40:46Z") }, { id: 34, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 23104, integrity_level: "low", started_at: new Date("2025-09-08T20:12:09Z") }, { id: 35, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 59744, integrity_level: "low", started_at: new Date("2025-09-11T11:57:44Z") }, { id: 36, session_id: 3, endpoint_id: 8, parent_pid: 3588, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 26578, integrity_level: "medium", started_at: new Date("2025-09-08T10:18:56Z") }, { id: 37, session_id: 128, endpoint_id: 10, parent_pid: 3770, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 64176, integrity_level: "medium", started_at: new Date("2025-09-09T12:31:50Z") }, { id: 38, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 52701, integrity_level: "medium", started_at: new Date("2025-09-10T15:48:18Z") }, { id: 39, session_id: 80, endpoint_id: 1, parent_pid: 5566, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 41614, integrity_level: "medium", started_at: new Date("2025-09-10T13:57:49Z") }, { id: 40, session_id: 126, endpoint_id: 12, parent_pid: 9993, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 24267, integrity_level: "medium", started_at: new Date("2025-09-12T14:13:07Z") }, { id: 41, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 37138, integrity_level: "low", started_at: new Date("2025-09-09T17:53:40Z") }, { id: 42, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 43487, integrity_level: "medium", started_at: new Date("2025-09-11T12:24:41Z") }, { id: 43, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 57823, integrity_level: "high", started_at: new Date("2025-09-11T16:36:24Z") }, { id: 44, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 34278, integrity_level: "medium", started_at: new Date("2025-09-08T14:09:18Z") }, { id: 45, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 10542, integrity_level: "medium", started_at: new Date("2025-09-11T12:28:45Z") }, { id: 46, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 61930, integrity_level: "low", started_at: new Date("2025-09-12T21:05:51Z") }, { id: 47, session_id: 52, endpoint_id: 28, parent_pid: 2323, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 26066, integrity_level: "medium", started_at: new Date("2025-09-08T18:34:30Z") }, { id: 48, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6832, integrity_level: "low", started_at: new Date("2025-09-10T15:53:38Z") }, { id: 49, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 44112, integrity_level: "medium", started_at: new Date("2025-09-10T12:49:13Z") }, { id: 50, session_id: 56, endpoint_id: 30, parent_pid: 2847, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 4770, integrity_level: "low", started_at: new Date("2025-09-11T18:03:53Z") }, { id: 51, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 9327, integrity_level: "medium", started_at: new Date("2025-09-09T19:48:19Z") }, { id: 52, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 34765, integrity_level: "low", started_at: new Date("2025-09-11T20:58:47Z") }, { id: 53, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 62824, integrity_level: "medium", started_at: new Date("2025-09-09T13:16:05Z") }, { id: 54, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 14883, integrity_level: "medium", started_at: new Date("2025-09-11T12:02:15Z") }, { id: 55, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 31902, integrity_level: "low", started_at: new Date("2025-09-11T18:27:56Z") }, { id: 56, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 61151, integrity_level: "high", started_at: new Date("2025-09-08T07:59:52Z") }, { id: 57, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 7006, integrity_level: "medium", started_at: new Date("2025-09-11T12:44:43Z") }, { id: 58, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 47835, integrity_level: "medium", started_at: new Date("2025-09-12T15:18:39Z") }, { id: 59, session_id: 56, endpoint_id: 30, parent_pid: 2847, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 53339, integrity_level: "medium", started_at: new Date("2025-09-11T18:30:17Z") }, { id: 60, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 20713, integrity_level: "medium", started_at: new Date("2025-09-08T21:13:04Z") }, { id: 61, session_id: 57, endpoint_id: 27, parent_pid: 8454, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 62437, integrity_level: "medium", started_at: new Date("2025-09-12T16:39:59Z") }, { id: 62, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 13633, integrity_level: "medium", started_at: new Date("2025-09-10T16:25:08Z") }, { id: 63, session_id: 95, endpoint_id: 7, parent_pid: 9803, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24941, integrity_level: "medium", started_at: new Date("2025-09-10T21:01:49Z") }, { id: 64, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 27918, integrity_level: "low", started_at: new Date("2025-09-09T13:37:18Z") }, { id: 65, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 32057, integrity_level: "medium", started_at: new Date("2025-09-11T22:23:53Z") }, { id: 66, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 47490, integrity_level: "low", started_at: new Date("2025-09-11T23:31:19Z") }, { id: 67, session_id: 103, endpoint_id: 13, parent_pid: 3347, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 44935, integrity_level: "medium", started_at: new Date("2025-09-09T16:45:02Z") }, { id: 68, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28650, integrity_level: "high", started_at: new Date("2025-09-10T17:45:16Z") }, { id: 69, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 34591, integrity_level: "medium", started_at: new Date("2025-09-11T17:37:53Z") }, { id: 70, session_id: 32, endpoint_id: 20, parent_pid: 7143, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 7497, integrity_level: "low", started_at: new Date("2025-09-12T20:22:19Z") }, { id: 71, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 20163, integrity_level: "medium", started_at: new Date("2025-09-11T10:23:31Z") }, { id: 72, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 15433, integrity_level: "medium", started_at: new Date("2025-09-11T18:39:59Z") }, { id: 73, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 47384, integrity_level: "low", started_at: new Date("2025-09-08T16:19:38Z") }, { id: 74, session_id: 77, endpoint_id: 11, parent_pid: 6081, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 39720, integrity_level: "medium", started_at: new Date("2025-09-12T10:42:43Z") }, { id: 75, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 13860, integrity_level: "low", started_at: new Date("2025-09-08T11:17:20Z") }, { id: 76, session_id: 42, endpoint_id: 20, parent_pid: 5987, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 27802, integrity_level: "medium", started_at: new Date("2025-09-09T14:38:58Z") }, { id: 77, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 64195, integrity_level: "low", started_at: new Date("2025-09-08T09:18:33Z") }, { id: 78, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 6027, integrity_level: "medium", started_at: new Date("2025-09-12T15:59:38Z") }, { id: 79, session_id: 124, endpoint_id: 7, parent_pid: 3310, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32308, integrity_level: "medium", started_at: new Date("2025-09-09T09:46:25Z") }, { id: 80, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 5293, integrity_level: "medium", started_at: new Date("2025-09-08T16:07:40Z") }, { id: 81, session_id: 83, endpoint_id: 26, parent_pid: 8003, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 60792, integrity_level: "medium", started_at: new Date("2025-09-09T10:47:41Z") }, { id: 82, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 46471, integrity_level: "low", started_at: new Date("2025-09-10T11:40:58Z") }, { id: 83, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 25522, integrity_level: "medium", started_at: new Date("2025-09-09T11:34:40Z") }, { id: 84, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 27434, integrity_level: "medium", started_at: new Date("2025-09-12T17:46:02Z") }, { id: 85, session_id: 12, endpoint_id: 21, parent_pid: 4059, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 1264, integrity_level: "medium", started_at: new Date("2025-09-12T18:08:42Z") }, { id: 86, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 13878, integrity_level: "medium", started_at: new Date("2025-09-10T17:02:58Z") }, { id: 87, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 42358, integrity_level: "high", started_at: new Date("2025-09-08T15:17:29Z") }, { id: 88, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 9701, integrity_level: "medium", started_at: new Date("2025-09-09T11:45:42Z") }, { id: 89, session_id: 6, endpoint_id: 19, parent_pid: 2205, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 7169, integrity_level: "medium", started_at: new Date("2025-09-08T15:30:13Z") }, { id: 90, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 62491, integrity_level: "medium", started_at: new Date("2025-09-10T11:56:32Z") }, { id: 91, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24205, integrity_level: "medium", started_at: new Date("2025-09-10T14:02:58Z") }, { id: 92, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 49989, integrity_level: "medium", started_at: new Date("2025-09-10T14:12:28Z") }, { id: 93, session_id: 25, endpoint_id: 2, parent_pid: 3737, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 20325, integrity_level: "medium", started_at: new Date("2025-09-08T12:04:01Z") }, { id: 94, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 23005, integrity_level: "medium", started_at: new Date("2025-09-12T00:51:27Z") }, { id: 95, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 6543, integrity_level: "low", started_at: new Date("2025-09-10T17:49:25Z") }, { id: 96, session_id: 3, endpoint_id: 8, parent_pid: 3588, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 53626, integrity_level: "medium", started_at: new Date("2025-09-08T11:18:52Z") }, { id: 97, session_id: 103, endpoint_id: 13, parent_pid: 3347, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 10964, integrity_level: "medium", started_at: new Date("2025-09-09T17:33:44Z") }, { id: 98, session_id: 27, endpoint_id: 1, parent_pid: 6515, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 41939, integrity_level: "medium", started_at: new Date("2025-09-09T13:18:39Z") }, { id: 99, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 20374, integrity_level: "medium", started_at: new Date("2025-09-11T12:48:36Z") }, { id: 100, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 54664, integrity_level: "high", started_at: new Date("2025-09-08T14:12:14Z") }, { id: 101, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 20280, integrity_level: "low", started_at: new Date("2025-09-10T14:52:47Z") }, { id: 102, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 16232, integrity_level: "medium", started_at: new Date("2025-09-12T20:21:56Z") }, { id: 103, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 37100, integrity_level: "medium", started_at: new Date("2025-09-12T15:35:16Z") }, { id: 104, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 53814, integrity_level: "medium", started_at: new Date("2025-09-11T17:38:29Z") }, { id: 105, session_id: 92, endpoint_id: 29, parent_pid: 7465, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 39442, integrity_level: "medium", started_at: new Date("2025-09-08T17:08:27Z") }, { id: 106, session_id: 57, endpoint_id: 27, parent_pid: 8454, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 11209, integrity_level: "high", started_at: new Date("2025-09-12T17:12:45Z") }, { id: 107, session_id: 109, endpoint_id: 1, parent_pid: 9809, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22672, integrity_level: "medium", started_at: new Date("2025-09-09T13:27:17Z") }, { id: 108, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 25979, integrity_level: "medium", started_at: new Date("2025-09-12T20:36:42Z") }, { id: 109, session_id: 27, endpoint_id: 1, parent_pid: 6515, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 47511, integrity_level: "medium", started_at: new Date("2025-09-09T14:04:20Z") }, { id: 110, session_id: 44, endpoint_id: 6, parent_pid: 2524, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 5764, integrity_level: "medium", started_at: new Date("2025-09-12T09:03:21Z") }, { id: 111, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 24998, integrity_level: "medium", started_at: new Date("2025-09-12T20:46:04Z") }, { id: 112, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 14943, integrity_level: "medium", started_at: new Date("2025-09-10T11:57:14Z") }, { id: 113, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32416, integrity_level: "high", started_at: new Date("2025-09-08T16:36:04Z") }, { id: 114, session_id: 57, endpoint_id: 27, parent_pid: 8454, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 58166, integrity_level: "high", started_at: new Date("2025-09-12T17:45:23Z") }, { id: 115, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 63965, integrity_level: "high", started_at: new Date("2025-09-10T13:17:25Z") }, { id: 116, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 54176, integrity_level: "high", started_at: new Date("2025-09-12T18:35:41Z") }, { id: 117, session_id: 80, endpoint_id: 1, parent_pid: 5566, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 23533, integrity_level: "medium", started_at: new Date("2025-09-10T15:27:39Z") }, { id: 118, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 1891, integrity_level: "medium", started_at: new Date("2025-09-10T13:25:49Z") }, { id: 119, session_id: 32, endpoint_id: 20, parent_pid: 7143, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 46524, integrity_level: "high", started_at: new Date("2025-09-12T21:37:44Z") }, { id: 120, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 29798, integrity_level: "medium", started_at: new Date("2025-09-08T15:15:22Z") }, { id: 121, session_id: 35, endpoint_id: 26, parent_pid: 5419, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 54076, integrity_level: "medium", started_at: new Date("2025-09-08T12:15:56Z") }, { id: 122, session_id: 117, endpoint_id: 25, parent_pid: 6672, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 13399, integrity_level: "low", started_at: new Date("2025-09-12T20:16:58Z") }, { id: 123, session_id: 11, endpoint_id: 7, parent_pid: 2105, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17270, integrity_level: "medium", started_at: new Date("2025-09-12T16:04:42Z") }, { id: 124, session_id: 94, endpoint_id: 4, parent_pid: 8955, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 35872, integrity_level: "high", started_at: new Date("2025-09-11T08:42:25Z") }, { id: 125, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 54123, integrity_level: "medium", started_at: new Date("2025-09-08T15:19:15Z") }, { id: 126, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 63920, integrity_level: "medium", started_at: new Date("2025-09-08T21:33:50Z") }, { id: 127, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 54190, integrity_level: "medium", started_at: new Date("2025-09-08T16:22:38Z") }, { id: 128, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 40436, integrity_level: "medium", started_at: new Date("2025-09-12T22:19:59Z") }, { id: 129, session_id: 128, endpoint_id: 10, parent_pid: 3770, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 8473, integrity_level: "high", started_at: new Date("2025-09-09T13:02:27Z") }, { id: 130, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 62677, integrity_level: "medium", started_at: new Date("2025-09-08T16:57:13Z") }, { id: 131, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 21536, integrity_level: "medium", started_at: new Date("2025-09-10T16:16:06Z") }, { id: 132, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 54687, integrity_level: "medium", started_at: new Date("2025-09-08T09:34:02Z") }, { id: 133, session_id: 14, endpoint_id: 20, parent_pid: 5631, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 58185, integrity_level: "medium", started_at: new Date("2025-09-10T12:44:42Z") }, { id: 134, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 16981, integrity_level: "medium", started_at: new Date("2025-09-09T14:09:56Z") }, { id: 135, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 16644, integrity_level: "low", started_at: new Date("2025-09-12T17:04:51Z") }, { id: 136, session_id: 56, endpoint_id: 30, parent_pid: 2847, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45127, integrity_level: "medium", started_at: new Date("2025-09-11T19:04:48Z") }, { id: 137, session_id: 60, endpoint_id: 25, parent_pid: 1935, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 14030, integrity_level: "medium", started_at: new Date("2025-09-10T23:52:52Z") }, { id: 138, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 21859, integrity_level: "medium", started_at: new Date("2025-09-08T17:26:06Z") }, { id: 139, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 13534, integrity_level: "medium", started_at: new Date("2025-09-11T13:44:44Z") }, { id: 140, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 54066, integrity_level: "medium", started_at: new Date("2025-09-10T18:51:01Z") }, { id: 141, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 29579, integrity_level: "medium", started_at: new Date("2025-09-11T13:47:50Z") }, { id: 142, session_id: 76, endpoint_id: 17, parent_pid: 7760, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 53142, integrity_level: "medium", started_at: new Date("2025-09-11T12:33:01Z") }, { id: 143, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 14475, integrity_level: "high", started_at: new Date("2025-09-08T18:52:12Z") }, { id: 144, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 57322, integrity_level: "medium", started_at: new Date("2025-09-10T16:38:56Z") }, { id: 145, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 11876, integrity_level: "medium", started_at: new Date("2025-09-10T12:23:40Z") }, { id: 146, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 25240, integrity_level: "medium", started_at: new Date("2025-09-12T18:45:19Z") }, { id: 147, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28944, integrity_level: "medium", started_at: new Date("2025-09-11T19:02:30Z") }, { id: 148, session_id: 82, endpoint_id: 7, parent_pid: 3087, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 54781, integrity_level: "low", started_at: new Date("2025-09-08T15:42:39Z") }, { id: 149, session_id: 85, endpoint_id: 9, parent_pid: 7128, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 41988, integrity_level: "medium", started_at: new Date("2025-09-10T16:05:54Z") }, { id: 150, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 35093, integrity_level: "medium", started_at: new Date("2025-09-12T12:34:08Z") }, { id: 151, session_id: 66, endpoint_id: 25, parent_pid: 2140, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 45079, integrity_level: "low", started_at: new Date("2025-09-08T11:10:23Z") }, { id: 152, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 31558, integrity_level: "medium", started_at: new Date("2025-09-12T18:05:19Z") }, { id: 153, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 61558, integrity_level: "medium", started_at: new Date("2025-09-08T21:42:16Z") }, { id: 154, session_id: 25, endpoint_id: 2, parent_pid: 3737, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 57288, integrity_level: "medium", started_at: new Date("2025-09-08T12:07:06Z") }, { id: 155, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 1398, integrity_level: "medium", started_at: new Date("2025-09-08T12:41:19Z") }, { id: 156, session_id: 113, endpoint_id: 22, parent_pid: 4002, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 8336, integrity_level: "medium", started_at: new Date("2025-09-09T11:16:51Z") }, { id: 157, session_id: 127, endpoint_id: 22, parent_pid: 1504, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 10269, integrity_level: "medium", started_at: new Date("2025-09-11T10:08:04Z") }, { id: 158, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 11402, integrity_level: "low", started_at: new Date("2025-09-10T17:24:08Z") }, { id: 159, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 44836, integrity_level: "medium", started_at: new Date("2025-09-10T13:26:16Z") }, { id: 160, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 46776, integrity_level: "medium", started_at: new Date("2025-09-09T12:10:08Z") }, { id: 161, session_id: 103, endpoint_id: 13, parent_pid: 3347, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 38072, integrity_level: "medium", started_at: new Date("2025-09-09T17:46:34Z") }, { id: 162, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 4295, integrity_level: "low", started_at: new Date("2025-09-11T13:33:09Z") }, { id: 163, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 49369, integrity_level: "medium", started_at: new Date("2025-09-10T19:35:00Z") }, { id: 164, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 44115, integrity_level: "medium", started_at: new Date("2025-09-09T18:19:27Z") }, { id: 165, session_id: 64, endpoint_id: 4, parent_pid: 2187, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24591, integrity_level: "medium", started_at: new Date("2025-09-11T18:05:21Z") }, { id: 166, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 14994, integrity_level: "medium", started_at: new Date("2025-09-09T18:31:45Z") }, { id: 167, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 5361, integrity_level: "medium", started_at: new Date("2025-09-10T20:00:14Z") }, { id: 168, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 17830, integrity_level: "medium", started_at: new Date("2025-09-11T19:31:36Z") }, { id: 169, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60234, integrity_level: "high", started_at: new Date("2025-09-11T15:27:31Z") }, { id: 170, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 41453, integrity_level: "high", started_at: new Date("2025-09-08T13:29:04Z") }, { id: 171, session_id: 36, endpoint_id: 20, parent_pid: 4428, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 30005, integrity_level: "medium", started_at: new Date("2025-09-09T17:27:26Z") }, { id: 172, session_id: 76, endpoint_id: 17, parent_pid: 7760, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 44074, integrity_level: "low", started_at: new Date("2025-09-11T12:39:23Z") }, { id: 173, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 49561, integrity_level: "low", started_at: new Date("2025-09-10T13:47:21Z") }, { id: 174, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 18938, integrity_level: "low", started_at: new Date("2025-09-09T19:38:03Z") }, { id: 175, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 45523, integrity_level: "medium", started_at: new Date("2025-09-12T19:14:07Z") }, { id: 176, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 33369, integrity_level: "medium", started_at: new Date("2025-09-12T21:27:21Z") }, { id: 177, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 52969, integrity_level: "low", started_at: new Date("2025-09-08T15:14:12Z") }, { id: 178, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 53009, integrity_level: "medium", started_at: new Date("2025-09-10T16:07:54Z") }, { id: 179, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 41425, integrity_level: "medium", started_at: new Date("2025-09-12T21:57:29Z") }, { id: 180, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 22062, integrity_level: "medium", started_at: new Date("2025-09-12T13:41:22Z") }, { id: 181, session_id: 26, endpoint_id: 2, parent_pid: 3041, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 40256, integrity_level: "medium", started_at: new Date("2025-09-12T15:10:13Z") }, { id: 182, session_id: 33, endpoint_id: 26, parent_pid: 3235, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 61073, integrity_level: "medium", started_at: new Date("2025-09-08T10:13:45Z") }, { id: 183, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 57760, integrity_level: "medium", started_at: new Date("2025-09-11T20:06:30Z") }, { id: 184, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 34069, integrity_level: "medium", started_at: new Date("2025-09-08T16:58:38Z") }, { id: 185, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 43534, integrity_level: "low", started_at: new Date("2025-09-09T15:30:09Z") }, { id: 186, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 38818, integrity_level: "medium", started_at: new Date("2025-09-09T20:10:52Z") }, { id: 187, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 56528, integrity_level: "medium", started_at: new Date("2025-09-11T19:05:02Z") }, { id: 188, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 55862, integrity_level: "medium", started_at: new Date("2025-09-11T20:27:58Z") }, { id: 189, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 26077, integrity_level: "medium", started_at: new Date("2025-09-10T20:09:27Z") }, { id: 190, session_id: 60, endpoint_id: 25, parent_pid: 1935, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 31025, integrity_level: "medium", started_at: new Date("2025-09-11T00:00:34Z") }, { id: 191, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 7221, integrity_level: "medium", started_at: new Date("2025-09-10T16:45:37Z") }, { id: 192, session_id: 27, endpoint_id: 1, parent_pid: 6515, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 3940, integrity_level: "high", started_at: new Date("2025-09-09T14:27:20Z") }, { id: 193, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 20177, integrity_level: "medium", started_at: new Date("2025-09-10T14:41:36Z") }, { id: 194, session_id: 23, endpoint_id: 20, parent_pid: 3826, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 29813, integrity_level: "low", started_at: new Date("2025-09-12T10:58:10Z") }, { id: 195, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 54269, integrity_level: "high", started_at: new Date("2025-09-12T18:21:29Z") }, { id: 196, session_id: 54, endpoint_id: 7, parent_pid: 2990, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 40860, integrity_level: "medium", started_at: new Date("2025-09-12T15:34:52Z") }, { id: 197, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 39816, integrity_level: "low", started_at: new Date("2025-09-09T15:56:04Z") }, { id: 198, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 48079, integrity_level: "medium", started_at: new Date("2025-09-10T21:29:21Z") }, { id: 199, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 31843, integrity_level: "medium", started_at: new Date("2025-09-10T13:32:24Z") }, { id: 200, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 6928, integrity_level: "high", started_at: new Date("2025-09-10T14:38:39Z") }, { id: 201, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 63883, integrity_level: "medium", started_at: new Date("2025-09-09T13:30:00Z") }, { id: 202, session_id: 72, endpoint_id: 23, parent_pid: 9273, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 43291, integrity_level: "medium", started_at: new Date("2025-09-08T11:43:04Z") }, { id: 203, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 16739, integrity_level: "medium", started_at: new Date("2025-09-12T22:57:02Z") }, { id: 204, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 15665, integrity_level: "low", started_at: new Date("2025-09-08T10:49:57Z") }, { id: 205, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 50897, integrity_level: "high", started_at: new Date("2025-09-08T18:28:51Z") }, { id: 206, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 18564, integrity_level: "medium", started_at: new Date("2025-09-11T16:20:42Z") }, { id: 207, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 12954, integrity_level: "medium", started_at: new Date("2025-09-08T16:25:58Z") }, { id: 208, session_id: 87, endpoint_id: 8, parent_pid: 9087, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 56449, integrity_level: "high", started_at: new Date("2025-09-11T16:17:34Z") }, { id: 209, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 32252, integrity_level: "medium", started_at: new Date("2025-09-11T13:58:44Z") }, { id: 210, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 28766, integrity_level: "medium", started_at: new Date("2025-09-11T18:29:05Z") }, { id: 211, session_id: 90, endpoint_id: 14, parent_pid: 5514, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 5420, integrity_level: "medium", started_at: new Date("2025-09-11T09:30:40Z") }, { id: 212, session_id: 64, endpoint_id: 4, parent_pid: 2187, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 61892, integrity_level: "medium", started_at: new Date("2025-09-11T18:41:52Z") }, { id: 213, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 37867, integrity_level: "medium", started_at: new Date("2025-09-08T22:25:56Z") }, { id: 214, session_id: 72, endpoint_id: 23, parent_pid: 9273, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 22372, integrity_level: "medium", started_at: new Date("2025-09-08T11:53:54Z") }, { id: 215, session_id: 83, endpoint_id: 26, parent_pid: 8003, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 39630, integrity_level: "low", started_at: new Date("2025-09-09T12:09:17Z") }, { id: 216, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 4540, integrity_level: "medium", started_at: new Date("2025-09-08T23:44:56Z") }, { id: 217, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 61419, integrity_level: "low", started_at: new Date("2025-09-10T17:42:05Z") }, { id: 218, session_id: 3, endpoint_id: 8, parent_pid: 3588, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 61225, integrity_level: "high", started_at: new Date("2025-09-08T12:15:16Z") }, { id: 219, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 30347, integrity_level: "medium", started_at: new Date("2025-09-09T20:17:30Z") }, { id: 220, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 23413, integrity_level: "high", started_at: new Date("2025-09-10T12:01:45Z") }, { id: 221, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 36353, integrity_level: "medium", started_at: new Date("2025-09-10T13:43:34Z") }, { id: 222, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 28924, integrity_level: "medium", started_at: new Date("2025-09-10T14:25:45Z") }, { id: 223, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 13972, integrity_level: "medium", started_at: new Date("2025-09-11T11:11:23Z") }, { id: 224, session_id: 26, endpoint_id: 2, parent_pid: 3041, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 61478, integrity_level: "medium", started_at: new Date("2025-09-12T15:55:01Z") }, { id: 225, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 60709, integrity_level: "high", started_at: new Date("2025-09-09T11:44:29Z") }, { id: 226, session_id: 109, endpoint_id: 1, parent_pid: 9809, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 28834, integrity_level: "medium", started_at: new Date("2025-09-09T13:33:00Z") }, { id: 227, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 48805, integrity_level: "low", started_at: new Date("2025-09-08T12:13:40Z") }, { id: 228, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 55636, integrity_level: "low", started_at: new Date("2025-09-10T14:34:31Z") }, { id: 229, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 27407, integrity_level: "medium", started_at: new Date("2025-09-08T18:06:49Z") }, { id: 230, session_id: 91, endpoint_id: 19, parent_pid: 7689, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 40314, integrity_level: "high", started_at: new Date("2025-09-12T10:35:01Z") }, { id: 231, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 54292, integrity_level: "medium", started_at: new Date("2025-09-10T15:57:17Z") }, { id: 232, session_id: 25, endpoint_id: 2, parent_pid: 3737, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32167, integrity_level: "medium", started_at: new Date("2025-09-08T12:34:34Z") }, { id: 233, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 46600, integrity_level: "medium", started_at: new Date("2025-09-13T00:14:24Z") }, { id: 234, session_id: 121, endpoint_id: 5, parent_pid: 6355, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 62469, integrity_level: "low", started_at: new Date("2025-09-09T13:48:36Z") }, { id: 235, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 34266, integrity_level: "low", started_at: new Date("2025-09-10T14:04:24Z") }, { id: 236, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 19597, integrity_level: "low", started_at: new Date("2025-09-11T20:36:31Z") }, { id: 237, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 14924, integrity_level: "medium", started_at: new Date("2025-09-08T12:39:40Z") }, { id: 238, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 23200, integrity_level: "medium", started_at: new Date("2025-09-10T12:16:54Z") }, { id: 239, session_id: 72, endpoint_id: 23, parent_pid: 9273, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 3544, integrity_level: "high", started_at: new Date("2025-09-08T12:31:01Z") }, { id: 240, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 32551, integrity_level: "medium", started_at: new Date("2025-09-09T14:33:03Z") }, { id: 241, session_id: 128, endpoint_id: 10, parent_pid: 3770, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 32223, integrity_level: "medium", started_at: new Date("2025-09-09T14:08:35Z") }, { id: 242, session_id: 119, endpoint_id: 21, parent_pid: 6808, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 27221, integrity_level: "low", started_at: new Date("2025-09-10T20:58:28Z") }, { id: 243, session_id: 87, endpoint_id: 8, parent_pid: 9087, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 12920, integrity_level: "medium", started_at: new Date("2025-09-11T17:47:10Z") }, { id: 244, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 60267, integrity_level: "high", started_at: new Date("2025-09-10T17:39:42Z") }, { id: 245, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 35064, integrity_level: "medium", started_at: new Date("2025-09-08T13:44:16Z") }, { id: 246, session_id: 33, endpoint_id: 26, parent_pid: 3235, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 5696, integrity_level: "medium", started_at: new Date("2025-09-08T11:17:34Z") }, { id: 247, session_id: 116, endpoint_id: 9, parent_pid: 1596, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 49419, integrity_level: "medium", started_at: new Date("2025-09-10T10:39:38Z") }, { id: 248, session_id: 64, endpoint_id: 4, parent_pid: 2187, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60865, integrity_level: "medium", started_at: new Date("2025-09-11T19:41:33Z") }, { id: 249, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 2629, integrity_level: "low", started_at: new Date("2025-09-10T18:02:21Z") }, { id: 250, session_id: 8, endpoint_id: 14, parent_pid: 8148, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 35738, integrity_level: "medium", started_at: new Date("2025-09-09T09:25:53Z") }, { id: 251, session_id: 76, endpoint_id: 17, parent_pid: 7760, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 56178, integrity_level: "medium", started_at: new Date("2025-09-11T13:44:36Z") }, { id: 252, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 47675, integrity_level: "low", started_at: new Date("2025-09-10T18:40:29Z") }, { id: 253, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 55668, integrity_level: "medium", started_at: new Date("2025-09-08T17:40:14Z") }, { id: 254, session_id: 89, endpoint_id: 18, parent_pid: 7044, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 56120, integrity_level: "low", started_at: new Date("2025-09-10T15:44:55Z") }, { id: 255, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 23623, integrity_level: "medium", started_at: new Date("2025-09-12T20:19:05Z") }, { id: 256, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 6303, integrity_level: "medium", started_at: new Date("2025-09-10T17:54:55Z") }, { id: 257, session_id: 45, endpoint_id: 11, parent_pid: 8295, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 17170, integrity_level: "medium", started_at: new Date("2025-09-12T17:31:07Z") }, { id: 258, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 22176, integrity_level: "medium", started_at: new Date("2025-09-12T18:18:00Z") }, { id: 259, session_id: 28, endpoint_id: 29, parent_pid: 1782, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 1192, integrity_level: "high", started_at: new Date("2025-09-10T12:04:23Z") }, { id: 260, session_id: 25, endpoint_id: 2, parent_pid: 3737, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 12286, integrity_level: "low", started_at: new Date("2025-09-08T13:48:55Z") }, { id: 261, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 8522, integrity_level: "high", started_at: new Date("2025-09-11T15:08:42Z") }, { id: 262, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 3605, integrity_level: "medium", started_at: new Date("2025-09-09T18:36:35Z") }, { id: 263, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 62432, integrity_level: "high", started_at: new Date("2025-09-12T19:44:42Z") }, { id: 264, session_id: 76, endpoint_id: 17, parent_pid: 7760, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 6071, integrity_level: "medium", started_at: new Date("2025-09-11T14:53:59Z") }, { id: 265, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 932, integrity_level: "medium", started_at: new Date("2025-09-11T11:36:24Z") }, { id: 266, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 56419, integrity_level: "low", started_at: new Date("2025-09-11T14:56:48Z") }, { id: 267, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 37820, integrity_level: "medium", started_at: new Date("2025-09-10T14:11:45Z") }, { id: 268, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 1833, integrity_level: "medium", started_at: new Date("2025-09-10T20:31:53Z") }, { id: 269, session_id: 28, endpoint_id: 29, parent_pid: 1782, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45000, integrity_level: "low", started_at: new Date("2025-09-10T12:15:09Z") }, { id: 270, session_id: 129, endpoint_id: 1, parent_pid: 5131, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 58553, integrity_level: "medium", started_at: new Date("2025-09-09T01:03:27Z") }, { id: 271, session_id: 109, endpoint_id: 1, parent_pid: 9809, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 54078, integrity_level: "medium", started_at: new Date("2025-09-09T13:58:54Z") }, { id: 272, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 47307, integrity_level: "high", started_at: new Date("2025-09-09T18:40:07Z") }, { id: 273, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 56921, integrity_level: "medium", started_at: new Date("2025-09-08T16:26:21Z") }, { id: 274, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 8488, integrity_level: "medium", started_at: new Date("2025-09-10T19:28:37Z") }, { id: 275, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 50379, integrity_level: "medium", started_at: new Date("2025-09-11T16:31:31Z") }, { id: 276, session_id: 116, endpoint_id: 9, parent_pid: 1596, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 15988, integrity_level: "low", started_at: new Date("2025-09-10T11:53:40Z") }, { id: 277, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 47062, integrity_level: "medium", started_at: new Date("2025-09-08T13:33:10Z") }, { id: 278, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 46939, integrity_level: "medium", started_at: new Date("2025-09-10T14:52:50Z") }, { id: 279, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 15100, integrity_level: "low", started_at: new Date("2025-09-11T16:06:57Z") }, { id: 280, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 42237, integrity_level: "medium", started_at: new Date("2025-09-08T15:04:54Z") }, { id: 281, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 44118, integrity_level: "medium", started_at: new Date("2025-09-11T15:17:58Z") }, { id: 282, session_id: 104, endpoint_id: 21, parent_pid: 7548, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 25431, integrity_level: "medium", started_at: new Date("2025-09-09T10:53:00Z") }, { id: 283, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 31200, integrity_level: "medium", started_at: new Date("2025-09-09T12:46:16Z") }, { id: 284, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 25670, integrity_level: "medium", started_at: new Date("2025-09-08T10:19:26Z") }, { id: 285, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 64241, integrity_level: "medium", started_at: new Date("2025-09-12T14:24:49Z") }, { id: 286, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 15966, integrity_level: "medium", started_at: new Date("2025-09-11T15:47:46Z") }, { id: 287, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 31309, integrity_level: "medium", started_at: new Date("2025-09-09T19:00:18Z") }, { id: 288, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 43147, integrity_level: "low", started_at: new Date("2025-09-12T01:06:39Z") }, { id: 289, session_id: 116, endpoint_id: 9, parent_pid: 1596, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 5347, integrity_level: "medium", started_at: new Date("2025-09-10T12:57:46Z") }, { id: 290, session_id: 23, endpoint_id: 20, parent_pid: 3826, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 58314, integrity_level: "high", started_at: new Date("2025-09-12T11:06:46Z") }, { id: 291, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 24759, integrity_level: "low", started_at: new Date("2025-09-13T00:29:13Z") }, { id: 292, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 43343, integrity_level: "medium", started_at: new Date("2025-09-12T01:45:18Z") }, { id: 293, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 46403, integrity_level: "low", started_at: new Date("2025-09-13T01:00:58Z") }, { id: 294, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 63248, integrity_level: "medium", started_at: new Date("2025-09-10T15:00:27Z") }, { id: 295, session_id: 22, endpoint_id: 16, parent_pid: 3475, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 49610, integrity_level: "medium", started_at: new Date("2025-09-10T16:34:16Z") }, { id: 296, session_id: 57, endpoint_id: 27, parent_pid: 8454, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 6413, integrity_level: "medium", started_at: new Date("2025-09-12T18:49:06Z") }, { id: 297, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17238, integrity_level: "high", started_at: new Date("2025-09-10T15:29:13Z") }, { id: 298, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 40165, integrity_level: "medium", started_at: new Date("2025-09-10T16:51:51Z") }, { id: 299, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 40090, integrity_level: "medium", started_at: new Date("2025-09-10T14:53:57Z") }, { id: 300, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 13451, integrity_level: "medium", started_at: new Date("2025-09-09T16:39:51Z") }, { id: 301, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 935, integrity_level: "medium", started_at: new Date("2025-09-08T19:42:52Z") }, { id: 302, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 21968, integrity_level: "medium", started_at: new Date("2025-09-08T17:14:03Z") }, { id: 303, session_id: 95, endpoint_id: 7, parent_pid: 9803, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 60717, integrity_level: "medium", started_at: new Date("2025-09-10T22:20:35Z") }, { id: 304, session_id: 72, endpoint_id: 23, parent_pid: 9273, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 33428, integrity_level: "medium", started_at: new Date("2025-09-08T13:00:29Z") }, { id: 305, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 43470, integrity_level: "medium", started_at: new Date("2025-09-12T19:40:48Z") }, { id: 306, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 19835, integrity_level: "medium", started_at: new Date("2025-09-10T14:33:51Z") }, { id: 307, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 52995, integrity_level: "medium", started_at: new Date("2025-09-09T15:17:15Z") }, { id: 308, session_id: 7, endpoint_id: 1, parent_pid: 777, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 39176, integrity_level: "low", started_at: new Date("2025-09-08T13:25:49Z") }, { id: 309, session_id: 97, endpoint_id: 1, parent_pid: 3764, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 2501, integrity_level: "medium", started_at: new Date("2025-09-08T16:58:14Z") }, { id: 310, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 31168, integrity_level: "medium", started_at: new Date("2025-09-11T16:44:35Z") }, { id: 311, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 38782, integrity_level: "medium", started_at: new Date("2025-09-08T18:45:55Z") }, { id: 312, session_id: 107, endpoint_id: 11, parent_pid: 7525, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 58917, integrity_level: "medium", started_at: new Date("2025-09-12T12:14:36Z") }, { id: 313, session_id: 23, endpoint_id: 20, parent_pid: 3826, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 31378, integrity_level: "high", started_at: new Date("2025-09-12T12:29:03Z") }, { id: 314, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 7325, integrity_level: "low", started_at: new Date("2025-09-09T19:20:20Z") }, { id: 315, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 42933, integrity_level: "high", started_at: new Date("2025-09-11T17:33:35Z") }, { id: 316, session_id: 116, endpoint_id: 9, parent_pid: 1596, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 64565, integrity_level: "medium", started_at: new Date("2025-09-10T13:08:22Z") }, { id: 317, session_id: 122, endpoint_id: 17, parent_pid: 6690, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 54314, integrity_level: "medium", started_at: new Date("2025-09-10T14:01:14Z") }, { id: 318, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 36233, integrity_level: "low", started_at: new Date("2025-09-10T15:08:41Z") }, { id: 319, session_id: 121, endpoint_id: 5, parent_pid: 6355, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 9012, integrity_level: "high", started_at: new Date("2025-09-09T14:33:30Z") }, { id: 320, session_id: 7, endpoint_id: 1, parent_pid: 777, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 27511, integrity_level: "high", started_at: new Date("2025-09-08T14:45:39Z") }, { id: 321, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 56212, integrity_level: "high", started_at: new Date("2025-09-12T16:21:36Z") }, { id: 322, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45116, integrity_level: "medium", started_at: new Date("2025-09-10T19:52:20Z") }, { id: 323, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 39061, integrity_level: "low", started_at: new Date("2025-09-08T20:08:14Z") }, { id: 324, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 30035, integrity_level: "medium", started_at: new Date("2025-09-11T16:23:19Z") }, { id: 325, session_id: 34, endpoint_id: 30, parent_pid: 9204, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 20469, integrity_level: "medium", started_at: new Date("2025-09-08T16:23:07Z") }, { id: 326, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 23781, integrity_level: "medium", started_at: new Date("2025-09-11T17:49:34Z") }, { id: 327, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 54358, integrity_level: "medium", started_at: new Date("2025-09-09T21:42:37Z") }, { id: 328, session_id: 87, endpoint_id: 8, parent_pid: 9087, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 60534, integrity_level: "medium", started_at: new Date("2025-09-11T19:01:31Z") }, { id: 329, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 20216, integrity_level: "medium", started_at: new Date("2025-09-09T16:26:06Z") }, { id: 330, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 3831, integrity_level: "medium", started_at: new Date("2025-09-09T21:57:46Z") }, { id: 331, session_id: 64, endpoint_id: 4, parent_pid: 2187, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 58772, integrity_level: "medium", started_at: new Date("2025-09-11T20:40:54Z") }, { id: 332, session_id: 130, endpoint_id: 8, parent_pid: 6080, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 14407, integrity_level: "medium", started_at: new Date("2025-09-12T12:32:13Z") }, { id: 333, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 7215, integrity_level: "low", started_at: new Date("2025-09-08T18:13:15Z") }, { id: 334, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 60255, integrity_level: "low", started_at: new Date("2025-09-08T16:33:17Z") }, { id: 335, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 48395, integrity_level: "high", started_at: new Date("2025-09-12T16:49:05Z") }, { id: 336, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 51238, integrity_level: "medium", started_at: new Date("2025-09-09T19:42:08Z") }, { id: 337, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 54920, integrity_level: "medium", started_at: new Date("2025-09-12T02:04:33Z") }, { id: 338, session_id: 22, endpoint_id: 16, parent_pid: 3475, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 26943, integrity_level: "medium", started_at: new Date("2025-09-10T16:53:11Z") }, { id: 339, session_id: 40, endpoint_id: 18, parent_pid: 9039, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6596, integrity_level: "medium", started_at: new Date("2025-09-08T14:06:40Z") }, { id: 340, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 11257, integrity_level: "low", started_at: new Date("2025-09-10T12:55:09Z") }, { id: 341, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 28515, integrity_level: "medium", started_at: new Date("2025-09-11T12:06:30Z") }, { id: 342, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 47029, integrity_level: "medium", started_at: new Date("2025-09-08T17:29:32Z") }, { id: 343, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 13697, integrity_level: "medium", started_at: new Date("2025-09-11T20:54:16Z") }, { id: 344, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 31471, integrity_level: "medium", started_at: new Date("2025-09-08T15:52:29Z") }, { id: 345, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 30315, integrity_level: "medium", started_at: new Date("2025-09-11T12:19:27Z") }, { id: 346, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 18805, integrity_level: "medium", started_at: new Date("2025-09-12T14:48:44Z") }, { id: 347, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 9114, integrity_level: "medium", started_at: new Date("2025-09-12T20:06:10Z") }, { id: 348, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 36455, integrity_level: "low", started_at: new Date("2025-09-10T15:20:13Z") }, { id: 349, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 20688, integrity_level: "medium", started_at: new Date("2025-09-10T13:29:19Z") }, { id: 350, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 5485, integrity_level: "medium", started_at: new Date("2025-09-11T16:42:34Z") }, { id: 351, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 53006, integrity_level: "low", started_at: new Date("2025-09-08T11:41:42Z") }, { id: 352, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 39809, integrity_level: "high", started_at: new Date("2025-09-10T19:56:59Z") }, { id: 353, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 57986, integrity_level: "medium", started_at: new Date("2025-09-10T16:19:03Z") }, { id: 354, session_id: 3, endpoint_id: 8, parent_pid: 3588, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 42988, integrity_level: "low", started_at: new Date("2025-09-08T13:25:03Z") }, { id: 355, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 12494, integrity_level: "medium", started_at: new Date("2025-09-10T14:36:14Z") }, { id: 356, session_id: 22, endpoint_id: 16, parent_pid: 3475, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 54721, integrity_level: "medium", started_at: new Date("2025-09-10T18:23:43Z") }, { id: 357, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 17802, integrity_level: "medium", started_at: new Date("2025-09-09T21:13:19Z") }, { id: 358, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 52012, integrity_level: "low", started_at: new Date("2025-09-08T14:48:32Z") }, { id: 359, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 34261, integrity_level: "high", started_at: new Date("2025-09-08T20:51:54Z") }, { id: 360, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 2848, integrity_level: "medium", started_at: new Date("2025-09-12T18:06:19Z") }, { id: 361, session_id: 41, endpoint_id: 19, parent_pid: 5450, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 26046, integrity_level: "medium", started_at: new Date("2025-09-08T06:39:42Z") }, { id: 362, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 53635, integrity_level: "medium", started_at: new Date("2025-09-08T19:27:24Z") }, { id: 363, session_id: 26, endpoint_id: 2, parent_pid: 3041, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 16048, integrity_level: "high", started_at: new Date("2025-09-12T16:29:18Z") }, { id: 364, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 36103, integrity_level: "medium", started_at: new Date("2025-09-12T02:38:58Z") }, { id: 365, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 2077, integrity_level: "medium", started_at: new Date("2025-09-10T16:56:36Z") }, { id: 366, session_id: 94, endpoint_id: 4, parent_pid: 8955, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 38325, integrity_level: "high", started_at: new Date("2025-09-11T09:28:36Z") }, { id: 367, session_id: 52, endpoint_id: 28, parent_pid: 2323, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 58323, integrity_level: "high", started_at: new Date("2025-09-08T19:12:57Z") }, { id: 368, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 18083, integrity_level: "low", started_at: new Date("2025-09-10T16:12:58Z") }, { id: 369, session_id: 14, endpoint_id: 20, parent_pid: 5631, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 49049, integrity_level: "medium", started_at: new Date("2025-09-10T13:53:13Z") }, { id: 370, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 11839, integrity_level: "medium", started_at: new Date("2025-09-12T19:07:03Z") }, { id: 371, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 36076, integrity_level: "medium", started_at: new Date("2025-09-09T17:37:54Z") }, { id: 372, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 44607, integrity_level: "medium", started_at: new Date("2025-09-09T17:41:48Z") }, { id: 373, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 18894, integrity_level: "low", started_at: new Date("2025-09-08T19:11:57Z") }, { id: 374, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 34533, integrity_level: "medium", started_at: new Date("2025-09-09T16:44:22Z") }, { id: 375, session_id: 71, endpoint_id: 2, parent_pid: 9165, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 38181, integrity_level: "medium", started_at: new Date("2025-09-10T17:22:05Z") }, { id: 376, session_id: 3, endpoint_id: 8, parent_pid: 3588, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 13354, integrity_level: "low", started_at: new Date("2025-09-08T14:34:14Z") }, { id: 377, session_id: 21, endpoint_id: 8, parent_pid: 1578, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 27111, integrity_level: "medium", started_at: new Date("2025-09-08T12:54:04Z") }, { id: 378, session_id: 13, endpoint_id: 22, parent_pid: 6372, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 14900, integrity_level: "medium", started_at: new Date("2025-09-08T13:41:01Z") }, { id: 379, session_id: 4, endpoint_id: 10, parent_pid: 9279, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 6542, integrity_level: "low", started_at: new Date("2025-09-10T14:07:38Z") }, { id: 380, session_id: 75, endpoint_id: 26, parent_pid: 799, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 16118, integrity_level: "medium", started_at: new Date("2025-09-08T11:35:22Z") }, { id: 381, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 36546, integrity_level: "medium", started_at: new Date("2025-09-10T14:49:22Z") }, { id: 382, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 35728, integrity_level: "low", started_at: new Date("2025-09-10T16:19:14Z") }, { id: 383, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 42906, integrity_level: "low", started_at: new Date("2025-09-12T21:34:23Z") }, { id: 384, session_id: 81, endpoint_id: 14, parent_pid: 1248, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 59974, integrity_level: "medium", started_at: new Date("2025-09-11T16:50:53Z") }, { id: 385, session_id: 43, endpoint_id: 5, parent_pid: 2202, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 19298, integrity_level: "low", started_at: new Date("2025-09-10T22:51:07Z") }, { id: 386, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 63102, integrity_level: "medium", started_at: new Date("2025-09-08T18:59:30Z") }, { id: 387, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 13027, integrity_level: "medium", started_at: new Date("2025-09-08T18:59:44Z") }, { id: 388, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 29144, integrity_level: "medium", started_at: new Date("2025-09-11T18:59:26Z") }, { id: 389, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 1834, integrity_level: "medium", started_at: new Date("2025-09-10T18:29:32Z") }, { id: 390, session_id: 94, endpoint_id: 4, parent_pid: 8955, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 50328, integrity_level: "medium", started_at: new Date("2025-09-11T09:38:05Z") }, { id: 391, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 19567, integrity_level: "low", started_at: new Date("2025-09-08T22:08:12Z") }, { id: 392, session_id: 22, endpoint_id: 16, parent_pid: 3475, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 33782, integrity_level: "medium", started_at: new Date("2025-09-10T19:35:47Z") }, { id: 393, session_id: 80, endpoint_id: 1, parent_pid: 5566, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 15421, integrity_level: "medium", started_at: new Date("2025-09-10T15:34:27Z") }, { id: 394, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 11868, integrity_level: "medium", started_at: new Date("2025-09-09T13:05:33Z") }, { id: 395, session_id: 83, endpoint_id: 26, parent_pid: 8003, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 43857, integrity_level: "low", started_at: new Date("2025-09-09T13:02:59Z") }, { id: 396, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 22514, integrity_level: "medium", started_at: new Date("2025-09-09T22:07:05Z") }, { id: 397, session_id: 82, endpoint_id: 7, parent_pid: 3087, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 47772, integrity_level: "medium", started_at: new Date("2025-09-08T16:20:15Z") }, { id: 398, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 31853, integrity_level: "medium", started_at: new Date("2025-09-12T22:47:41Z") }, { id: 399, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 12354, integrity_level: "medium", started_at: new Date("2025-09-08T19:46:58Z") }, { id: 400, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 51811, integrity_level: "high", started_at: new Date("2025-09-08T17:43:45Z") }, { id: 401, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22532, integrity_level: "medium", started_at: new Date("2025-09-10T19:41:44Z") }, { id: 402, session_id: 14, endpoint_id: 20, parent_pid: 5631, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 3576, integrity_level: "medium", started_at: new Date("2025-09-10T13:59:07Z") }, { id: 403, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 37069, integrity_level: "medium", started_at: new Date("2025-09-08T12:14:04Z") }, { id: 404, session_id: 27, endpoint_id: 1, parent_pid: 6515, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 1270, integrity_level: "medium", started_at: new Date("2025-09-09T15:56:22Z") }, { id: 405, session_id: 47, endpoint_id: 30, parent_pid: 8438, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 58028, integrity_level: "medium", started_at: new Date("2025-09-10T17:17:30Z") }, { id: 406, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 24732, integrity_level: "medium", started_at: new Date("2025-09-09T22:11:36Z") }, { id: 407, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 26398, integrity_level: "medium", started_at: new Date("2025-09-08T20:56:22Z") }, { id: 408, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 29568, integrity_level: "low", started_at: new Date("2025-09-11T12:39:33Z") }, { id: 409, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 60471, integrity_level: "low", started_at: new Date("2025-09-11T21:30:32Z") }, { id: 410, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 52011, integrity_level: "medium", started_at: new Date("2025-09-11T12:55:09Z") }, { id: 411, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 38569, integrity_level: "medium", started_at: new Date("2025-09-11T19:54:40Z") }, { id: 412, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 2537, integrity_level: "medium", started_at: new Date("2025-09-11T18:47:34Z") }, { id: 413, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 15396, integrity_level: "medium", started_at: new Date("2025-09-10T21:28:45Z") }, { id: 414, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 61129, integrity_level: "high", started_at: new Date("2025-09-09T18:44:03Z") }, { id: 415, session_id: 100, endpoint_id: 13, parent_pid: 4103, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 44236, integrity_level: "medium", started_at: new Date("2025-09-08T16:24:51Z") }, { id: 416, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 64425, integrity_level: "medium", started_at: new Date("2025-09-11T21:25:17Z") }, { id: 417, session_id: 92, endpoint_id: 29, parent_pid: 7465, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 7857, integrity_level: "medium", started_at: new Date("2025-09-08T17:37:24Z") }, { id: 418, session_id: 131, endpoint_id: 3, parent_pid: 807, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 25491, integrity_level: "medium", started_at: new Date("2025-09-11T22:05:34Z") }, { id: 419, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 6165, integrity_level: "medium", started_at: new Date("2025-09-11T13:46:17Z") }, { id: 420, session_id: 88, endpoint_id: 27, parent_pid: 4101, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 47194, integrity_level: "medium", started_at: new Date("2025-09-11T17:04:11Z") }, { id: 421, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 27717, integrity_level: "high", started_at: new Date("2025-09-12T03:09:53Z") }, { id: 422, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 23607, integrity_level: "medium", started_at: new Date("2025-09-08T20:38:12Z") }, { id: 423, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 29523, integrity_level: "low", started_at: new Date("2025-09-12T19:32:39Z") }, { id: 424, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 12999, integrity_level: "low", started_at: new Date("2025-09-13T01:47:49Z") }, { id: 425, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28405, integrity_level: "medium", started_at: new Date("2025-09-08T15:51:27Z") }, { id: 426, session_id: 79, endpoint_id: 24, parent_pid: 1688, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 30972, integrity_level: "low", started_at: new Date("2025-09-09T14:10:01Z") }, { id: 427, session_id: 95, endpoint_id: 7, parent_pid: 9803, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 22114, integrity_level: "low", started_at: new Date("2025-09-10T22:32:01Z") }, { id: 428, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 34210, integrity_level: "medium", started_at: new Date("2025-09-12T20:28:27Z") }, { id: 429, session_id: 38, endpoint_id: 21, parent_pid: 8575, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 12950, integrity_level: "low", started_at: new Date("2025-09-08T08:17:51Z") }, { id: 430, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 14673, integrity_level: "medium", started_at: new Date("2025-09-11T12:48:40Z") }, { id: 431, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 7288, integrity_level: "medium", started_at: new Date("2025-09-08T13:04:36Z") }, { id: 432, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 58174, integrity_level: "medium", started_at: new Date("2025-09-08T18:49:17Z") }, { id: 433, session_id: 87, endpoint_id: 8, parent_pid: 9087, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 49560, integrity_level: "medium", started_at: new Date("2025-09-11T20:16:36Z") }, { id: 434, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 37311, integrity_level: "low", started_at: new Date("2025-09-08T22:39:04Z") }, { id: 435, session_id: 82, endpoint_id: 7, parent_pid: 3087, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 42046, integrity_level: "medium", started_at: new Date("2025-09-08T17:34:46Z") }, { id: 436, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 46964, integrity_level: "low", started_at: new Date("2025-09-08T22:07:12Z") }, { id: 437, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 45963, integrity_level: "medium", started_at: new Date("2025-09-10T14:56:10Z") }, { id: 438, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 39388, integrity_level: "medium", started_at: new Date("2025-09-09T22:18:27Z") }, { id: 439, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60486, integrity_level: "high", started_at: new Date("2025-09-08T22:47:59Z") }, { id: 440, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 14899, integrity_level: "medium", started_at: new Date("2025-09-10T18:20:11Z") }, { id: 441, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 56072, integrity_level: "medium", started_at: new Date("2025-09-08T23:51:20Z") }, { id: 442, session_id: 17, endpoint_id: 19, parent_pid: 7447, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 7940, integrity_level: "high", started_at: new Date("2025-09-09T23:31:18Z") }, { id: 443, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 7017, integrity_level: "low", started_at: new Date("2025-09-11T14:09:52Z") }, { id: 444, session_id: 96, endpoint_id: 9, parent_pid: 9109, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 28259, integrity_level: "medium", started_at: new Date("2025-09-12T07:58:53Z") }, { id: 445, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 8609, integrity_level: "low", started_at: new Date("2025-09-12T19:50:14Z") }, { id: 446, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 43909, integrity_level: "medium", started_at: new Date("2025-09-08T20:39:57Z") }, { id: 447, session_id: 14, endpoint_id: 20, parent_pid: 5631, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 64946, integrity_level: "medium", started_at: new Date("2025-09-10T14:25:12Z") }, { id: 448, session_id: 101, endpoint_id: 25, parent_pid: 7446, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24095, integrity_level: "medium", started_at: new Date("2025-09-10T16:56:12Z") }, { id: 449, session_id: 102, endpoint_id: 6, parent_pid: 2779, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 7351, integrity_level: "medium", started_at: new Date("2025-09-10T13:27:21Z") }, { id: 450, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 52592, integrity_level: "low", started_at: new Date("2025-09-11T22:28:05Z") }, { id: 451, session_id: 113, endpoint_id: 22, parent_pid: 4002, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 18454, integrity_level: "medium", started_at: new Date("2025-09-09T11:38:49Z") }, { id: 452, session_id: 84, endpoint_id: 29, parent_pid: 6330, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 15071, integrity_level: "medium", started_at: new Date("2025-09-11T19:02:44Z") }, { id: 453, session_id: 82, endpoint_id: 7, parent_pid: 3087, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 31800, integrity_level: "medium", started_at: new Date("2025-09-08T18:18:47Z") }, { id: 454, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 44332, integrity_level: "medium", started_at: new Date("2025-09-08T17:24:23Z") }, { id: 455, session_id: 87, endpoint_id: 8, parent_pid: 9087, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 28274, integrity_level: "low", started_at: new Date("2025-09-11T20:51:20Z") }, { id: 456, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 45910, integrity_level: "low", started_at: new Date("2025-09-08T21:41:30Z") }, { id: 457, session_id: 123, endpoint_id: 4, parent_pid: 9605, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60738, integrity_level: "low", started_at: new Date("2025-09-10T21:09:03Z") }, { id: 458, session_id: 5, endpoint_id: 9, parent_pid: 4092, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 33005, integrity_level: "medium", started_at: new Date("2025-09-12T21:50:35Z") }, { id: 459, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 15459, integrity_level: "medium", started_at: new Date("2025-09-10T18:26:48Z") }, { id: 460, session_id: 40, endpoint_id: 18, parent_pid: 9039, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17152, integrity_level: "medium", started_at: new Date("2025-09-08T14:51:38Z") }, { id: 461, session_id: 86, endpoint_id: 24, parent_pid: 4959, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 3614, integrity_level: "low", started_at: new Date("2025-09-12T10:37:32Z") }, { id: 462, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 1160, integrity_level: "medium", started_at: new Date("2025-09-10T20:35:20Z") }, { id: 463, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 3725, integrity_level: "medium", started_at: new Date("2025-09-13T02:51:32Z") }, { id: 464, session_id: 97, endpoint_id: 1, parent_pid: 3764, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 16918, integrity_level: "medium", started_at: new Date("2025-09-08T17:28:10Z") }, { id: 465, session_id: 78, endpoint_id: 28, parent_pid: 4336, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 61135, integrity_level: "medium", started_at: new Date("2025-09-12T13:53:17Z") }, { id: 466, session_id: 48, endpoint_id: 10, parent_pid: 1271, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 33595, integrity_level: "medium", started_at: new Date("2025-09-08T13:33:55Z") }, { id: 467, session_id: 83, endpoint_id: 26, parent_pid: 8003, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 36899, integrity_level: "medium", started_at: new Date("2025-09-09T14:16:25Z") }, { id: 468, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 50480, integrity_level: "medium", started_at: new Date("2025-09-08T19:53:12Z") }, { id: 469, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 29343, integrity_level: "medium", started_at: new Date("2025-09-08T20:10:14Z") }, { id: 470, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 11266, integrity_level: "medium", started_at: new Date("2025-09-12T23:13:57Z") }, { id: 471, session_id: 10, endpoint_id: 18, parent_pid: 6676, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 3932, integrity_level: "medium", started_at: new Date("2025-09-08T17:24:11Z") }, { id: 472, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 50693, integrity_level: "low", started_at: new Date("2025-09-10T15:55:48Z") }, { id: 473, session_id: 98, endpoint_id: 17, parent_pid: 8504, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 982, integrity_level: "medium", started_at: new Date("2025-09-09T01:02:41Z") }, { id: 474, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 46432, integrity_level: "low", started_at: new Date("2025-09-11T14:16:12Z") }, { id: 475, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6333, integrity_level: "medium", started_at: new Date("2025-09-10T14:53:57Z") }, { id: 476, session_id: 22, endpoint_id: 16, parent_pid: 3475, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 56343, integrity_level: "medium", started_at: new Date("2025-09-10T20:23:15Z") }, { id: 477, session_id: 30, endpoint_id: 5, parent_pid: 5435, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 7825, integrity_level: "low", started_at: new Date("2025-09-09T17:37:49Z") }, { id: 478, session_id: 39, endpoint_id: 12, parent_pid: 4269, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 44850, integrity_level: "medium", started_at: new Date("2025-09-09T19:04:15Z") }, { id: 479, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 20100, integrity_level: "medium", started_at: new Date("2025-09-10T15:38:40Z") }, { id: 480, session_id: 4, endpoint_id: 10, parent_pid: 9279, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 62992, integrity_level: "medium", started_at: new Date("2025-09-10T15:31:36Z") }, { id: 481, session_id: 68, endpoint_id: 26, parent_pid: 3905, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 56274, integrity_level: "low", started_at: new Date("2025-09-08T16:56:55Z") }, { id: 482, session_id: 121, endpoint_id: 5, parent_pid: 6355, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 64717, integrity_level: "medium", started_at: new Date("2025-09-09T14:45:44Z") }, { id: 483, session_id: 77, endpoint_id: 11, parent_pid: 6081, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 12492, integrity_level: "medium", started_at: new Date("2025-09-12T11:44:14Z") }, { id: 484, session_id: 125, endpoint_id: 10, parent_pid: 6716, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 32968, integrity_level: "medium", started_at: new Date("2025-09-08T13:41:44Z") }, { id: 485, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 45501, integrity_level: "medium", started_at: new Date("2025-09-10T16:18:13Z") }, { id: 486, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 44392, integrity_level: "medium", started_at: new Date("2025-09-13T00:20:46Z") }, { id: 487, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 44974, integrity_level: "medium", started_at: new Date("2025-09-08T20:45:04Z") }, { id: 488, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 61473, integrity_level: "medium", started_at: new Date("2025-09-12T22:27:31Z") }, { id: 489, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 22003, integrity_level: "low", started_at: new Date("2025-09-10T22:41:08Z") }, { id: 490, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 51639, integrity_level: "low", started_at: new Date("2025-09-08T23:36:35Z") }, { id: 491, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 5519, integrity_level: "medium", started_at: new Date("2025-09-08T19:25:43Z") }, { id: 492, session_id: 15, endpoint_id: 26, parent_pid: 1207, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 9231, integrity_level: "medium", started_at: new Date("2025-09-09T17:42:34Z") }, { id: 493, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 50019, integrity_level: "high", started_at: new Date("2025-09-11T18:12:09Z") }, { id: 494, session_id: 83, endpoint_id: 26, parent_pid: 8003, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 9289, integrity_level: "medium", started_at: new Date("2025-09-09T14:49:51Z") }, { id: 495, session_id: 128, endpoint_id: 10, parent_pid: 3770, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 57344, integrity_level: "medium", started_at: new Date("2025-09-09T14:27:22Z") }, { id: 496, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 28484, integrity_level: "medium", started_at: new Date("2025-09-09T20:21:27Z") }, { id: 497, session_id: 106, endpoint_id: 12, parent_pid: 8968, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 34077, integrity_level: "medium", started_at: new Date("2025-09-08T22:12:50Z") }, { id: 498, session_id: 77, endpoint_id: 11, parent_pid: 6081, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 25642, integrity_level: "medium", started_at: new Date("2025-09-12T12:44:58Z") }, { id: 499, session_id: 53, endpoint_id: 23, parent_pid: 5187, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28518, integrity_level: "medium", started_at: new Date("2025-09-10T18:44:21Z") }, { id: 500, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 56378, integrity_level: "medium", started_at: new Date("2025-09-12T23:37:05Z") }, ], }); await prisma.app_processes.createMany({ data: [ { id: 501, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 21386, integrity_level: "low", started_at: new Date("2025-09-10T15:38:38Z") }, { id: 502, session_id: 60, endpoint_id: 25, parent_pid: 1935, launch_chain_id: 14, process_name: "cmd.exe", child_process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 55238, integrity_level: "low", started_at: new Date("2025-09-11T01:12:20Z") }, { id: 503, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 58254, integrity_level: "medium", started_at: new Date("2025-09-10T21:46:44Z") }, { id: 504, session_id: 73, endpoint_id: 15, parent_pid: 2342, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 34957, integrity_level: "medium", started_at: new Date("2025-09-08T21:23:46Z") }, { id: 505, session_id: 102, endpoint_id: 6, parent_pid: 2779, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 53794, integrity_level: "medium", started_at: new Date("2025-09-10T14:14:19Z") }, { id: 506, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 10074, integrity_level: "low", started_at: new Date("2025-09-08T20:36:18Z") }, { id: 507, session_id: 45, endpoint_id: 11, parent_pid: 8295, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 24155, integrity_level: "medium", started_at: new Date("2025-09-12T18:23:00Z") }, { id: 508, session_id: 31, endpoint_id: 17, parent_pid: 9042, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 56082, integrity_level: "medium", started_at: new Date("2025-09-11T11:38:30Z") }, { id: 509, session_id: 105, endpoint_id: 18, parent_pid: 9411, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 6233, integrity_level: "medium", started_at: new Date("2025-09-12T15:31:32Z") }, { id: 510, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 41236, integrity_level: "low", started_at: new Date("2025-09-10T17:17:42Z") }, { id: 511, session_id: 113, endpoint_id: 22, parent_pid: 4002, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 21581, integrity_level: "medium", started_at: new Date("2025-09-09T11:47:44Z") }, { id: 512, session_id: 96, endpoint_id: 9, parent_pid: 9109, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 13102, integrity_level: "medium", started_at: new Date("2025-09-12T09:30:09Z") }, { id: 513, session_id: 60, endpoint_id: 25, parent_pid: 1935, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 4995, integrity_level: "low", started_at: new Date("2025-09-11T02:06:22Z") }, { id: 514, session_id: 108, endpoint_id: 1, parent_pid: 9857, launch_chain_id: 11, process_name: "outlook.exe", child_process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 25807, integrity_level: "low", started_at: new Date("2025-09-13T03:32:47Z") }, { id: 515, session_id: 67, endpoint_id: 19, parent_pid: 9805, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 36077, integrity_level: "medium", started_at: new Date("2025-09-10T16:41:47Z") }, { id: 516, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 1617, integrity_level: "medium", started_at: new Date("2025-09-10T19:44:15Z") }, { id: 517, session_id: 56, endpoint_id: 30, parent_pid: 2847, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 57726, integrity_level: "high", started_at: new Date("2025-09-11T19:14:18Z") }, { id: 518, session_id: 50, endpoint_id: 17, parent_pid: 2098, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 39724, integrity_level: "low", started_at: new Date("2025-09-09T20:41:56Z") }, { id: 519, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 28678, integrity_level: "medium", started_at: new Date("2025-09-09T22:36:30Z") }, { id: 520, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 57289, integrity_level: "low", started_at: new Date("2025-09-10T18:35:51Z") }, { id: 521, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 10497, integrity_level: "medium", started_at: new Date("2025-09-08T21:14:03Z") }, { id: 522, session_id: 65, endpoint_id: 28, parent_pid: 2048, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 51499, integrity_level: "medium", started_at: new Date("2025-09-08T19:52:39Z") }, { id: 523, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 41324, integrity_level: "low", started_at: new Date("2025-09-10T23:14:47Z") }, { id: 524, session_id: 70, endpoint_id: 14, parent_pid: 9033, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 64374, integrity_level: "medium", started_at: new Date("2025-09-10T17:16:07Z") }, { id: 525, session_id: 79, endpoint_id: 24, parent_pid: 1688, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 9432, integrity_level: "medium", started_at: new Date("2025-09-09T14:19:45Z") }, { id: 526, session_id: 69, endpoint_id: 14, parent_pid: 807, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 13520, integrity_level: "medium", started_at: new Date("2025-09-11T15:42:16Z") }, { id: 527, session_id: 63, endpoint_id: 20, parent_pid: 6555, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 25250, integrity_level: "medium", started_at: new Date("2025-09-08T20:40:23Z") }, { id: 528, session_id: 120, endpoint_id: 9, parent_pid: 5090, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 37202, integrity_level: "low", started_at: new Date("2025-09-10T23:54:01Z") }, { id: 529, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 52105, integrity_level: "medium", started_at: new Date("2025-09-12T21:11:11Z") }, { id: 530, session_id: 59, endpoint_id: 2, parent_pid: 3499, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 46255, integrity_level: "medium", started_at: new Date("2025-09-09T00:55:37Z") }, { id: 531, session_id: 68, endpoint_id: 26, parent_pid: 3905, launch_chain_id: 15, process_name: "powershell.exe", child_process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 56848, integrity_level: "medium", started_at: new Date("2025-09-08T17:34:41Z") }, { id: 532, session_id: 16, endpoint_id: 11, parent_pid: 5993, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 27202, integrity_level: "medium", started_at: new Date("2025-09-08T16:06:30Z") }, { id: 533, session_id: 80, endpoint_id: 1, parent_pid: 5566, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 44023, integrity_level: "high", started_at: new Date("2025-09-10T16:40:11Z") }, { id: 534, session_id: 111, endpoint_id: 25, parent_pid: 4893, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 63803, integrity_level: "medium", started_at: new Date("2025-09-11T10:29:49Z") }, { id: 535, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 12, process_name: "excel.exe", child_process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 12682, integrity_level: "medium", started_at: new Date("2025-09-13T00:00:14Z") }, { id: 536, session_id: 109, endpoint_id: 1, parent_pid: 9809, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 37531, integrity_level: "medium", started_at: new Date("2025-09-09T15:26:14Z") }, { id: 537, session_id: 37, endpoint_id: 2, parent_pid: 2950, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 40163, integrity_level: "medium", started_at: new Date("2025-09-11T22:27:18Z") }, { id: 538, session_id: 47, endpoint_id: 30, parent_pid: 8438, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 3478, integrity_level: "low", started_at: new Date("2025-09-10T18:02:33Z") }, { id: 539, session_id: 29, endpoint_id: 30, parent_pid: 4443, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 38696, integrity_level: "low", started_at: new Date("2025-09-10T20:19:48Z") }, { id: 540, session_id: 55, endpoint_id: 19, parent_pid: 4258, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 18596, integrity_level: "medium", started_at: new Date("2025-09-09T13:13:26Z") }, { id: 541, session_id: 61, endpoint_id: 29, parent_pid: 6985, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 50925, integrity_level: "low", started_at: new Date("2025-09-11T15:23:35Z") }, { id: 542, session_id: 18, endpoint_id: 19, parent_pid: 5353, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 42031, integrity_level: "medium", started_at: new Date("2025-09-09T14:58:31Z") }, { id: 543, session_id: 110, endpoint_id: 5, parent_pid: 4857, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 14472, integrity_level: "high", started_at: new Date("2025-09-10T16:56:47Z") }, { id: 544, session_id: 9, endpoint_id: 14, parent_pid: 5882, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 56307, integrity_level: "high", started_at: new Date("2025-09-08T21:16:54Z") }, { id: 545, session_id: 76, endpoint_id: 17, parent_pid: 7760, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 17648, integrity_level: "medium", started_at: new Date("2025-09-11T15:25:05Z") }, { id: 546, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 21296, integrity_level: "medium", started_at: new Date("2025-09-12T22:05:32Z") }, { id: 547, session_id: 31, endpoint_id: 17, parent_pid: 9042, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 20376, integrity_level: "high", started_at: new Date("2025-09-11T12:44:33Z") }, { id: 548, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 26369, integrity_level: "medium", started_at: new Date("2025-09-10T19:18:04Z") }, { id: 549, session_id: 99, endpoint_id: 9, parent_pid: 8717, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 54109, integrity_level: "medium", started_at: new Date("2025-09-08T22:52:45Z") }, { id: 550, session_id: 11, endpoint_id: 7, parent_pid: 2105, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 33263, integrity_level: "medium", started_at: new Date("2025-09-12T17:15:29Z") }, { id: 551, session_id: 118, endpoint_id: 18, parent_pid: 4211, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 42543, integrity_level: "medium", started_at: new Date("2025-09-11T00:02:57Z") }, { id: 552, session_id: 115, endpoint_id: 28, parent_pid: 6071, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 58514, integrity_level: "medium", started_at: new Date("2025-09-12T13:59:04Z") }, { id: 553, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 850, integrity_level: "low", started_at: new Date("2025-09-13T00:42:00Z") }, { id: 554, session_id: 79, endpoint_id: 24, parent_pid: 1688, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 2524, integrity_level: "low", started_at: new Date("2025-09-09T14:54:43Z") }, { id: 555, session_id: 4, endpoint_id: 10, parent_pid: 9279, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 9809, integrity_level: "medium", started_at: new Date("2025-09-10T15:58:53Z") }, { id: 556, session_id: 93, endpoint_id: 1, parent_pid: 9342, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 44299, integrity_level: "low", started_at: new Date("2025-09-10T19:23:29Z") }, { id: 557, session_id: 19, endpoint_id: 30, parent_pid: 5838, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 51424, integrity_level: "low", started_at: new Date("2025-09-12T04:18:54Z") }, { id: 558, session_id: 77, endpoint_id: 11, parent_pid: 6081, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 57792, integrity_level: "medium", started_at: new Date("2025-09-12T14:08:11Z") }, { id: 559, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 8, process_name: "explorer.exe", child_process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 45335, integrity_level: "low", started_at: new Date("2025-09-12T20:21:17Z") }, { id: 560, session_id: 20, endpoint_id: 12, parent_pid: 2248, launch_chain_id: 5, process_name: "code.exe", child_process_name: "node.exe", category: "development", detection_label: "none", pid: 18770, integrity_level: "medium", started_at: new Date("2025-09-13T01:57:40Z") }, { id: 561, session_id: 2, endpoint_id: 16, parent_pid: 9253, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 31827, integrity_level: "medium", started_at: new Date("2025-09-12T20:33:08Z") }, { id: 562, session_id: 51, endpoint_id: 24, parent_pid: 3525, launch_chain_id: 3, process_name: "winword.exe", child_process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 58496, integrity_level: "high", started_at: new Date("2025-09-08T17:27:59Z") }, { id: 563, session_id: 62, endpoint_id: 14, parent_pid: 5166, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 62900, integrity_level: "medium", started_at: new Date("2025-09-10T15:55:33Z") }, { id: 564, session_id: 79, endpoint_id: 24, parent_pid: 1688, launch_chain_id: 4, process_name: "excel.exe", child_process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 20441, integrity_level: "medium", started_at: new Date("2025-09-09T15:38:40Z") }, { id: 565, session_id: 77, endpoint_id: 11, parent_pid: 6081, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 59866, integrity_level: "medium", started_at: new Date("2025-09-12T14:43:13Z") }, { id: 566, session_id: 114, endpoint_id: 26, parent_pid: 1599, launch_chain_id: 6, process_name: "outlook.exe", child_process_name: "olk.exe", category: "email", detection_label: "none", pid: 18059, integrity_level: "medium", started_at: new Date("2025-09-08T16:35:19Z") }, { id: 567, session_id: 1, endpoint_id: 30, parent_pid: 1223, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 25903, integrity_level: "low", started_at: new Date("2025-09-10T19:52:11Z") }, { id: 568, session_id: 128, endpoint_id: 10, parent_pid: 3770, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 2260, integrity_level: "medium", started_at: new Date("2025-09-09T15:49:19Z") }, { id: 569, session_id: 74, endpoint_id: 8, parent_pid: 8020, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 10941, integrity_level: "low", started_at: new Date("2025-09-11T19:03:32Z") }, { id: 570, session_id: 112, endpoint_id: 3, parent_pid: 8684, launch_chain_id: 9, process_name: "cmd.exe", child_process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 37692, integrity_level: "high", started_at: new Date("2025-09-11T22:49:28Z") }, { id: 571, session_id: 24, endpoint_id: 11, parent_pid: 4927, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 7435, integrity_level: "medium", started_at: new Date("2025-09-13T01:11:41Z") }, { id: 572, session_id: 103, endpoint_id: 13, parent_pid: 3347, launch_chain_id: 10, process_name: "winword.exe", child_process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 17893, integrity_level: "medium", started_at: new Date("2025-09-09T19:05:26Z") }, { id: 573, session_id: 132, endpoint_id: 5, parent_pid: 9527, launch_chain_id: 7, process_name: "teams.exe", child_process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 28951, integrity_level: "low", started_at: new Date("2025-09-11T18:29:02Z") }, { id: 574, session_id: 46, endpoint_id: 15, parent_pid: 1692, launch_chain_id: 13, process_name: "cmd.exe", child_process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 56518, integrity_level: "medium", started_at: new Date("2025-09-12T22:58:34Z") }, { id: 575, session_id: 64, endpoint_id: 4, parent_pid: 2187, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 42950, integrity_level: "low", started_at: new Date("2025-09-11T20:52:07Z") }, { id: 576, session_id: 58, endpoint_id: 7, parent_pid: 5507, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 9308, integrity_level: "low", started_at: new Date("2025-09-09T19:14:37Z") }, { id: 577, session_id: 116, endpoint_id: 9, parent_pid: 1596, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 50253, integrity_level: "medium", started_at: new Date("2025-09-10T13:56:34Z") }, { id: 578, session_id: 49, endpoint_id: 13, parent_pid: 7754, launch_chain_id: 2, process_name: "chrome.exe", child_process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 37119, integrity_level: "medium", started_at: new Date("2025-09-09T23:02:25Z") }, { id: 579, session_id: 100, endpoint_id: 13, parent_pid: 4103, launch_chain_id: 1, process_name: "msedge.exe", child_process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24394, integrity_level: "high", started_at: new Date("2025-09-08T16:35:19Z") }, ], }); await prisma.child_processes.createMany({ data: [ { id: 1, app_process_id: 419, endpoint_id: 14, parent_pid: 6165, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 8349, command_source: "local_disk", started_at: new Date("2025-09-11T13:48:10Z") }, { id: 2, app_process_id: 146, endpoint_id: 15, parent_pid: 25240, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 32092, command_source: "local_disk", started_at: new Date("2025-09-12T18:47:06Z") }, { id: 3, app_process_id: 302, endpoint_id: 14, parent_pid: 21968, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 41696, command_source: "temp_folder", started_at: new Date("2025-09-08T17:15:22Z") }, { id: 4, app_process_id: 142, endpoint_id: 17, parent_pid: 53142, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 57847, command_source: "local_disk", started_at: new Date("2025-09-11T12:33:11Z") }, { id: 5, app_process_id: 408, endpoint_id: 29, parent_pid: 29568, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 11652, command_source: "local_disk", started_at: new Date("2025-09-11T12:40:41Z") }, { id: 6, app_process_id: 438, endpoint_id: 19, parent_pid: 39388, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 56438, command_source: "local_disk", started_at: new Date("2025-09-09T22:20:17Z") }, { id: 7, app_process_id: 250, endpoint_id: 14, parent_pid: 35738, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 53327, command_source: "user_profile", started_at: new Date("2025-09-09T09:27:16Z") }, { id: 8, app_process_id: 66, endpoint_id: 30, parent_pid: 47490, process_name: "olk.exe", category: "email", detection_label: "none", pid: 5608, command_source: "user_profile", started_at: new Date("2025-09-11T23:31:47Z") }, { id: 9, app_process_id: 371, endpoint_id: 12, parent_pid: 36076, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 22059, command_source: "temp_folder", started_at: new Date("2025-09-09T17:38:40Z") }, { id: 10, app_process_id: 454, endpoint_id: 24, parent_pid: 44332, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 58536, command_source: "temp_folder", started_at: new Date("2025-09-08T17:25:47Z") }, { id: 11, app_process_id: 295, endpoint_id: 16, parent_pid: 49610, process_name: "node.exe", category: "development", detection_label: "none", pid: 56489, command_source: "local_disk", started_at: new Date("2025-09-10T16:34:51Z") }, { id: 12, app_process_id: 409, endpoint_id: 3, parent_pid: 60471, process_name: "node.exe", category: "development", detection_label: "none", pid: 40588, command_source: "network_path", started_at: new Date("2025-09-11T21:30:38Z") }, { id: 13, app_process_id: 66, endpoint_id: 30, parent_pid: 47490, process_name: "olk.exe", category: "email", detection_label: "none", pid: 64348, command_source: "network_path", started_at: new Date("2025-09-11T23:32:28Z") }, { id: 14, app_process_id: 44, endpoint_id: 28, parent_pid: 34278, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 30253, command_source: "local_disk", started_at: new Date("2025-09-08T14:09:41Z") }, { id: 15, app_process_id: 20, endpoint_id: 29, parent_pid: 31578, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 20465, command_source: "local_disk", started_at: new Date("2025-09-11T08:59:48Z") }, { id: 16, app_process_id: 262, endpoint_id: 17, parent_pid: 3605, process_name: "node.exe", category: "development", detection_label: "none", pid: 48987, command_source: "local_disk", started_at: new Date("2025-09-09T18:36:36Z") }, { id: 17, app_process_id: 409, endpoint_id: 3, parent_pid: 60471, process_name: "node.exe", category: "development", detection_label: "none", pid: 30439, command_source: "local_disk", started_at: new Date("2025-09-11T21:32:12Z") }, { id: 18, app_process_id: 486, endpoint_id: 12, parent_pid: 44392, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17607, command_source: "local_disk", started_at: new Date("2025-09-13T00:22:10Z") }, { id: 19, app_process_id: 404, endpoint_id: 1, parent_pid: 1270, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 44864, command_source: "local_disk", started_at: new Date("2025-09-09T15:56:36Z") }, { id: 20, app_process_id: 280, endpoint_id: 24, parent_pid: 42237, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 42362, command_source: "temp_folder", started_at: new Date("2025-09-08T15:05:32Z") }, { id: 21, app_process_id: 534, endpoint_id: 25, parent_pid: 63803, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 11797, command_source: "local_disk", started_at: new Date("2025-09-11T10:31:23Z") }, { id: 22, app_process_id: 32, endpoint_id: 6, parent_pid: 6449, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 11435, command_source: "user_profile", started_at: new Date("2025-09-10T12:38:07Z") }, { id: 23, app_process_id: 416, endpoint_id: 2, parent_pid: 64425, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 47384, command_source: "local_disk", started_at: new Date("2025-09-11T21:26:21Z") }, { id: 24, app_process_id: 489, endpoint_id: 18, parent_pid: 22003, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 33056, command_source: "local_disk", started_at: new Date("2025-09-10T22:41:40Z") }, { id: 25, app_process_id: 360, endpoint_id: 16, parent_pid: 2848, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 41048, command_source: "local_disk", started_at: new Date("2025-09-12T18:07:11Z") }, { id: 26, app_process_id: 104, endpoint_id: 3, parent_pid: 53814, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 24023, command_source: "local_disk", started_at: new Date("2025-09-11T17:39:42Z") }, { id: 27, app_process_id: 355, endpoint_id: 19, parent_pid: 12494, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 26192, command_source: "local_disk", started_at: new Date("2025-09-10T14:37:26Z") }, { id: 28, app_process_id: 324, endpoint_id: 8, parent_pid: 30035, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 55130, command_source: "temp_folder", started_at: new Date("2025-09-11T16:24:52Z") }, { id: 29, app_process_id: 56, endpoint_id: 10, parent_pid: 61151, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 22662, command_source: "local_disk", started_at: new Date("2025-09-08T08:00:13Z") }, { id: 30, app_process_id: 31, endpoint_id: 1, parent_pid: 14661, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 63918, command_source: "temp_folder", started_at: new Date("2025-09-09T13:01:43Z") }, { id: 31, app_process_id: 215, endpoint_id: 26, parent_pid: 39630, process_name: "olk.exe", category: "email", detection_label: "none", pid: 1795, command_source: "local_disk", started_at: new Date("2025-09-09T12:09:29Z") }, { id: 32, app_process_id: 192, endpoint_id: 1, parent_pid: 3940, process_name: "node.exe", category: "development", detection_label: "none", pid: 50476, command_source: "local_disk", started_at: new Date("2025-09-09T14:29:04Z") }, { id: 33, app_process_id: 416, endpoint_id: 2, parent_pid: 64425, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 23623, command_source: "local_disk", started_at: new Date("2025-09-11T21:26:37Z") }, { id: 34, app_process_id: 561, endpoint_id: 16, parent_pid: 31827, process_name: "olk.exe", category: "email", detection_label: "none", pid: 58601, command_source: "local_disk", started_at: new Date("2025-09-12T20:33:41Z") }, { id: 35, app_process_id: 52, endpoint_id: 30, parent_pid: 34765, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 42438, command_source: "local_disk", started_at: new Date("2025-09-11T20:59:08Z") }, { id: 36, app_process_id: 90, endpoint_id: 14, parent_pid: 62491, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 16591, command_source: "user_profile", started_at: new Date("2025-09-10T11:58:03Z") }, { id: 37, app_process_id: 21, endpoint_id: 29, parent_pid: 33716, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 28380, command_source: "temp_folder", started_at: new Date("2025-09-11T11:01:14Z") }, { id: 38, app_process_id: 20, endpoint_id: 29, parent_pid: 31578, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 48111, command_source: "local_disk", started_at: new Date("2025-09-11T09:00:47Z") }, { id: 39, app_process_id: 37, endpoint_id: 10, parent_pid: 64176, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 51314, command_source: "user_profile", started_at: new Date("2025-09-09T12:32:31Z") }, { id: 40, app_process_id: 3, endpoint_id: 8, parent_pid: 43396, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 53442, command_source: "local_disk", started_at: new Date("2025-09-12T11:23:34Z") }, { id: 41, app_process_id: 490, endpoint_id: 2, parent_pid: 51639, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 29964, command_source: "local_disk", started_at: new Date("2025-09-08T23:38:03Z") }, { id: 42, app_process_id: 152, endpoint_id: 9, parent_pid: 31558, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 15403, command_source: "local_disk", started_at: new Date("2025-09-12T18:06:34Z") }, { id: 43, app_process_id: 274, endpoint_id: 18, parent_pid: 8488, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 57013, command_source: "user_profile", started_at: new Date("2025-09-10T19:29:12Z") }, { id: 44, app_process_id: 195, endpoint_id: 9, parent_pid: 54269, process_name: "node.exe", category: "development", detection_label: "none", pid: 62735, command_source: "temp_folder", started_at: new Date("2025-09-12T18:22:10Z") }, { id: 45, app_process_id: 8, endpoint_id: 9, parent_pid: 27161, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 22079, command_source: "temp_folder", started_at: new Date("2025-09-10T16:47:51Z") }, { id: 46, app_process_id: 569, endpoint_id: 8, parent_pid: 10941, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 55298, command_source: "local_disk", started_at: new Date("2025-09-11T19:03:49Z") }, { id: 47, app_process_id: 222, endpoint_id: 14, parent_pid: 28924, process_name: "node.exe", category: "development", detection_label: "none", pid: 48708, command_source: "local_disk", started_at: new Date("2025-09-10T14:27:29Z") }, { id: 48, app_process_id: 500, endpoint_id: 11, parent_pid: 56378, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 32335, command_source: "temp_folder", started_at: new Date("2025-09-12T23:38:14Z") }, { id: 49, app_process_id: 10, endpoint_id: 12, parent_pid: 39319, process_name: "node.exe", category: "development", detection_label: "none", pid: 51816, command_source: "user_profile", started_at: new Date("2025-09-08T15:08:49Z") }, { id: 50, app_process_id: 88, endpoint_id: 12, parent_pid: 9701, process_name: "node.exe", category: "development", detection_label: "none", pid: 19801, command_source: "user_profile", started_at: new Date("2025-09-09T11:46:27Z") }, { id: 51, app_process_id: 283, endpoint_id: 19, parent_pid: 31200, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 62136, command_source: "local_disk", started_at: new Date("2025-09-09T12:47:03Z") }, { id: 52, app_process_id: 293, endpoint_id: 1, parent_pid: 46403, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 40901, command_source: "temp_folder", started_at: new Date("2025-09-13T01:02:51Z") }, { id: 53, app_process_id: 80, endpoint_id: 14, parent_pid: 5293, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 5457, command_source: "local_disk", started_at: new Date("2025-09-08T16:08:47Z") }, { id: 54, app_process_id: 438, endpoint_id: 19, parent_pid: 39388, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 43256, command_source: "local_disk", started_at: new Date("2025-09-09T22:20:43Z") }, { id: 55, app_process_id: 162, endpoint_id: 29, parent_pid: 4295, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 32472, command_source: "user_profile", started_at: new Date("2025-09-11T13:33:52Z") }, { id: 56, app_process_id: 468, endpoint_id: 20, parent_pid: 50480, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 39507, command_source: "network_path", started_at: new Date("2025-09-08T19:53:13Z") }, { id: 57, app_process_id: 197, endpoint_id: 26, parent_pid: 39816, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 23633, command_source: "user_profile", started_at: new Date("2025-09-09T15:57:09Z") }, { id: 58, app_process_id: 543, endpoint_id: 5, parent_pid: 14472, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 10035, command_source: "user_profile", started_at: new Date("2025-09-10T16:58:09Z") }, { id: 59, app_process_id: 230, endpoint_id: 19, parent_pid: 40314, process_name: "node.exe", category: "development", detection_label: "none", pid: 56323, command_source: "local_disk", started_at: new Date("2025-09-12T10:35:35Z") }, { id: 60, app_process_id: 284, endpoint_id: 10, parent_pid: 25670, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 57665, command_source: "local_disk", started_at: new Date("2025-09-08T10:21:24Z") }, { id: 61, app_process_id: 331, endpoint_id: 4, parent_pid: 58772, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 11673, command_source: "local_disk", started_at: new Date("2025-09-11T20:42:35Z") }, { id: 62, app_process_id: 385, endpoint_id: 5, parent_pid: 19298, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 32560, command_source: "temp_folder", started_at: new Date("2025-09-10T22:52:57Z") }, { id: 63, app_process_id: 413, endpoint_id: 18, parent_pid: 15396, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 37668, command_source: "user_profile", started_at: new Date("2025-09-10T21:29:58Z") }, { id: 64, app_process_id: 517, endpoint_id: 30, parent_pid: 57726, process_name: "olk.exe", category: "email", detection_label: "none", pid: 19943, command_source: "local_disk", started_at: new Date("2025-09-11T19:14:42Z") }, { id: 65, app_process_id: 120, endpoint_id: 15, parent_pid: 29798, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 34225, command_source: "network_path", started_at: new Date("2025-09-08T15:15:58Z") }, { id: 66, app_process_id: 349, endpoint_id: 19, parent_pid: 20688, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 18561, command_source: "local_disk", started_at: new Date("2025-09-10T13:30:39Z") }, { id: 67, app_process_id: 183, endpoint_id: 3, parent_pid: 57760, process_name: "olk.exe", category: "email", detection_label: "none", pid: 19867, command_source: "local_disk", started_at: new Date("2025-09-11T20:06:49Z") }, { id: 68, app_process_id: 403, endpoint_id: 10, parent_pid: 37069, process_name: "olk.exe", category: "email", detection_label: "none", pid: 49014, command_source: "local_disk", started_at: new Date("2025-09-08T12:15:36Z") }, { id: 69, app_process_id: 261, endpoint_id: 27, parent_pid: 8522, process_name: "node.exe", category: "development", detection_label: "none", pid: 55239, command_source: "user_profile", started_at: new Date("2025-09-11T15:09:03Z") }, { id: 70, app_process_id: 473, endpoint_id: 17, parent_pid: 982, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 48159, command_source: "local_disk", started_at: new Date("2025-09-09T01:03:41Z") }, { id: 71, app_process_id: 132, endpoint_id: 10, parent_pid: 54687, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 53544, command_source: "local_disk", started_at: new Date("2025-09-08T09:34:22Z") }, { id: 72, app_process_id: 95, endpoint_id: 5, parent_pid: 6543, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 19550, command_source: "user_profile", started_at: new Date("2025-09-10T17:51:08Z") }, { id: 73, app_process_id: 100, endpoint_id: 2, parent_pid: 54664, process_name: "olk.exe", category: "email", detection_label: "none", pid: 41382, command_source: "local_disk", started_at: new Date("2025-09-08T14:12:29Z") }, { id: 74, app_process_id: 341, endpoint_id: 14, parent_pid: 28515, process_name: "node.exe", category: "development", detection_label: "none", pid: 62547, command_source: "user_profile", started_at: new Date("2025-09-11T12:07:33Z") }, { id: 75, app_process_id: 577, endpoint_id: 9, parent_pid: 50253, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32784, command_source: "local_disk", started_at: new Date("2025-09-10T13:57:57Z") }, { id: 76, app_process_id: 414, endpoint_id: 12, parent_pid: 61129, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 4981, command_source: "network_path", started_at: new Date("2025-09-09T18:44:40Z") }, { id: 77, app_process_id: 191, endpoint_id: 18, parent_pid: 7221, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 2424, command_source: "local_disk", started_at: new Date("2025-09-10T16:47:15Z") }, { id: 78, app_process_id: 330, endpoint_id: 19, parent_pid: 3831, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 50028, command_source: "temp_folder", started_at: new Date("2025-09-09T21:58:54Z") }, { id: 79, app_process_id: 368, endpoint_id: 14, parent_pid: 18083, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 59197, command_source: "user_profile", started_at: new Date("2025-09-10T16:13:18Z") }, { id: 80, app_process_id: 322, endpoint_id: 18, parent_pid: 45116, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 1197, command_source: "local_disk", started_at: new Date("2025-09-10T19:52:49Z") }, { id: 81, app_process_id: 183, endpoint_id: 3, parent_pid: 57760, process_name: "olk.exe", category: "email", detection_label: "none", pid: 20666, command_source: "user_profile", started_at: new Date("2025-09-11T20:08:16Z") }, { id: 82, app_process_id: 127, endpoint_id: 15, parent_pid: 54190, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 16153, command_source: "local_disk", started_at: new Date("2025-09-08T16:24:08Z") }, { id: 83, app_process_id: 413, endpoint_id: 18, parent_pid: 15396, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 35845, command_source: "local_disk", started_at: new Date("2025-09-10T21:31:00Z") }, { id: 84, app_process_id: 156, endpoint_id: 22, parent_pid: 8336, process_name: "node.exe", category: "development", detection_label: "none", pid: 32720, command_source: "local_disk", started_at: new Date("2025-09-09T11:17:49Z") }, { id: 85, app_process_id: 274, endpoint_id: 18, parent_pid: 8488, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 24093, command_source: "local_disk", started_at: new Date("2025-09-10T19:30:29Z") }, { id: 86, app_process_id: 65, endpoint_id: 30, parent_pid: 32057, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 12517, command_source: "local_disk", started_at: new Date("2025-09-11T22:24:29Z") }, { id: 87, app_process_id: 380, endpoint_id: 26, parent_pid: 16118, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6205, command_source: "temp_folder", started_at: new Date("2025-09-08T11:36:15Z") }, { id: 88, app_process_id: 395, endpoint_id: 26, parent_pid: 43857, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 47945, command_source: "local_disk", started_at: new Date("2025-09-09T13:03:22Z") }, { id: 89, app_process_id: 163, endpoint_id: 9, parent_pid: 49369, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 25132, command_source: "local_disk", started_at: new Date("2025-09-10T19:35:09Z") }, { id: 90, app_process_id: 288, endpoint_id: 30, parent_pid: 43147, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60299, command_source: "temp_folder", started_at: new Date("2025-09-12T01:07:01Z") }, { id: 91, app_process_id: 332, endpoint_id: 8, parent_pid: 14407, process_name: "olk.exe", category: "email", detection_label: "none", pid: 12847, command_source: "local_disk", started_at: new Date("2025-09-12T12:33:49Z") }, { id: 92, app_process_id: 511, endpoint_id: 22, parent_pid: 21581, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 27929, command_source: "local_disk", started_at: new Date("2025-09-09T11:48:13Z") }, { id: 93, app_process_id: 563, endpoint_id: 14, parent_pid: 62900, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 58209, command_source: "local_disk", started_at: new Date("2025-09-10T15:57:04Z") }, { id: 94, app_process_id: 518, endpoint_id: 17, parent_pid: 39724, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 13723, command_source: "local_disk", started_at: new Date("2025-09-09T20:42:26Z") }, { id: 95, app_process_id: 197, endpoint_id: 26, parent_pid: 39816, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 27509, command_source: "user_profile", started_at: new Date("2025-09-09T15:57:47Z") }, { id: 96, app_process_id: 451, endpoint_id: 22, parent_pid: 18454, process_name: "node.exe", category: "development", detection_label: "none", pid: 45475, command_source: "local_disk", started_at: new Date("2025-09-09T11:39:59Z") }, { id: 97, app_process_id: 160, endpoint_id: 12, parent_pid: 46776, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 36668, command_source: "user_profile", started_at: new Date("2025-09-09T12:12:05Z") }, { id: 98, app_process_id: 71, endpoint_id: 14, parent_pid: 20163, process_name: "olk.exe", category: "email", detection_label: "none", pid: 28025, command_source: "temp_folder", started_at: new Date("2025-09-11T10:24:04Z") }, { id: 99, app_process_id: 579, endpoint_id: 13, parent_pid: 24394, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 21572, command_source: "local_disk", started_at: new Date("2025-09-08T16:35:49Z") }, { id: 100, app_process_id: 355, endpoint_id: 19, parent_pid: 12494, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 35449, command_source: "local_disk", started_at: new Date("2025-09-10T14:38:20Z") }, { id: 101, app_process_id: 175, endpoint_id: 15, parent_pid: 45523, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 42582, command_source: "temp_folder", started_at: new Date("2025-09-12T19:14:55Z") }, { id: 102, app_process_id: 210, endpoint_id: 2, parent_pid: 28766, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 42752, command_source: "local_disk", started_at: new Date("2025-09-11T18:29:44Z") }, { id: 103, app_process_id: 477, endpoint_id: 5, parent_pid: 7825, process_name: "olk.exe", category: "email", detection_label: "none", pid: 37925, command_source: "local_disk", started_at: new Date("2025-09-09T17:38:08Z") }, { id: 104, app_process_id: 384, endpoint_id: 14, parent_pid: 59974, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 58288, command_source: "local_disk", started_at: new Date("2025-09-11T16:52:17Z") }, { id: 105, app_process_id: 511, endpoint_id: 22, parent_pid: 21581, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 44465, command_source: "local_disk", started_at: new Date("2025-09-09T11:48:57Z") }, { id: 106, app_process_id: 45, endpoint_id: 29, parent_pid: 10542, process_name: "node.exe", category: "development", detection_label: "none", pid: 58533, command_source: "local_disk", started_at: new Date("2025-09-11T12:30:15Z") }, { id: 107, app_process_id: 167, endpoint_id: 5, parent_pid: 5361, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 14190, command_source: "local_disk", started_at: new Date("2025-09-10T20:02:00Z") }, { id: 108, app_process_id: 23, endpoint_id: 29, parent_pid: 21327, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 14242, command_source: "local_disk", started_at: new Date("2025-09-11T10:16:42Z") }, { id: 109, app_process_id: 254, endpoint_id: 18, parent_pid: 56120, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 15299, command_source: "local_disk", started_at: new Date("2025-09-10T15:46:37Z") }, { id: 110, app_process_id: 535, endpoint_id: 11, parent_pid: 12682, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 58444, command_source: "local_disk", started_at: new Date("2025-09-13T00:01:31Z") }, { id: 111, app_process_id: 324, endpoint_id: 8, parent_pid: 30035, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 18087, command_source: "local_disk", started_at: new Date("2025-09-11T16:25:27Z") }, { id: 112, app_process_id: 21, endpoint_id: 29, parent_pid: 33716, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 63700, command_source: "user_profile", started_at: new Date("2025-09-11T11:02:20Z") }, { id: 113, app_process_id: 231, endpoint_id: 30, parent_pid: 54292, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 62647, command_source: "user_profile", started_at: new Date("2025-09-10T15:57:25Z") }, { id: 114, app_process_id: 333, endpoint_id: 14, parent_pid: 7215, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 18970, command_source: "temp_folder", started_at: new Date("2025-09-08T18:13:59Z") }, { id: 115, app_process_id: 529, endpoint_id: 15, parent_pid: 52105, process_name: "node.exe", category: "development", detection_label: "none", pid: 57332, command_source: "local_disk", started_at: new Date("2025-09-12T21:11:55Z") }, { id: 116, app_process_id: 107, endpoint_id: 1, parent_pid: 22672, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 62514, command_source: "local_disk", started_at: new Date("2025-09-09T13:28:34Z") }, { id: 117, app_process_id: 389, endpoint_id: 23, parent_pid: 1834, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 57982, command_source: "user_profile", started_at: new Date("2025-09-10T18:30:24Z") }, { id: 118, app_process_id: 544, endpoint_id: 14, parent_pid: 56307, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 34309, command_source: "local_disk", started_at: new Date("2025-09-08T21:17:42Z") }, { id: 119, app_process_id: 125, endpoint_id: 15, parent_pid: 54123, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 2794, command_source: "local_disk", started_at: new Date("2025-09-08T15:19:19Z") }, { id: 120, app_process_id: 233, endpoint_id: 1, parent_pid: 46600, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 42642, command_source: "network_path", started_at: new Date("2025-09-13T00:14:33Z") }, { id: 121, app_process_id: 295, endpoint_id: 16, parent_pid: 49610, process_name: "node.exe", category: "development", detection_label: "none", pid: 32063, command_source: "local_disk", started_at: new Date("2025-09-10T16:35:20Z") }, { id: 122, app_process_id: 550, endpoint_id: 7, parent_pid: 33263, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 59623, command_source: "user_profile", started_at: new Date("2025-09-12T17:16:08Z") }, { id: 123, app_process_id: 163, endpoint_id: 9, parent_pid: 49369, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 39980, command_source: "local_disk", started_at: new Date("2025-09-10T19:36:10Z") }, { id: 124, app_process_id: 540, endpoint_id: 19, parent_pid: 18596, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 23120, command_source: "local_disk", started_at: new Date("2025-09-09T13:13:45Z") }, { id: 125, app_process_id: 155, endpoint_id: 11, parent_pid: 1398, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 46351, command_source: "local_disk", started_at: new Date("2025-09-08T12:41:49Z") }, { id: 126, app_process_id: 65, endpoint_id: 30, parent_pid: 32057, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 28540, command_source: "local_disk", started_at: new Date("2025-09-11T22:25:03Z") }, { id: 127, app_process_id: 153, endpoint_id: 1, parent_pid: 61558, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 31826, command_source: "local_disk", started_at: new Date("2025-09-08T21:43:32Z") }, { id: 128, app_process_id: 291, endpoint_id: 1, parent_pid: 24759, process_name: "olk.exe", category: "email", detection_label: "none", pid: 13658, command_source: "user_profile", started_at: new Date("2025-09-13T00:29:40Z") }, { id: 129, app_process_id: 505, endpoint_id: 6, parent_pid: 53794, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 9870, command_source: "local_disk", started_at: new Date("2025-09-10T14:15:45Z") }, { id: 130, app_process_id: 41, endpoint_id: 17, parent_pid: 37138, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 41911, command_source: "temp_folder", started_at: new Date("2025-09-09T17:54:08Z") }, { id: 131, app_process_id: 161, endpoint_id: 13, parent_pid: 38072, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 57241, command_source: "local_disk", started_at: new Date("2025-09-09T17:46:52Z") }, { id: 132, app_process_id: 107, endpoint_id: 1, parent_pid: 22672, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 41698, command_source: "network_path", started_at: new Date("2025-09-09T13:29:43Z") }, { id: 133, app_process_id: 262, endpoint_id: 17, parent_pid: 3605, process_name: "node.exe", category: "development", detection_label: "none", pid: 27298, command_source: "local_disk", started_at: new Date("2025-09-09T18:38:37Z") }, { id: 134, app_process_id: 257, endpoint_id: 11, parent_pid: 17170, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 18349, command_source: "local_disk", started_at: new Date("2025-09-12T17:31:49Z") }, { id: 135, app_process_id: 410, endpoint_id: 14, parent_pid: 52011, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 57872, command_source: "local_disk", started_at: new Date("2025-09-11T12:57:04Z") }, { id: 136, app_process_id: 480, endpoint_id: 10, parent_pid: 62992, process_name: "node.exe", category: "development", detection_label: "none", pid: 42078, command_source: "user_profile", started_at: new Date("2025-09-10T15:32:56Z") }, { id: 137, app_process_id: 393, endpoint_id: 1, parent_pid: 15421, process_name: "olk.exe", category: "email", detection_label: "none", pid: 55647, command_source: "local_disk", started_at: new Date("2025-09-10T15:34:59Z") }, { id: 138, app_process_id: 291, endpoint_id: 1, parent_pid: 24759, process_name: "olk.exe", category: "email", detection_label: "none", pid: 22649, command_source: "user_profile", started_at: new Date("2025-09-13T00:31:01Z") }, { id: 139, app_process_id: 229, endpoint_id: 15, parent_pid: 27407, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 53469, command_source: "local_disk", started_at: new Date("2025-09-08T18:07:59Z") }, { id: 140, app_process_id: 472, endpoint_id: 1, parent_pid: 50693, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 4189, command_source: "local_disk", started_at: new Date("2025-09-10T15:57:37Z") }, { id: 141, app_process_id: 520, endpoint_id: 1, parent_pid: 57289, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 21334, command_source: "local_disk", started_at: new Date("2025-09-10T18:36:43Z") }, { id: 142, app_process_id: 316, endpoint_id: 9, parent_pid: 64565, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 15003, command_source: "temp_folder", started_at: new Date("2025-09-10T13:08:25Z") }, { id: 143, app_process_id: 154, endpoint_id: 2, parent_pid: 57288, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 59509, command_source: "network_path", started_at: new Date("2025-09-08T12:07:42Z") }, { id: 144, app_process_id: 531, endpoint_id: 26, parent_pid: 56848, process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 30252, command_source: "local_disk", started_at: new Date("2025-09-08T17:35:49Z") }, { id: 145, app_process_id: 402, endpoint_id: 20, parent_pid: 3576, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 48637, command_source: "user_profile", started_at: new Date("2025-09-10T13:59:10Z") }, { id: 146, app_process_id: 378, endpoint_id: 22, parent_pid: 14900, process_name: "node.exe", category: "development", detection_label: "none", pid: 37072, command_source: "local_disk", started_at: new Date("2025-09-08T13:42:25Z") }, { id: 147, app_process_id: 371, endpoint_id: 12, parent_pid: 36076, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 49679, command_source: "user_profile", started_at: new Date("2025-09-09T17:39:53Z") }, { id: 148, app_process_id: 267, endpoint_id: 2, parent_pid: 37820, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 23922, command_source: "local_disk", started_at: new Date("2025-09-10T14:13:23Z") }, { id: 149, app_process_id: 496, endpoint_id: 17, parent_pid: 28484, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 5767, command_source: "local_disk", started_at: new Date("2025-09-09T20:22:46Z") }, { id: 150, app_process_id: 4, endpoint_id: 10, parent_pid: 13733, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45620, command_source: "user_profile", started_at: new Date("2025-09-10T13:41:53Z") }, { id: 151, app_process_id: 253, endpoint_id: 2, parent_pid: 55668, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 42773, command_source: "local_disk", started_at: new Date("2025-09-08T17:40:58Z") }, { id: 152, app_process_id: 450, endpoint_id: 3, parent_pid: 52592, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 32316, command_source: "local_disk", started_at: new Date("2025-09-11T22:29:48Z") }, { id: 153, app_process_id: 371, endpoint_id: 12, parent_pid: 36076, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 39357, command_source: "local_disk", started_at: new Date("2025-09-09T17:41:43Z") }, { id: 154, app_process_id: 325, endpoint_id: 30, parent_pid: 20469, process_name: "node.exe", category: "development", detection_label: "none", pid: 32301, command_source: "local_disk", started_at: new Date("2025-09-08T16:24:05Z") }, { id: 155, app_process_id: 402, endpoint_id: 20, parent_pid: 3576, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 3432, command_source: "local_disk", started_at: new Date("2025-09-10T13:59:12Z") }, { id: 156, app_process_id: 260, endpoint_id: 2, parent_pid: 12286, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 35571, command_source: "temp_folder", started_at: new Date("2025-09-08T13:50:21Z") }, { id: 157, app_process_id: 388, endpoint_id: 29, parent_pid: 29144, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 59399, command_source: "network_path", started_at: new Date("2025-09-11T18:59:49Z") }, { id: 158, app_process_id: 285, endpoint_id: 18, parent_pid: 64241, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 50455, command_source: "temp_folder", started_at: new Date("2025-09-12T14:24:54Z") }, { id: 159, app_process_id: 486, endpoint_id: 12, parent_pid: 44392, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 20820, command_source: "network_path", started_at: new Date("2025-09-13T00:23:20Z") }, { id: 160, app_process_id: 388, endpoint_id: 29, parent_pid: 29144, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 22164, command_source: "local_disk", started_at: new Date("2025-09-11T19:00:54Z") }, { id: 161, app_process_id: 53, endpoint_id: 26, parent_pid: 62824, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 51929, command_source: "network_path", started_at: new Date("2025-09-09T13:16:51Z") }, { id: 162, app_process_id: 312, endpoint_id: 11, parent_pid: 58917, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22010, command_source: "local_disk", started_at: new Date("2025-09-12T12:14:37Z") }, { id: 163, app_process_id: 52, endpoint_id: 30, parent_pid: 34765, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 4275, command_source: "local_disk", started_at: new Date("2025-09-11T20:59:51Z") }, { id: 164, app_process_id: 65, endpoint_id: 30, parent_pid: 32057, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 2699, command_source: "local_disk", started_at: new Date("2025-09-11T22:25:49Z") }, { id: 165, app_process_id: 319, endpoint_id: 5, parent_pid: 9012, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 7656, command_source: "user_profile", started_at: new Date("2025-09-09T14:34:38Z") }, { id: 166, app_process_id: 98, endpoint_id: 1, parent_pid: 41939, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 49010, command_source: "local_disk", started_at: new Date("2025-09-09T13:19:05Z") }, { id: 167, app_process_id: 8, endpoint_id: 9, parent_pid: 27161, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 51826, command_source: "local_disk", started_at: new Date("2025-09-10T16:48:21Z") }, { id: 168, app_process_id: 383, endpoint_id: 11, parent_pid: 42906, process_name: "node.exe", category: "development", detection_label: "none", pid: 5536, command_source: "local_disk", started_at: new Date("2025-09-12T21:34:41Z") }, { id: 169, app_process_id: 37, endpoint_id: 10, parent_pid: 64176, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 11749, command_source: "temp_folder", started_at: new Date("2025-09-09T12:33:51Z") }, { id: 170, app_process_id: 145, endpoint_id: 2, parent_pid: 11876, process_name: "olk.exe", category: "email", detection_label: "none", pid: 3164, command_source: "user_profile", started_at: new Date("2025-09-10T12:24:14Z") }, { id: 171, app_process_id: 455, endpoint_id: 8, parent_pid: 28274, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 61064, command_source: "network_path", started_at: new Date("2025-09-11T20:52:00Z") }, { id: 172, app_process_id: 1, endpoint_id: 5, parent_pid: 59762, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 21300, command_source: "local_disk", started_at: new Date("2025-09-10T11:51:32Z") }, { id: 173, app_process_id: 108, endpoint_id: 12, parent_pid: 25979, process_name: "node.exe", category: "development", detection_label: "none", pid: 61855, command_source: "local_disk", started_at: new Date("2025-09-12T20:37:09Z") }, { id: 174, app_process_id: 335, endpoint_id: 16, parent_pid: 48395, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 56733, command_source: "temp_folder", started_at: new Date("2025-09-12T16:51:01Z") }, { id: 175, app_process_id: 299, endpoint_id: 5, parent_pid: 40090, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 48172, command_source: "user_profile", started_at: new Date("2025-09-10T14:55:48Z") }, { id: 176, app_process_id: 59, endpoint_id: 30, parent_pid: 53339, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 53100, command_source: "temp_folder", started_at: new Date("2025-09-11T18:32:17Z") }, { id: 177, app_process_id: 425, endpoint_id: 11, parent_pid: 28405, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 55169, command_source: "user_profile", started_at: new Date("2025-09-08T15:51:32Z") }, { id: 178, app_process_id: 579, endpoint_id: 13, parent_pid: 24394, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 28119, command_source: "local_disk", started_at: new Date("2025-09-08T16:36:45Z") }, { id: 179, app_process_id: 441, endpoint_id: 17, parent_pid: 56072, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 16208, command_source: "local_disk", started_at: new Date("2025-09-08T23:52:58Z") }, { id: 180, app_process_id: 486, endpoint_id: 12, parent_pid: 44392, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 34061, command_source: "local_disk", started_at: new Date("2025-09-13T00:25:03Z") }, { id: 181, app_process_id: 433, endpoint_id: 8, parent_pid: 49560, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 40639, command_source: "temp_folder", started_at: new Date("2025-09-11T20:17:39Z") }, { id: 182, app_process_id: 420, endpoint_id: 27, parent_pid: 47194, process_name: "olk.exe", category: "email", detection_label: "none", pid: 8820, command_source: "user_profile", started_at: new Date("2025-09-11T17:04:11Z") }, { id: 183, app_process_id: 8, endpoint_id: 9, parent_pid: 27161, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 25934, command_source: "temp_folder", started_at: new Date("2025-09-10T16:48:30Z") }, { id: 184, app_process_id: 430, endpoint_id: 29, parent_pid: 14673, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 47191, command_source: "temp_folder", started_at: new Date("2025-09-11T12:50:05Z") }, { id: 185, app_process_id: 285, endpoint_id: 18, parent_pid: 64241, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 50340, command_source: "local_disk", started_at: new Date("2025-09-12T14:26:38Z") }, { id: 186, app_process_id: 241, endpoint_id: 10, parent_pid: 32223, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 30415, command_source: "local_disk", started_at: new Date("2025-09-09T14:09:13Z") }, { id: 187, app_process_id: 564, endpoint_id: 24, parent_pid: 20441, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 14955, command_source: "local_disk", started_at: new Date("2025-09-09T15:39:37Z") }, { id: 188, app_process_id: 189, endpoint_id: 5, parent_pid: 26077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 36612, command_source: "local_disk", started_at: new Date("2025-09-10T20:10:02Z") }, { id: 189, app_process_id: 449, endpoint_id: 6, parent_pid: 7351, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 42612, command_source: "local_disk", started_at: new Date("2025-09-10T13:28:41Z") }, { id: 190, app_process_id: 354, endpoint_id: 8, parent_pid: 42988, process_name: "node.exe", category: "development", detection_label: "none", pid: 47393, command_source: "local_disk", started_at: new Date("2025-09-08T13:26:35Z") }, { id: 191, app_process_id: 62, endpoint_id: 30, parent_pid: 13633, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 26603, command_source: "local_disk", started_at: new Date("2025-09-10T16:26:54Z") }, { id: 192, app_process_id: 576, endpoint_id: 7, parent_pid: 9308, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 63629, command_source: "temp_folder", started_at: new Date("2025-09-09T19:15:30Z") }, { id: 193, app_process_id: 225, endpoint_id: 19, parent_pid: 60709, process_name: "node.exe", category: "development", detection_label: "none", pid: 51651, command_source: "user_profile", started_at: new Date("2025-09-09T11:46:11Z") }, { id: 194, app_process_id: 290, endpoint_id: 20, parent_pid: 58314, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 50831, command_source: "local_disk", started_at: new Date("2025-09-12T11:07:19Z") }, { id: 195, app_process_id: 164, endpoint_id: 13, parent_pid: 44115, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 14436, command_source: "local_disk", started_at: new Date("2025-09-09T18:19:39Z") }, { id: 196, app_process_id: 565, endpoint_id: 11, parent_pid: 59866, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 53258, command_source: "user_profile", started_at: new Date("2025-09-12T14:44:25Z") }, { id: 197, app_process_id: 219, endpoint_id: 19, parent_pid: 30347, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 51841, command_source: "network_path", started_at: new Date("2025-09-09T20:18:25Z") }, { id: 198, app_process_id: 232, endpoint_id: 2, parent_pid: 32167, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 26563, command_source: "local_disk", started_at: new Date("2025-09-08T12:35:12Z") }, { id: 199, app_process_id: 23, endpoint_id: 29, parent_pid: 21327, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 9025, command_source: "user_profile", started_at: new Date("2025-09-11T10:17:50Z") }, { id: 200, app_process_id: 139, endpoint_id: 27, parent_pid: 13534, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 62314, command_source: "local_disk", started_at: new Date("2025-09-11T13:44:52Z") }, { id: 201, app_process_id: 398, endpoint_id: 12, parent_pid: 31853, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 52141, command_source: "local_disk", started_at: new Date("2025-09-12T22:47:59Z") }, { id: 202, app_process_id: 437, endpoint_id: 5, parent_pid: 45963, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 49554, command_source: "local_disk", started_at: new Date("2025-09-10T14:57:46Z") }, { id: 203, app_process_id: 130, endpoint_id: 14, parent_pid: 62677, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 41894, command_source: "user_profile", started_at: new Date("2025-09-08T16:57:17Z") }, { id: 204, app_process_id: 517, endpoint_id: 30, parent_pid: 57726, process_name: "olk.exe", category: "email", detection_label: "none", pid: 51038, command_source: "local_disk", started_at: new Date("2025-09-11T19:16:43Z") }, { id: 205, app_process_id: 45, endpoint_id: 29, parent_pid: 10542, process_name: "node.exe", category: "development", detection_label: "none", pid: 18956, command_source: "user_profile", started_at: new Date("2025-09-11T12:30:39Z") }, { id: 206, app_process_id: 432, endpoint_id: 20, parent_pid: 58174, process_name: "node.exe", category: "development", detection_label: "none", pid: 64523, command_source: "local_disk", started_at: new Date("2025-09-08T18:51:09Z") }, { id: 207, app_process_id: 368, endpoint_id: 14, parent_pid: 18083, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 63233, command_source: "local_disk", started_at: new Date("2025-09-10T16:14:53Z") }, { id: 208, app_process_id: 148, endpoint_id: 7, parent_pid: 54781, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 31548, command_source: "local_disk", started_at: new Date("2025-09-08T15:43:08Z") }, { id: 209, app_process_id: 204, endpoint_id: 24, parent_pid: 15665, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 20424, command_source: "local_disk", started_at: new Date("2025-09-08T10:51:35Z") }, { id: 210, app_process_id: 546, endpoint_id: 15, parent_pid: 21296, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 60117, command_source: "local_disk", started_at: new Date("2025-09-12T22:06:35Z") }, { id: 211, app_process_id: 530, endpoint_id: 2, parent_pid: 46255, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 47334, command_source: "local_disk", started_at: new Date("2025-09-09T00:57:00Z") }, { id: 212, app_process_id: 314, endpoint_id: 17, parent_pid: 7325, process_name: "node.exe", category: "development", detection_label: "none", pid: 35275, command_source: "temp_folder", started_at: new Date("2025-09-09T19:20:51Z") }, { id: 213, app_process_id: 94, endpoint_id: 30, parent_pid: 23005, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 1164, command_source: "local_disk", started_at: new Date("2025-09-12T00:52:40Z") }, { id: 214, app_process_id: 577, endpoint_id: 9, parent_pid: 50253, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 60294, command_source: "temp_folder", started_at: new Date("2025-09-10T13:58:36Z") }, { id: 215, app_process_id: 380, endpoint_id: 26, parent_pid: 16118, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 38785, command_source: "local_disk", started_at: new Date("2025-09-08T11:36:42Z") }, { id: 216, app_process_id: 32, endpoint_id: 6, parent_pid: 6449, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 9359, command_source: "local_disk", started_at: new Date("2025-09-10T12:39:10Z") }, { id: 217, app_process_id: 458, endpoint_id: 9, parent_pid: 33005, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 32321, command_source: "local_disk", started_at: new Date("2025-09-12T21:51:21Z") }, { id: 218, app_process_id: 12, endpoint_id: 8, parent_pid: 52296, process_name: "olk.exe", category: "email", detection_label: "none", pid: 20052, command_source: "local_disk", started_at: new Date("2025-09-11T14:10:44Z") }, { id: 219, app_process_id: 554, endpoint_id: 24, parent_pid: 2524, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 9205, command_source: "local_disk", started_at: new Date("2025-09-09T14:55:09Z") }, { id: 220, app_process_id: 464, endpoint_id: 1, parent_pid: 16918, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 40999, command_source: "user_profile", started_at: new Date("2025-09-08T17:29:39Z") }, { id: 221, app_process_id: 264, endpoint_id: 17, parent_pid: 6071, process_name: "node.exe", category: "development", detection_label: "none", pid: 25061, command_source: "user_profile", started_at: new Date("2025-09-11T14:55:25Z") }, { id: 222, app_process_id: 451, endpoint_id: 22, parent_pid: 18454, process_name: "node.exe", category: "development", detection_label: "none", pid: 44563, command_source: "local_disk", started_at: new Date("2025-09-09T11:41:21Z") }, { id: 223, app_process_id: 283, endpoint_id: 19, parent_pid: 31200, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 27781, command_source: "user_profile", started_at: new Date("2025-09-09T12:47:48Z") }, { id: 224, app_process_id: 443, endpoint_id: 29, parent_pid: 7017, process_name: "node.exe", category: "development", detection_label: "none", pid: 14180, command_source: "local_disk", started_at: new Date("2025-09-11T14:11:49Z") }, { id: 225, app_process_id: 304, endpoint_id: 23, parent_pid: 33428, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 30097, command_source: "temp_folder", started_at: new Date("2025-09-08T13:02:16Z") }, { id: 226, app_process_id: 420, endpoint_id: 27, parent_pid: 47194, process_name: "olk.exe", category: "email", detection_label: "none", pid: 24640, command_source: "network_path", started_at: new Date("2025-09-11T17:05:24Z") }, { id: 227, app_process_id: 227, endpoint_id: 24, parent_pid: 48805, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 55244, command_source: "temp_folder", started_at: new Date("2025-09-08T12:15:23Z") }, { id: 228, app_process_id: 388, endpoint_id: 29, parent_pid: 29144, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 22005, command_source: "local_disk", started_at: new Date("2025-09-11T19:01:43Z") }, { id: 229, app_process_id: 377, endpoint_id: 8, parent_pid: 27111, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 30427, command_source: "local_disk", started_at: new Date("2025-09-08T12:54:05Z") }, { id: 230, app_process_id: 32, endpoint_id: 6, parent_pid: 6449, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22511, command_source: "network_path", started_at: new Date("2025-09-10T12:39:59Z") }, { id: 231, app_process_id: 302, endpoint_id: 14, parent_pid: 21968, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 31301, command_source: "local_disk", started_at: new Date("2025-09-08T17:16:28Z") }, { id: 232, app_process_id: 567, endpoint_id: 30, parent_pid: 25903, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 32355, command_source: "local_disk", started_at: new Date("2025-09-10T19:53:31Z") }, { id: 233, app_process_id: 92, endpoint_id: 4, parent_pid: 49989, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 38098, command_source: "local_disk", started_at: new Date("2025-09-10T14:14:27Z") }, { id: 234, app_process_id: 71, endpoint_id: 14, parent_pid: 20163, process_name: "olk.exe", category: "email", detection_label: "none", pid: 29804, command_source: "local_disk", started_at: new Date("2025-09-11T10:24:24Z") }, { id: 235, app_process_id: 437, endpoint_id: 5, parent_pid: 45963, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 1654, command_source: "user_profile", started_at: new Date("2025-09-10T14:59:46Z") }, { id: 236, app_process_id: 72, endpoint_id: 3, parent_pid: 15433, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 21573, command_source: "local_disk", started_at: new Date("2025-09-11T18:41:00Z") }, { id: 237, app_process_id: 197, endpoint_id: 26, parent_pid: 39816, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32565, command_source: "local_disk", started_at: new Date("2025-09-09T15:59:36Z") }, { id: 238, app_process_id: 376, endpoint_id: 8, parent_pid: 13354, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 23600, command_source: "user_profile", started_at: new Date("2025-09-08T14:35:10Z") }, { id: 239, app_process_id: 503, endpoint_id: 9, parent_pid: 58254, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 64715, command_source: "temp_folder", started_at: new Date("2025-09-10T21:47:43Z") }, { id: 240, app_process_id: 179, endpoint_id: 12, parent_pid: 41425, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 57671, command_source: "temp_folder", started_at: new Date("2025-09-12T21:59:11Z") }, { id: 241, app_process_id: 5, endpoint_id: 27, parent_pid: 4607, process_name: "node.exe", category: "development", detection_label: "none", pid: 12122, command_source: "user_profile", started_at: new Date("2025-09-12T15:52:57Z") }, { id: 242, app_process_id: 464, endpoint_id: 1, parent_pid: 16918, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 57971, command_source: "local_disk", started_at: new Date("2025-09-08T17:29:49Z") }, { id: 243, app_process_id: 472, endpoint_id: 1, parent_pid: 50693, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 1729, command_source: "temp_folder", started_at: new Date("2025-09-10T15:59:38Z") }, { id: 244, app_process_id: 132, endpoint_id: 10, parent_pid: 54687, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 11111, command_source: "local_disk", started_at: new Date("2025-09-08T09:34:52Z") }, { id: 245, app_process_id: 237, endpoint_id: 24, parent_pid: 14924, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 13239, command_source: "local_disk", started_at: new Date("2025-09-08T12:40:58Z") }, { id: 246, app_process_id: 379, endpoint_id: 10, parent_pid: 6542, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 36390, command_source: "temp_folder", started_at: new Date("2025-09-10T14:07:52Z") }, { id: 247, app_process_id: 404, endpoint_id: 1, parent_pid: 1270, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 36715, command_source: "user_profile", started_at: new Date("2025-09-09T15:57:34Z") }, { id: 248, app_process_id: 395, endpoint_id: 26, parent_pid: 43857, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 26572, command_source: "local_disk", started_at: new Date("2025-09-09T13:03:23Z") }, { id: 249, app_process_id: 80, endpoint_id: 14, parent_pid: 5293, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 25415, command_source: "local_disk", started_at: new Date("2025-09-08T16:10:30Z") }, { id: 250, app_process_id: 196, endpoint_id: 7, parent_pid: 40860, process_name: "olk.exe", category: "email", detection_label: "none", pid: 60016, command_source: "user_profile", started_at: new Date("2025-09-12T15:34:56Z") }, { id: 251, app_process_id: 62, endpoint_id: 30, parent_pid: 13633, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 48711, command_source: "user_profile", started_at: new Date("2025-09-10T16:28:37Z") }, { id: 252, app_process_id: 473, endpoint_id: 17, parent_pid: 982, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 3603, command_source: "local_disk", started_at: new Date("2025-09-09T01:05:14Z") }, { id: 253, app_process_id: 80, endpoint_id: 14, parent_pid: 5293, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 40023, command_source: "temp_folder", started_at: new Date("2025-09-08T16:10:39Z") }, { id: 254, app_process_id: 365, endpoint_id: 30, parent_pid: 2077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 49295, command_source: "user_profile", started_at: new Date("2025-09-10T16:57:41Z") }, { id: 255, app_process_id: 5, endpoint_id: 27, parent_pid: 4607, process_name: "node.exe", category: "development", detection_label: "none", pid: 58155, command_source: "local_disk", started_at: new Date("2025-09-12T15:53:35Z") }, { id: 256, app_process_id: 114, endpoint_id: 27, parent_pid: 58166, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 38598, command_source: "local_disk", started_at: new Date("2025-09-12T17:46:52Z") }, { id: 257, app_process_id: 366, endpoint_id: 4, parent_pid: 38325, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 29704, command_source: "user_profile", started_at: new Date("2025-09-11T09:30:31Z") }, { id: 258, app_process_id: 348, endpoint_id: 14, parent_pid: 36455, process_name: "olk.exe", category: "email", detection_label: "none", pid: 15922, command_source: "user_profile", started_at: new Date("2025-09-10T15:21:42Z") }, { id: 259, app_process_id: 69, endpoint_id: 2, parent_pid: 34591, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 55151, command_source: "user_profile", started_at: new Date("2025-09-11T17:38:46Z") }, { id: 260, app_process_id: 44, endpoint_id: 28, parent_pid: 34278, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 61890, command_source: "local_disk", started_at: new Date("2025-09-08T14:11:16Z") }, { id: 261, app_process_id: 412, endpoint_id: 8, parent_pid: 2537, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 35144, command_source: "local_disk", started_at: new Date("2025-09-11T18:48:13Z") }, { id: 262, app_process_id: 68, endpoint_id: 30, parent_pid: 28650, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 49643, command_source: "local_disk", started_at: new Date("2025-09-10T17:46:49Z") }, { id: 263, app_process_id: 236, endpoint_id: 3, parent_pid: 19597, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 17769, command_source: "local_disk", started_at: new Date("2025-09-11T20:38:00Z") }, { id: 264, app_process_id: 247, endpoint_id: 9, parent_pid: 49419, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 15100, command_source: "temp_folder", started_at: new Date("2025-09-10T10:40:16Z") }, { id: 265, app_process_id: 64, endpoint_id: 26, parent_pid: 27918, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 64321, command_source: "local_disk", started_at: new Date("2025-09-09T13:39:14Z") }, { id: 266, app_process_id: 308, endpoint_id: 1, parent_pid: 39176, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 36227, command_source: "local_disk", started_at: new Date("2025-09-08T13:27:14Z") }, { id: 267, app_process_id: 100, endpoint_id: 2, parent_pid: 54664, process_name: "olk.exe", category: "email", detection_label: "none", pid: 40481, command_source: "local_disk", started_at: new Date("2025-09-08T14:12:42Z") }, { id: 268, app_process_id: 398, endpoint_id: 12, parent_pid: 31853, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 6531, command_source: "local_disk", started_at: new Date("2025-09-12T22:49:25Z") }, { id: 269, app_process_id: 221, endpoint_id: 25, parent_pid: 36353, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 51335, command_source: "local_disk", started_at: new Date("2025-09-10T13:44:21Z") }, { id: 270, app_process_id: 508, endpoint_id: 17, parent_pid: 56082, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22611, command_source: "user_profile", started_at: new Date("2025-09-11T11:39:20Z") }, { id: 271, app_process_id: 191, endpoint_id: 18, parent_pid: 7221, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 28096, command_source: "local_disk", started_at: new Date("2025-09-10T16:48:44Z") }, { id: 272, app_process_id: 454, endpoint_id: 24, parent_pid: 44332, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 59285, command_source: "temp_folder", started_at: new Date("2025-09-08T17:27:14Z") }, { id: 273, app_process_id: 79, endpoint_id: 7, parent_pid: 32308, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 32749, command_source: "network_path", started_at: new Date("2025-09-09T09:47:31Z") }, { id: 274, app_process_id: 345, endpoint_id: 29, parent_pid: 30315, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 21245, command_source: "local_disk", started_at: new Date("2025-09-11T12:19:53Z") }, { id: 275, app_process_id: 300, endpoint_id: 26, parent_pid: 13451, process_name: "node.exe", category: "development", detection_label: "none", pid: 55324, command_source: "local_disk", started_at: new Date("2025-09-09T16:41:09Z") }, { id: 276, app_process_id: 4, endpoint_id: 10, parent_pid: 13733, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 11243, command_source: "local_disk", started_at: new Date("2025-09-10T13:43:31Z") }, { id: 277, app_process_id: 472, endpoint_id: 1, parent_pid: 50693, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 58788, command_source: "local_disk", started_at: new Date("2025-09-10T16:01:25Z") }, { id: 278, app_process_id: 474, endpoint_id: 14, parent_pid: 46432, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 44687, command_source: "temp_folder", started_at: new Date("2025-09-11T14:17:31Z") }, { id: 279, app_process_id: 290, endpoint_id: 20, parent_pid: 58314, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 61570, command_source: "temp_folder", started_at: new Date("2025-09-12T11:09:19Z") }, { id: 280, app_process_id: 236, endpoint_id: 3, parent_pid: 19597, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 53586, command_source: "local_disk", started_at: new Date("2025-09-11T20:38:36Z") }, { id: 281, app_process_id: 189, endpoint_id: 5, parent_pid: 26077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 51509, command_source: "temp_folder", started_at: new Date("2025-09-10T20:11:01Z") }, { id: 282, app_process_id: 47, endpoint_id: 28, parent_pid: 26066, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 34472, command_source: "local_disk", started_at: new Date("2025-09-08T18:35:33Z") }, { id: 283, app_process_id: 212, endpoint_id: 4, parent_pid: 61892, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 26873, command_source: "local_disk", started_at: new Date("2025-09-11T18:43:05Z") }, { id: 284, app_process_id: 445, endpoint_id: 16, parent_pid: 8609, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45608, command_source: "local_disk", started_at: new Date("2025-09-12T19:51:59Z") }, { id: 285, app_process_id: 349, endpoint_id: 19, parent_pid: 20688, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 59177, command_source: "local_disk", started_at: new Date("2025-09-10T13:32:24Z") }, { id: 286, app_process_id: 352, endpoint_id: 18, parent_pid: 39809, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 18022, command_source: "user_profile", started_at: new Date("2025-09-10T19:58:28Z") }, { id: 287, app_process_id: 389, endpoint_id: 23, parent_pid: 1834, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 46842, command_source: "network_path", started_at: new Date("2025-09-10T18:30:53Z") }, { id: 288, app_process_id: 56, endpoint_id: 10, parent_pid: 61151, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 16846, command_source: "local_disk", started_at: new Date("2025-09-08T08:02:04Z") }, { id: 289, app_process_id: 145, endpoint_id: 2, parent_pid: 11876, process_name: "olk.exe", category: "email", detection_label: "none", pid: 64062, command_source: "local_disk", started_at: new Date("2025-09-10T12:24:36Z") }, { id: 290, app_process_id: 443, endpoint_id: 29, parent_pid: 7017, process_name: "node.exe", category: "development", detection_label: "none", pid: 6071, command_source: "local_disk", started_at: new Date("2025-09-11T14:12:19Z") }, { id: 291, app_process_id: 187, endpoint_id: 3, parent_pid: 56528, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 11089, command_source: "temp_folder", started_at: new Date("2025-09-11T19:06:37Z") }, { id: 292, app_process_id: 562, endpoint_id: 24, parent_pid: 58496, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17881, command_source: "local_disk", started_at: new Date("2025-09-08T17:29:57Z") }, { id: 293, app_process_id: 577, endpoint_id: 9, parent_pid: 50253, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 23133, command_source: "local_disk", started_at: new Date("2025-09-10T13:59:17Z") }, { id: 294, app_process_id: 103, endpoint_id: 16, parent_pid: 37100, process_name: "olk.exe", category: "email", detection_label: "none", pid: 2152, command_source: "local_disk", started_at: new Date("2025-09-12T15:35:44Z") }, { id: 295, app_process_id: 456, endpoint_id: 12, parent_pid: 45910, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 37910, command_source: "local_disk", started_at: new Date("2025-09-08T21:42:20Z") }, { id: 296, app_process_id: 423, endpoint_id: 16, parent_pid: 29523, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 12747, command_source: "temp_folder", started_at: new Date("2025-09-12T19:34:25Z") }, { id: 297, app_process_id: 549, endpoint_id: 9, parent_pid: 54109, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 54251, command_source: "network_path", started_at: new Date("2025-09-08T22:54:06Z") }, { id: 298, app_process_id: 557, endpoint_id: 30, parent_pid: 51424, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 44477, command_source: "temp_folder", started_at: new Date("2025-09-12T04:19:19Z") }, { id: 299, app_process_id: 525, endpoint_id: 24, parent_pid: 9432, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 15415, command_source: "local_disk", started_at: new Date("2025-09-09T14:20:46Z") }, { id: 300, app_process_id: 570, endpoint_id: 3, parent_pid: 37692, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 3681, command_source: "user_profile", started_at: new Date("2025-09-11T22:49:31Z") }, { id: 301, app_process_id: 476, endpoint_id: 16, parent_pid: 56343, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 24563, command_source: "temp_folder", started_at: new Date("2025-09-10T20:24:06Z") }, { id: 302, app_process_id: 92, endpoint_id: 4, parent_pid: 49989, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 9180, command_source: "local_disk", started_at: new Date("2025-09-10T14:16:26Z") }, { id: 303, app_process_id: 348, endpoint_id: 14, parent_pid: 36455, process_name: "olk.exe", category: "email", detection_label: "none", pid: 42246, command_source: "local_disk", started_at: new Date("2025-09-10T15:23:25Z") }, { id: 304, app_process_id: 511, endpoint_id: 22, parent_pid: 21581, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 11738, command_source: "local_disk", started_at: new Date("2025-09-09T11:50:46Z") }, { id: 305, app_process_id: 533, endpoint_id: 1, parent_pid: 44023, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 25135, command_source: "user_profile", started_at: new Date("2025-09-10T16:42:06Z") }, { id: 306, app_process_id: 254, endpoint_id: 18, parent_pid: 56120, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 27568, command_source: "user_profile", started_at: new Date("2025-09-10T15:47:05Z") }, { id: 307, app_process_id: 387, endpoint_id: 28, parent_pid: 13027, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 18296, command_source: "network_path", started_at: new Date("2025-09-08T19:00:36Z") }, { id: 308, app_process_id: 38, endpoint_id: 23, parent_pid: 52701, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 61360, command_source: "local_disk", started_at: new Date("2025-09-10T15:48:41Z") }, { id: 309, app_process_id: 12, endpoint_id: 8, parent_pid: 52296, process_name: "olk.exe", category: "email", detection_label: "none", pid: 2764, command_source: "user_profile", started_at: new Date("2025-09-11T14:12:30Z") }, { id: 310, app_process_id: 345, endpoint_id: 29, parent_pid: 30315, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 9990, command_source: "user_profile", started_at: new Date("2025-09-11T12:21:00Z") }, { id: 311, app_process_id: 523, endpoint_id: 9, parent_pid: 41324, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 39904, command_source: "network_path", started_at: new Date("2025-09-10T23:16:37Z") }, { id: 312, app_process_id: 470, endpoint_id: 12, parent_pid: 11266, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 17374, command_source: "local_disk", started_at: new Date("2025-09-12T23:14:25Z") }, { id: 313, app_process_id: 72, endpoint_id: 3, parent_pid: 15433, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 49530, command_source: "local_disk", started_at: new Date("2025-09-11T18:41:55Z") }, { id: 314, app_process_id: 88, endpoint_id: 12, parent_pid: 9701, process_name: "node.exe", category: "development", detection_label: "none", pid: 7157, command_source: "network_path", started_at: new Date("2025-09-09T11:47:51Z") }, { id: 315, app_process_id: 331, endpoint_id: 4, parent_pid: 58772, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 61084, command_source: "local_disk", started_at: new Date("2025-09-11T20:44:28Z") }, { id: 316, app_process_id: 130, endpoint_id: 14, parent_pid: 62677, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 25409, command_source: "local_disk", started_at: new Date("2025-09-08T16:57:49Z") }, { id: 317, app_process_id: 285, endpoint_id: 18, parent_pid: 64241, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 60884, command_source: "local_disk", started_at: new Date("2025-09-12T14:26:41Z") }, { id: 318, app_process_id: 100, endpoint_id: 2, parent_pid: 54664, process_name: "olk.exe", category: "email", detection_label: "none", pid: 12786, command_source: "local_disk", started_at: new Date("2025-09-08T14:13:56Z") }, { id: 319, app_process_id: 259, endpoint_id: 29, parent_pid: 1192, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 24121, command_source: "local_disk", started_at: new Date("2025-09-10T12:04:50Z") }, { id: 320, app_process_id: 302, endpoint_id: 14, parent_pid: 21968, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 9286, command_source: "network_path", started_at: new Date("2025-09-08T17:16:37Z") }, { id: 321, app_process_id: 239, endpoint_id: 23, parent_pid: 3544, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 10671, command_source: "local_disk", started_at: new Date("2025-09-08T12:31:24Z") }, { id: 322, app_process_id: 544, endpoint_id: 14, parent_pid: 56307, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 47075, command_source: "user_profile", started_at: new Date("2025-09-08T21:17:52Z") }, { id: 323, app_process_id: 43, endpoint_id: 3, parent_pid: 57823, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 29428, command_source: "local_disk", started_at: new Date("2025-09-11T16:37:17Z") }, { id: 324, app_process_id: 557, endpoint_id: 30, parent_pid: 51424, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 10452, command_source: "local_disk", started_at: new Date("2025-09-12T04:19:58Z") }, { id: 325, app_process_id: 94, endpoint_id: 30, parent_pid: 23005, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 18947, command_source: "local_disk", started_at: new Date("2025-09-12T00:54:19Z") }, { id: 326, app_process_id: 280, endpoint_id: 24, parent_pid: 42237, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 23642, command_source: "temp_folder", started_at: new Date("2025-09-08T15:06:49Z") }, { id: 327, app_process_id: 114, endpoint_id: 27, parent_pid: 58166, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 25589, command_source: "temp_folder", started_at: new Date("2025-09-12T17:48:40Z") }, { id: 328, app_process_id: 579, endpoint_id: 13, parent_pid: 24394, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 41697, command_source: "local_disk", started_at: new Date("2025-09-08T16:38:10Z") }, { id: 329, app_process_id: 300, endpoint_id: 26, parent_pid: 13451, process_name: "node.exe", category: "development", detection_label: "none", pid: 47419, command_source: "user_profile", started_at: new Date("2025-09-09T16:41:11Z") }, { id: 330, app_process_id: 473, endpoint_id: 17, parent_pid: 982, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 57718, command_source: "temp_folder", started_at: new Date("2025-09-09T01:07:06Z") }, { id: 331, app_process_id: 275, endpoint_id: 27, parent_pid: 50379, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 18698, command_source: "local_disk", started_at: new Date("2025-09-11T16:32:25Z") }, { id: 332, app_process_id: 235, endpoint_id: 5, parent_pid: 34266, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 22027, command_source: "user_profile", started_at: new Date("2025-09-10T14:04:59Z") }, { id: 333, app_process_id: 303, endpoint_id: 7, parent_pid: 60717, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 59737, command_source: "local_disk", started_at: new Date("2025-09-10T22:22:11Z") }, { id: 334, app_process_id: 326, endpoint_id: 8, parent_pid: 23781, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 33463, command_source: "local_disk", started_at: new Date("2025-09-11T17:50:13Z") }, { id: 335, app_process_id: 563, endpoint_id: 14, parent_pid: 62900, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 28152, command_source: "temp_folder", started_at: new Date("2025-09-10T15:57:30Z") }, { id: 336, app_process_id: 569, endpoint_id: 8, parent_pid: 10941, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 45925, command_source: "local_disk", started_at: new Date("2025-09-11T19:05:25Z") }, { id: 337, app_process_id: 201, endpoint_id: 12, parent_pid: 63883, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 50103, command_source: "user_profile", started_at: new Date("2025-09-09T13:30:33Z") }, { id: 338, app_process_id: 233, endpoint_id: 1, parent_pid: 46600, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 60354, command_source: "temp_folder", started_at: new Date("2025-09-13T00:16:07Z") }, { id: 339, app_process_id: 70, endpoint_id: 20, parent_pid: 7497, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 18447, command_source: "local_disk", started_at: new Date("2025-09-12T20:23:42Z") }, { id: 340, app_process_id: 144, endpoint_id: 18, parent_pid: 57322, process_name: "node.exe", category: "development", detection_label: "none", pid: 13091, command_source: "local_disk", started_at: new Date("2025-09-10T16:39:39Z") }, { id: 341, app_process_id: 522, endpoint_id: 28, parent_pid: 51499, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 13177, command_source: "network_path", started_at: new Date("2025-09-08T19:52:55Z") }, { id: 342, app_process_id: 225, endpoint_id: 19, parent_pid: 60709, process_name: "node.exe", category: "development", detection_label: "none", pid: 45960, command_source: "local_disk", started_at: new Date("2025-09-09T11:48:12Z") }, { id: 343, app_process_id: 425, endpoint_id: 11, parent_pid: 28405, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 40560, command_source: "local_disk", started_at: new Date("2025-09-08T15:52:04Z") }, { id: 344, app_process_id: 219, endpoint_id: 19, parent_pid: 30347, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 43942, command_source: "local_disk", started_at: new Date("2025-09-09T20:19:57Z") }, { id: 345, app_process_id: 319, endpoint_id: 5, parent_pid: 9012, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 26755, command_source: "local_disk", started_at: new Date("2025-09-09T14:34:47Z") }, { id: 346, app_process_id: 449, endpoint_id: 6, parent_pid: 7351, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 5719, command_source: "temp_folder", started_at: new Date("2025-09-10T13:28:52Z") }, { id: 347, app_process_id: 532, endpoint_id: 11, parent_pid: 27202, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 40037, command_source: "user_profile", started_at: new Date("2025-09-08T16:06:59Z") }, { id: 348, app_process_id: 515, endpoint_id: 19, parent_pid: 36077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 23389, command_source: "temp_folder", started_at: new Date("2025-09-10T16:41:53Z") }, { id: 349, app_process_id: 481, endpoint_id: 26, parent_pid: 56274, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 22128, command_source: "user_profile", started_at: new Date("2025-09-08T16:58:45Z") }, { id: 350, app_process_id: 314, endpoint_id: 17, parent_pid: 7325, process_name: "node.exe", category: "development", detection_label: "none", pid: 18978, command_source: "local_disk", started_at: new Date("2025-09-09T19:21:37Z") }, { id: 351, app_process_id: 456, endpoint_id: 12, parent_pid: 45910, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 14819, command_source: "local_disk", started_at: new Date("2025-09-08T21:42:34Z") }, { id: 352, app_process_id: 333, endpoint_id: 14, parent_pid: 7215, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 19944, command_source: "local_disk", started_at: new Date("2025-09-08T18:15:04Z") }, { id: 353, app_process_id: 356, endpoint_id: 16, parent_pid: 54721, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 38745, command_source: "local_disk", started_at: new Date("2025-09-10T18:23:43Z") }, { id: 354, app_process_id: 322, endpoint_id: 18, parent_pid: 45116, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 37192, command_source: "local_disk", started_at: new Date("2025-09-10T19:54:48Z") }, { id: 355, app_process_id: 252, endpoint_id: 4, parent_pid: 47675, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 7207, command_source: "user_profile", started_at: new Date("2025-09-10T18:41:27Z") }, { id: 356, app_process_id: 425, endpoint_id: 11, parent_pid: 28405, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 62331, command_source: "local_disk", started_at: new Date("2025-09-08T15:53:46Z") }, { id: 357, app_process_id: 11, endpoint_id: 13, parent_pid: 25035, process_name: "node.exe", category: "development", detection_label: "none", pid: 37690, command_source: "local_disk", started_at: new Date("2025-09-09T17:12:22Z") }, { id: 358, app_process_id: 45, endpoint_id: 29, parent_pid: 10542, process_name: "node.exe", category: "development", detection_label: "none", pid: 788, command_source: "local_disk", started_at: new Date("2025-09-11T12:32:39Z") }, { id: 359, app_process_id: 310, endpoint_id: 27, parent_pid: 31168, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 25178, command_source: "local_disk", started_at: new Date("2025-09-11T16:46:09Z") }, { id: 360, app_process_id: 383, endpoint_id: 11, parent_pid: 42906, process_name: "node.exe", category: "development", detection_label: "none", pid: 42080, command_source: "local_disk", started_at: new Date("2025-09-12T21:36:22Z") }, { id: 361, app_process_id: 222, endpoint_id: 14, parent_pid: 28924, process_name: "node.exe", category: "development", detection_label: "none", pid: 48953, command_source: "local_disk", started_at: new Date("2025-09-10T14:29:23Z") }, { id: 362, app_process_id: 468, endpoint_id: 20, parent_pid: 50480, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 7566, command_source: "local_disk", started_at: new Date("2025-09-08T19:54:58Z") }, { id: 363, app_process_id: 219, endpoint_id: 19, parent_pid: 30347, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 40145, command_source: "local_disk", started_at: new Date("2025-09-09T20:21:38Z") }, { id: 364, app_process_id: 568, endpoint_id: 10, parent_pid: 2260, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 33834, command_source: "temp_folder", started_at: new Date("2025-09-09T15:49:27Z") }, { id: 365, app_process_id: 442, endpoint_id: 19, parent_pid: 7940, process_name: "node.exe", category: "development", detection_label: "none", pid: 45537, command_source: "local_disk", started_at: new Date("2025-09-09T23:31:41Z") }, { id: 366, app_process_id: 5, endpoint_id: 27, parent_pid: 4607, process_name: "node.exe", category: "development", detection_label: "none", pid: 54289, command_source: "temp_folder", started_at: new Date("2025-09-12T15:55:09Z") }, { id: 367, app_process_id: 298, endpoint_id: 2, parent_pid: 40165, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 5447, command_source: "local_disk", started_at: new Date("2025-09-10T16:52:51Z") }, { id: 368, app_process_id: 2, endpoint_id: 4, parent_pid: 36180, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 57299, command_source: "user_profile", started_at: new Date("2025-09-11T08:16:49Z") }, { id: 369, app_process_id: 417, endpoint_id: 29, parent_pid: 7857, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 42628, command_source: "local_disk", started_at: new Date("2025-09-08T17:37:37Z") }, { id: 370, app_process_id: 324, endpoint_id: 8, parent_pid: 30035, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 34000, command_source: "local_disk", started_at: new Date("2025-09-11T16:25:42Z") }, { id: 371, app_process_id: 11, endpoint_id: 13, parent_pid: 25035, process_name: "node.exe", category: "development", detection_label: "none", pid: 41579, command_source: "local_disk", started_at: new Date("2025-09-09T17:13:40Z") }, { id: 372, app_process_id: 127, endpoint_id: 15, parent_pid: 54190, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 47838, command_source: "local_disk", started_at: new Date("2025-09-08T16:25:01Z") }, { id: 373, app_process_id: 376, endpoint_id: 8, parent_pid: 13354, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 48102, command_source: "local_disk", started_at: new Date("2025-09-08T14:35:41Z") }, { id: 374, app_process_id: 561, endpoint_id: 16, parent_pid: 31827, process_name: "olk.exe", category: "email", detection_label: "none", pid: 19878, command_source: "local_disk", started_at: new Date("2025-09-12T20:35:13Z") }, { id: 375, app_process_id: 248, endpoint_id: 4, parent_pid: 60865, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 61982, command_source: "local_disk", started_at: new Date("2025-09-11T19:42:46Z") }, { id: 376, app_process_id: 396, endpoint_id: 19, parent_pid: 22514, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 58420, command_source: "local_disk", started_at: new Date("2025-09-09T22:08:14Z") }, { id: 377, app_process_id: 517, endpoint_id: 30, parent_pid: 57726, process_name: "olk.exe", category: "email", detection_label: "none", pid: 64130, command_source: "local_disk", started_at: new Date("2025-09-11T19:18:08Z") }, { id: 378, app_process_id: 281, endpoint_id: 5, parent_pid: 44118, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 33597, command_source: "temp_folder", started_at: new Date("2025-09-11T15:19:29Z") }, { id: 379, app_process_id: 532, endpoint_id: 11, parent_pid: 27202, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 9815, command_source: "user_profile", started_at: new Date("2025-09-08T16:07:32Z") }, { id: 380, app_process_id: 195, endpoint_id: 9, parent_pid: 54269, process_name: "node.exe", category: "development", detection_label: "none", pid: 51187, command_source: "user_profile", started_at: new Date("2025-09-12T18:22:28Z") }, { id: 381, app_process_id: 72, endpoint_id: 3, parent_pid: 15433, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 57075, command_source: "user_profile", started_at: new Date("2025-09-11T18:42:48Z") }, { id: 382, app_process_id: 114, endpoint_id: 27, parent_pid: 58166, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 51952, command_source: "local_disk", started_at: new Date("2025-09-12T17:49:35Z") }, { id: 383, app_process_id: 365, endpoint_id: 30, parent_pid: 2077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 9382, command_source: "user_profile", started_at: new Date("2025-09-10T16:58:52Z") }, { id: 384, app_process_id: 365, endpoint_id: 30, parent_pid: 2077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 51724, command_source: "local_disk", started_at: new Date("2025-09-10T16:59:08Z") }, { id: 385, app_process_id: 265, endpoint_id: 14, parent_pid: 932, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 16388, command_source: "temp_folder", started_at: new Date("2025-09-11T11:38:09Z") }, { id: 386, app_process_id: 227, endpoint_id: 24, parent_pid: 48805, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 27036, command_source: "local_disk", started_at: new Date("2025-09-08T12:16:03Z") }, { id: 387, app_process_id: 198, endpoint_id: 5, parent_pid: 48079, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 60734, command_source: "local_disk", started_at: new Date("2025-09-10T21:31:06Z") }, { id: 388, app_process_id: 455, endpoint_id: 8, parent_pid: 28274, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 5593, command_source: "temp_folder", started_at: new Date("2025-09-11T20:52:05Z") }, { id: 389, app_process_id: 468, endpoint_id: 20, parent_pid: 50480, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 28686, command_source: "local_disk", started_at: new Date("2025-09-08T19:55:57Z") }, { id: 390, app_process_id: 222, endpoint_id: 14, parent_pid: 28924, process_name: "node.exe", category: "development", detection_label: "none", pid: 1144, command_source: "local_disk", started_at: new Date("2025-09-10T14:31:12Z") }, { id: 391, app_process_id: 42, endpoint_id: 27, parent_pid: 43487, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 2753, command_source: "user_profile", started_at: new Date("2025-09-11T12:25:43Z") }, { id: 392, app_process_id: 333, endpoint_id: 14, parent_pid: 7215, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 31836, command_source: "temp_folder", started_at: new Date("2025-09-08T18:15:14Z") }, { id: 393, app_process_id: 211, endpoint_id: 14, parent_pid: 5420, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 34454, command_source: "temp_folder", started_at: new Date("2025-09-11T09:32:08Z") }, { id: 394, app_process_id: 308, endpoint_id: 1, parent_pid: 39176, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 22945, command_source: "temp_folder", started_at: new Date("2025-09-08T13:29:03Z") }, { id: 395, app_process_id: 221, endpoint_id: 25, parent_pid: 36353, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 2690, command_source: "local_disk", started_at: new Date("2025-09-10T13:45:45Z") }, { id: 396, app_process_id: 291, endpoint_id: 1, parent_pid: 24759, process_name: "olk.exe", category: "email", detection_label: "none", pid: 35574, command_source: "local_disk", started_at: new Date("2025-09-13T00:32:39Z") }, { id: 397, app_process_id: 146, endpoint_id: 15, parent_pid: 25240, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 62976, command_source: "local_disk", started_at: new Date("2025-09-12T18:47:34Z") }, { id: 398, app_process_id: 41, endpoint_id: 17, parent_pid: 37138, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 32866, command_source: "local_disk", started_at: new Date("2025-09-09T17:54:09Z") }, { id: 399, app_process_id: 363, endpoint_id: 2, parent_pid: 16048, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 32246, command_source: "user_profile", started_at: new Date("2025-09-12T16:29:28Z") }, { id: 400, app_process_id: 139, endpoint_id: 27, parent_pid: 13534, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 30629, command_source: "temp_folder", started_at: new Date("2025-09-11T13:46:21Z") }, { id: 401, app_process_id: 282, endpoint_id: 21, parent_pid: 25431, process_name: "node.exe", category: "development", detection_label: "none", pid: 5995, command_source: "user_profile", started_at: new Date("2025-09-09T10:53:18Z") }, { id: 402, app_process_id: 259, endpoint_id: 29, parent_pid: 1192, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 64519, command_source: "local_disk", started_at: new Date("2025-09-10T12:04:52Z") }, { id: 403, app_process_id: 560, endpoint_id: 12, parent_pid: 18770, process_name: "node.exe", category: "development", detection_label: "none", pid: 54426, command_source: "user_profile", started_at: new Date("2025-09-13T01:59:00Z") }, { id: 404, app_process_id: 196, endpoint_id: 7, parent_pid: 40860, process_name: "olk.exe", category: "email", detection_label: "none", pid: 29843, command_source: "user_profile", started_at: new Date("2025-09-12T15:36:57Z") }, { id: 405, app_process_id: 66, endpoint_id: 30, parent_pid: 47490, process_name: "olk.exe", category: "email", detection_label: "none", pid: 45716, command_source: "local_disk", started_at: new Date("2025-09-11T23:32:45Z") }, { id: 406, app_process_id: 148, endpoint_id: 7, parent_pid: 54781, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 45962, command_source: "user_profile", started_at: new Date("2025-09-08T15:43:37Z") }, { id: 407, app_process_id: 98, endpoint_id: 1, parent_pid: 41939, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 41437, command_source: "local_disk", started_at: new Date("2025-09-09T13:20:01Z") }, { id: 408, app_process_id: 217, endpoint_id: 23, parent_pid: 61419, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 42529, command_source: "local_disk", started_at: new Date("2025-09-10T17:42:09Z") }, { id: 409, app_process_id: 503, endpoint_id: 9, parent_pid: 58254, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 57005, command_source: "temp_folder", started_at: new Date("2025-09-10T21:49:14Z") }, { id: 410, app_process_id: 97, endpoint_id: 13, parent_pid: 10964, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 63419, command_source: "temp_folder", started_at: new Date("2025-09-09T17:35:36Z") }, { id: 411, app_process_id: 1, endpoint_id: 5, parent_pid: 59762, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 16568, command_source: "local_disk", started_at: new Date("2025-09-10T11:52:53Z") }, { id: 412, app_process_id: 130, endpoint_id: 14, parent_pid: 62677, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 29898, command_source: "local_disk", started_at: new Date("2025-09-08T16:59:24Z") }, { id: 413, app_process_id: 304, endpoint_id: 23, parent_pid: 33428, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 34929, command_source: "user_profile", started_at: new Date("2025-09-08T13:03:16Z") }, { id: 414, app_process_id: 401, endpoint_id: 4, parent_pid: 22532, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 22148, command_source: "local_disk", started_at: new Date("2025-09-10T19:42:39Z") }, { id: 415, app_process_id: 325, endpoint_id: 30, parent_pid: 20469, process_name: "node.exe", category: "development", detection_label: "none", pid: 53441, command_source: "local_disk", started_at: new Date("2025-09-08T16:25:20Z") }, { id: 416, app_process_id: 562, endpoint_id: 24, parent_pid: 58496, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 32671, command_source: "local_disk", started_at: new Date("2025-09-08T17:30:42Z") }, { id: 417, app_process_id: 385, endpoint_id: 5, parent_pid: 19298, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 27953, command_source: "temp_folder", started_at: new Date("2025-09-10T22:54:40Z") }, { id: 418, app_process_id: 435, endpoint_id: 7, parent_pid: 42046, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 36056, command_source: "local_disk", started_at: new Date("2025-09-08T17:36:10Z") }, { id: 419, app_process_id: 247, endpoint_id: 9, parent_pid: 49419, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 1287, command_source: "temp_folder", started_at: new Date("2025-09-10T10:40:47Z") }, { id: 420, app_process_id: 489, endpoint_id: 18, parent_pid: 22003, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 41581, command_source: "local_disk", started_at: new Date("2025-09-10T22:43:02Z") }, { id: 421, app_process_id: 13, endpoint_id: 12, parent_pid: 63035, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 9672, command_source: "user_profile", started_at: new Date("2025-09-08T16:28:37Z") }, { id: 422, app_process_id: 462, endpoint_id: 9, parent_pid: 1160, process_name: "olk.exe", category: "email", detection_label: "none", pid: 8626, command_source: "local_disk", started_at: new Date("2025-09-10T20:35:59Z") }, { id: 423, app_process_id: 53, endpoint_id: 26, parent_pid: 62824, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 58521, command_source: "user_profile", started_at: new Date("2025-09-09T13:18:48Z") }, { id: 424, app_process_id: 36, endpoint_id: 8, parent_pid: 26578, process_name: "olk.exe", category: "email", detection_label: "none", pid: 13750, command_source: "user_profile", started_at: new Date("2025-09-08T10:19:21Z") }, { id: 425, app_process_id: 458, endpoint_id: 9, parent_pid: 33005, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 26208, command_source: "user_profile", started_at: new Date("2025-09-12T21:52:40Z") }, { id: 426, app_process_id: 69, endpoint_id: 2, parent_pid: 34591, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 63087, command_source: "network_path", started_at: new Date("2025-09-11T17:39:46Z") }, { id: 427, app_process_id: 43, endpoint_id: 3, parent_pid: 57823, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 35789, command_source: "temp_folder", started_at: new Date("2025-09-11T16:38:36Z") }, { id: 428, app_process_id: 202, endpoint_id: 23, parent_pid: 43291, process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 50742, command_source: "temp_folder", started_at: new Date("2025-09-08T11:44:09Z") }, { id: 429, app_process_id: 64, endpoint_id: 26, parent_pid: 27918, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 28227, command_source: "temp_folder", started_at: new Date("2025-09-09T13:40:20Z") }, { id: 430, app_process_id: 529, endpoint_id: 15, parent_pid: 52105, process_name: "node.exe", category: "development", detection_label: "none", pid: 60323, command_source: "temp_folder", started_at: new Date("2025-09-12T21:12:41Z") }, { id: 431, app_process_id: 531, endpoint_id: 26, parent_pid: 56848, process_name: "schtasks.exe", category: "scheduled_task_creation", detection_label: "persistence_task", pid: 55347, command_source: "user_profile", started_at: new Date("2025-09-08T17:37:44Z") }, { id: 432, app_process_id: 533, endpoint_id: 1, parent_pid: 44023, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 42562, command_source: "user_profile", started_at: new Date("2025-09-10T16:43:19Z") }, { id: 433, app_process_id: 158, endpoint_id: 23, parent_pid: 11402, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 50804, command_source: "local_disk", started_at: new Date("2025-09-10T17:24:37Z") }, { id: 434, app_process_id: 183, endpoint_id: 3, parent_pid: 57760, process_name: "olk.exe", category: "email", detection_label: "none", pid: 36419, command_source: "user_profile", started_at: new Date("2025-09-11T20:08:56Z") }, { id: 435, app_process_id: 450, endpoint_id: 3, parent_pid: 52592, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 59120, command_source: "local_disk", started_at: new Date("2025-09-11T22:30:49Z") }, { id: 436, app_process_id: 292, endpoint_id: 30, parent_pid: 43343, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 42834, command_source: "local_disk", started_at: new Date("2025-09-12T01:46:54Z") }, { id: 437, app_process_id: 395, endpoint_id: 26, parent_pid: 43857, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 50986, command_source: "temp_folder", started_at: new Date("2025-09-09T13:04:50Z") }, { id: 438, app_process_id: 396, endpoint_id: 19, parent_pid: 22514, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 62045, command_source: "local_disk", started_at: new Date("2025-09-09T22:08:26Z") }, { id: 439, app_process_id: 281, endpoint_id: 5, parent_pid: 44118, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 40738, command_source: "local_disk", started_at: new Date("2025-09-11T15:19:57Z") }, { id: 440, app_process_id: 300, endpoint_id: 26, parent_pid: 13451, process_name: "node.exe", category: "development", detection_label: "none", pid: 42535, command_source: "local_disk", started_at: new Date("2025-09-09T16:41:22Z") }, { id: 441, app_process_id: 507, endpoint_id: 11, parent_pid: 24155, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 33961, command_source: "local_disk", started_at: new Date("2025-09-12T18:24:34Z") }, { id: 442, app_process_id: 433, endpoint_id: 8, parent_pid: 49560, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6330, command_source: "local_disk", started_at: new Date("2025-09-11T20:18:52Z") }, { id: 443, app_process_id: 113, endpoint_id: 14, parent_pid: 32416, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 60327, command_source: "local_disk", started_at: new Date("2025-09-08T16:36:35Z") }, { id: 444, app_process_id: 550, endpoint_id: 7, parent_pid: 33263, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 17342, command_source: "network_path", started_at: new Date("2025-09-12T17:16:43Z") }, { id: 445, app_process_id: 253, endpoint_id: 2, parent_pid: 55668, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 11470, command_source: "local_disk", started_at: new Date("2025-09-08T17:42:40Z") }, { id: 446, app_process_id: 49, endpoint_id: 5, parent_pid: 44112, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 14939, command_source: "local_disk", started_at: new Date("2025-09-10T12:49:29Z") }, { id: 447, app_process_id: 295, endpoint_id: 16, parent_pid: 49610, process_name: "node.exe", category: "development", detection_label: "none", pid: 24948, command_source: "temp_folder", started_at: new Date("2025-09-10T16:35:25Z") }, { id: 448, app_process_id: 357, endpoint_id: 13, parent_pid: 17802, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 27297, command_source: "local_disk", started_at: new Date("2025-09-09T21:14:37Z") }, { id: 449, app_process_id: 357, endpoint_id: 13, parent_pid: 17802, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 14400, command_source: "user_profile", started_at: new Date("2025-09-09T21:15:42Z") }, { id: 450, app_process_id: 419, endpoint_id: 14, parent_pid: 6165, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 59971, command_source: "local_disk", started_at: new Date("2025-09-11T13:49:53Z") }, { id: 451, app_process_id: 534, endpoint_id: 25, parent_pid: 63803, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 2999, command_source: "user_profile", started_at: new Date("2025-09-11T10:31:30Z") }, { id: 452, app_process_id: 408, endpoint_id: 29, parent_pid: 29568, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 25118, command_source: "user_profile", started_at: new Date("2025-09-11T12:42:00Z") }, { id: 453, app_process_id: 137, endpoint_id: 25, parent_pid: 14030, process_name: "node.exe", category: "development", detection_label: "none", pid: 62691, command_source: "local_disk", started_at: new Date("2025-09-10T23:53:06Z") }, { id: 454, app_process_id: 283, endpoint_id: 19, parent_pid: 31200, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 12381, command_source: "temp_folder", started_at: new Date("2025-09-09T12:48:28Z") }, { id: 455, app_process_id: 481, endpoint_id: 26, parent_pid: 56274, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 39143, command_source: "local_disk", started_at: new Date("2025-09-08T16:59:30Z") }, { id: 456, app_process_id: 3, endpoint_id: 8, parent_pid: 43396, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 36925, command_source: "local_disk", started_at: new Date("2025-09-12T11:25:09Z") }, { id: 457, app_process_id: 414, endpoint_id: 12, parent_pid: 61129, process_name: "rundll32.exe", category: "office_library_load", detection_label: "suspicious_library_load", pid: 7849, command_source: "local_disk", started_at: new Date("2025-09-09T18:45:26Z") }, { id: 458, app_process_id: 14, endpoint_id: 2, parent_pid: 45424, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 19962, command_source: "local_disk", started_at: new Date("2025-09-08T12:03:46Z") }, { id: 459, app_process_id: 212, endpoint_id: 4, parent_pid: 61892, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 24152, command_source: "local_disk", started_at: new Date("2025-09-11T18:43:33Z") }, { id: 460, app_process_id: 107, endpoint_id: 1, parent_pid: 22672, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 54275, command_source: "local_disk", started_at: new Date("2025-09-09T13:30:48Z") }, { id: 461, app_process_id: 470, endpoint_id: 12, parent_pid: 11266, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 19698, command_source: "temp_folder", started_at: new Date("2025-09-12T23:15:32Z") }, { id: 462, app_process_id: 567, endpoint_id: 30, parent_pid: 25903, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 7572, command_source: "local_disk", started_at: new Date("2025-09-10T19:54:19Z") }, { id: 463, app_process_id: 287, endpoint_id: 17, parent_pid: 31309, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 2604, command_source: "local_disk", started_at: new Date("2025-09-09T19:01:58Z") }, { id: 464, app_process_id: 290, endpoint_id: 20, parent_pid: 58314, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 7884, command_source: "local_disk", started_at: new Date("2025-09-12T11:11:18Z") }, { id: 465, app_process_id: 409, endpoint_id: 3, parent_pid: 60471, process_name: "node.exe", category: "development", detection_label: "none", pid: 11073, command_source: "local_disk", started_at: new Date("2025-09-11T21:32:31Z") }, { id: 466, app_process_id: 260, endpoint_id: 2, parent_pid: 12286, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 14040, command_source: "local_disk", started_at: new Date("2025-09-08T13:51:37Z") }, { id: 467, app_process_id: 227, endpoint_id: 24, parent_pid: 48805, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 60186, command_source: "user_profile", started_at: new Date("2025-09-08T12:16:33Z") }, { id: 468, app_process_id: 331, endpoint_id: 4, parent_pid: 58772, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 27212, command_source: "local_disk", started_at: new Date("2025-09-11T20:44:49Z") }, { id: 469, app_process_id: 304, endpoint_id: 23, parent_pid: 33428, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 62295, command_source: "network_path", started_at: new Date("2025-09-08T13:03:53Z") }, { id: 470, app_process_id: 196, endpoint_id: 7, parent_pid: 40860, process_name: "olk.exe", category: "email", detection_label: "none", pid: 48336, command_source: "local_disk", started_at: new Date("2025-09-12T15:37:27Z") }, { id: 471, app_process_id: 37, endpoint_id: 10, parent_pid: 64176, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 1177, command_source: "user_profile", started_at: new Date("2025-09-09T12:35:05Z") }, { id: 472, app_process_id: 470, endpoint_id: 12, parent_pid: 11266, process_name: "certutil.exe", category: "file_download_utility", detection_label: "download_utility", pid: 4171, command_source: "local_disk", started_at: new Date("2025-09-12T23:15:42Z") }, { id: 473, app_process_id: 328, endpoint_id: 8, parent_pid: 60534, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 57301, command_source: "temp_folder", started_at: new Date("2025-09-11T19:02:38Z") }, { id: 474, app_process_id: 379, endpoint_id: 10, parent_pid: 6542, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 52577, command_source: "temp_folder", started_at: new Date("2025-09-10T14:08:36Z") }, { id: 475, app_process_id: 239, endpoint_id: 23, parent_pid: 3544, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 5674, command_source: "local_disk", started_at: new Date("2025-09-08T12:32:27Z") }, { id: 476, app_process_id: 508, endpoint_id: 17, parent_pid: 56082, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 30113, command_source: "local_disk", started_at: new Date("2025-09-11T11:39:33Z") }, { id: 477, app_process_id: 176, endpoint_id: 12, parent_pid: 33369, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 59287, command_source: "local_disk", started_at: new Date("2025-09-12T21:27:38Z") }, { id: 478, app_process_id: 232, endpoint_id: 2, parent_pid: 32167, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 10769, command_source: "local_disk", started_at: new Date("2025-09-08T12:36:56Z") }, { id: 479, app_process_id: 233, endpoint_id: 1, parent_pid: 46600, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 45316, command_source: "local_disk", started_at: new Date("2025-09-13T00:17:43Z") }, { id: 480, app_process_id: 401, endpoint_id: 4, parent_pid: 22532, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 53545, command_source: "local_disk", started_at: new Date("2025-09-10T19:43:33Z") }, { id: 481, app_process_id: 474, endpoint_id: 14, parent_pid: 46432, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 7765, command_source: "local_disk", started_at: new Date("2025-09-11T14:19:19Z") }, { id: 482, app_process_id: 475, endpoint_id: 19, parent_pid: 6333, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 26737, command_source: "local_disk", started_at: new Date("2025-09-10T14:55:16Z") }, { id: 483, app_process_id: 268, endpoint_id: 9, parent_pid: 1833, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 2361, command_source: "network_path", started_at: new Date("2025-09-10T20:33:11Z") }, { id: 484, app_process_id: 332, endpoint_id: 8, parent_pid: 14407, process_name: "olk.exe", category: "email", detection_label: "none", pid: 63497, command_source: "temp_folder", started_at: new Date("2025-09-12T12:35:35Z") }, { id: 485, app_process_id: 266, endpoint_id: 29, parent_pid: 56419, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 19328, command_source: "local_disk", started_at: new Date("2025-09-11T14:57:32Z") }, { id: 486, app_process_id: 402, endpoint_id: 20, parent_pid: 3576, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 14135, command_source: "local_disk", started_at: new Date("2025-09-10T13:59:13Z") }, { id: 487, app_process_id: 359, endpoint_id: 17, parent_pid: 34261, process_name: "node.exe", category: "development", detection_label: "none", pid: 53930, command_source: "temp_folder", started_at: new Date("2025-09-08T20:52:49Z") }, { id: 488, app_process_id: 136, endpoint_id: 30, parent_pid: 45127, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 57792, command_source: "local_disk", started_at: new Date("2025-09-11T19:05:41Z") }, { id: 489, app_process_id: 189, endpoint_id: 5, parent_pid: 26077, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 1537, command_source: "user_profile", started_at: new Date("2025-09-10T20:11:10Z") }, { id: 490, app_process_id: 265, endpoint_id: 14, parent_pid: 932, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 15438, command_source: "temp_folder", started_at: new Date("2025-09-11T11:39:30Z") }, { id: 491, app_process_id: 176, endpoint_id: 12, parent_pid: 33369, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 30177, command_source: "temp_folder", started_at: new Date("2025-09-12T21:28:28Z") }, { id: 492, app_process_id: 543, endpoint_id: 5, parent_pid: 14472, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 29057, command_source: "local_disk", started_at: new Date("2025-09-10T16:59:29Z") }, { id: 493, app_process_id: 54, endpoint_id: 5, parent_pid: 14883, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 19121, command_source: "local_disk", started_at: new Date("2025-09-11T12:03:46Z") }, { id: 494, app_process_id: 534, endpoint_id: 25, parent_pid: 63803, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 13427, command_source: "local_disk", started_at: new Date("2025-09-11T10:31:44Z") }, { id: 495, app_process_id: 178, endpoint_id: 4, parent_pid: 53009, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 26313, command_source: "local_disk", started_at: new Date("2025-09-10T16:09:28Z") }, { id: 496, app_process_id: 570, endpoint_id: 3, parent_pid: 37692, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 5968, command_source: "temp_folder", started_at: new Date("2025-09-11T22:49:40Z") }, { id: 497, app_process_id: 94, endpoint_id: 30, parent_pid: 23005, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 46203, command_source: "user_profile", started_at: new Date("2025-09-12T00:56:13Z") }, { id: 498, app_process_id: 383, endpoint_id: 11, parent_pid: 42906, process_name: "node.exe", category: "development", detection_label: "none", pid: 60752, command_source: "local_disk", started_at: new Date("2025-09-12T21:38:22Z") }, { id: 499, app_process_id: 357, endpoint_id: 13, parent_pid: 17802, process_name: "powershell.exe", category: "office_script_host", detection_label: "suspicious_office_child", pid: 58932, command_source: "local_disk", started_at: new Date("2025-09-09T21:17:21Z") }, { id: 500, app_process_id: 15, endpoint_id: 12, parent_pid: 32021, process_name: "olk.exe", category: "email", detection_label: "none", pid: 44121, command_source: "local_disk", started_at: new Date("2025-09-08T17:38:22Z") }, ], }); await prisma.child_processes.createMany({ data: [ { id: 501, app_process_id: 281, endpoint_id: 5, parent_pid: 44118, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 22254, command_source: "local_disk", started_at: new Date("2025-09-11T15:20:19Z") }, { id: 502, app_process_id: 529, endpoint_id: 15, parent_pid: 52105, process_name: "node.exe", category: "development", detection_label: "none", pid: 48233, command_source: "user_profile", started_at: new Date("2025-09-12T21:12:42Z") }, { id: 503, app_process_id: 210, endpoint_id: 2, parent_pid: 28766, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 4285, command_source: "local_disk", started_at: new Date("2025-09-11T18:30:48Z") }, { id: 504, app_process_id: 98, endpoint_id: 1, parent_pid: 41939, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 55758, command_source: "local_disk", started_at: new Date("2025-09-09T13:21:33Z") }, { id: 505, app_process_id: 136, endpoint_id: 30, parent_pid: 45127, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 4410, command_source: "local_disk", started_at: new Date("2025-09-11T19:07:11Z") }, { id: 506, app_process_id: 564, endpoint_id: 24, parent_pid: 20441, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 20515, command_source: "local_disk", started_at: new Date("2025-09-09T15:39:42Z") }, { id: 507, app_process_id: 41, endpoint_id: 17, parent_pid: 37138, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 6478, command_source: "network_path", started_at: new Date("2025-09-09T17:55:47Z") }, { id: 508, app_process_id: 43, endpoint_id: 3, parent_pid: 57823, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 38648, command_source: "local_disk", started_at: new Date("2025-09-11T16:40:15Z") }, { id: 509, app_process_id: 120, endpoint_id: 15, parent_pid: 29798, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 41150, command_source: "user_profile", started_at: new Date("2025-09-08T15:16:29Z") }, { id: 510, app_process_id: 247, endpoint_id: 9, parent_pid: 49419, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 5944, command_source: "local_disk", started_at: new Date("2025-09-10T10:42:41Z") }, { id: 511, app_process_id: 104, endpoint_id: 3, parent_pid: 53814, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 57857, command_source: "user_profile", started_at: new Date("2025-09-11T17:41:41Z") }, { id: 512, app_process_id: 64, endpoint_id: 26, parent_pid: 27918, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 5172, command_source: "local_disk", started_at: new Date("2025-09-09T13:42:07Z") }, { id: 513, app_process_id: 10, endpoint_id: 12, parent_pid: 39319, process_name: "node.exe", category: "development", detection_label: "none", pid: 54310, command_source: "user_profile", started_at: new Date("2025-09-08T15:09:14Z") }, { id: 514, app_process_id: 235, endpoint_id: 5, parent_pid: 34266, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 17491, command_source: "user_profile", started_at: new Date("2025-09-10T14:05:25Z") }, { id: 515, app_process_id: 368, endpoint_id: 14, parent_pid: 18083, process_name: "mshta.exe", category: "email_script_host", detection_label: "suspicious_email_child", pid: 16824, command_source: "local_disk", started_at: new Date("2025-09-10T16:15:44Z") }, { id: 516, app_process_id: 345, endpoint_id: 29, parent_pid: 30315, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 62947, command_source: "local_disk", started_at: new Date("2025-09-11T12:22:29Z") }, { id: 517, app_process_id: 20, endpoint_id: 29, parent_pid: 31578, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 41123, command_source: "local_disk", started_at: new Date("2025-09-11T09:00:57Z") }, { id: 518, app_process_id: 288, endpoint_id: 30, parent_pid: 43147, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 12040, command_source: "local_disk", started_at: new Date("2025-09-12T01:07:43Z") }, { id: 519, app_process_id: 137, endpoint_id: 25, parent_pid: 14030, process_name: "node.exe", category: "development", detection_label: "none", pid: 48662, command_source: "local_disk", started_at: new Date("2025-09-10T23:53:43Z") }, { id: 520, app_process_id: 417, endpoint_id: 29, parent_pid: 7857, process_name: "teams.exe", category: "collaboration", detection_label: "none", pid: 61765, command_source: "local_disk", started_at: new Date("2025-09-08T17:38:53Z") }, { id: 521, app_process_id: 7, endpoint_id: 16, parent_pid: 41495, process_name: "node.exe", category: "development", detection_label: "none", pid: 50159, command_source: "local_disk", started_at: new Date("2025-09-12T15:31:22Z") }, { id: 522, app_process_id: 293, endpoint_id: 1, parent_pid: 46403, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 59866, command_source: "temp_folder", started_at: new Date("2025-09-13T01:04:49Z") }, { id: 523, app_process_id: 68, endpoint_id: 30, parent_pid: 28650, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 53691, command_source: "user_profile", started_at: new Date("2025-09-10T17:47:00Z") }, { id: 524, app_process_id: 430, endpoint_id: 29, parent_pid: 14673, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 43398, command_source: "local_disk", started_at: new Date("2025-09-11T12:51:11Z") }, { id: 525, app_process_id: 312, endpoint_id: 11, parent_pid: 58917, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 47650, command_source: "network_path", started_at: new Date("2025-09-12T12:15:22Z") }, { id: 526, app_process_id: 235, endpoint_id: 5, parent_pid: 34266, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 36964, command_source: "user_profile", started_at: new Date("2025-09-10T14:05:33Z") }, { id: 527, app_process_id: 274, endpoint_id: 18, parent_pid: 8488, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 18729, command_source: "temp_folder", started_at: new Date("2025-09-10T19:30:32Z") }, { id: 528, app_process_id: 33, endpoint_id: 26, parent_pid: 6437, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 56161, command_source: "temp_folder", started_at: new Date("2025-09-08T15:42:09Z") }, { id: 529, app_process_id: 148, endpoint_id: 7, parent_pid: 54781, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 17609, command_source: "user_profile", started_at: new Date("2025-09-08T15:44:12Z") }, { id: 530, app_process_id: 544, endpoint_id: 14, parent_pid: 56307, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 40131, command_source: "user_profile", started_at: new Date("2025-09-08T21:19:02Z") }, { id: 531, app_process_id: 362, endpoint_id: 12, parent_pid: 53635, process_name: "conhost.exe", category: "shell", detection_label: "none", pid: 19543, command_source: "temp_folder", started_at: new Date("2025-09-08T19:28:40Z") }, { id: 532, app_process_id: 240, endpoint_id: 12, parent_pid: 32551, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 25659, command_source: "user_profile", started_at: new Date("2025-09-09T14:34:08Z") }, { id: 533, app_process_id: 477, endpoint_id: 5, parent_pid: 7825, process_name: "olk.exe", category: "email", detection_label: "none", pid: 59066, command_source: "temp_folder", started_at: new Date("2025-09-09T17:38:57Z") }, { id: 534, app_process_id: 560, endpoint_id: 12, parent_pid: 18770, process_name: "node.exe", category: "development", detection_label: "none", pid: 32766, command_source: "user_profile", started_at: new Date("2025-09-13T02:00:13Z") }, { id: 535, app_process_id: 408, endpoint_id: 29, parent_pid: 29568, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 26148, command_source: "local_disk", started_at: new Date("2025-09-11T12:42:46Z") }, { id: 536, app_process_id: 569, endpoint_id: 8, parent_pid: 10941, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 2445, command_source: "local_disk", started_at: new Date("2025-09-11T19:05:51Z") }, { id: 537, app_process_id: 403, endpoint_id: 10, parent_pid: 37069, process_name: "olk.exe", category: "email", detection_label: "none", pid: 57618, command_source: "temp_folder", started_at: new Date("2025-09-08T12:16:38Z") }, { id: 538, app_process_id: 229, endpoint_id: 15, parent_pid: 27407, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 34097, command_source: "local_disk", started_at: new Date("2025-09-08T18:09:45Z") }, { id: 539, app_process_id: 562, endpoint_id: 24, parent_pid: 58496, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 18995, command_source: "local_disk", started_at: new Date("2025-09-08T17:32:43Z") }, { id: 540, app_process_id: 421, endpoint_id: 30, parent_pid: 27717, process_name: "whoami.exe", category: "account_discovery", detection_label: "discovery_command", pid: 30739, command_source: "local_disk", started_at: new Date("2025-09-12T03:11:52Z") }, { id: 541, app_process_id: 523, endpoint_id: 9, parent_pid: 41324, process_name: "notepad.exe", category: "file_management", detection_label: "none", pid: 56709, command_source: "local_disk", started_at: new Date("2025-09-10T23:17:30Z") }, { id: 542, app_process_id: 401, endpoint_id: 4, parent_pid: 22532, process_name: "splwow64.exe", category: "office", detection_label: "none", pid: 28812, command_source: "local_disk", started_at: new Date("2025-09-10T19:44:48Z") }, { id: 543, app_process_id: 53, endpoint_id: 26, parent_pid: 62824, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 7487, command_source: "local_disk", started_at: new Date("2025-09-09T13:19:53Z") }, { id: 544, app_process_id: 441, endpoint_id: 17, parent_pid: 56072, process_name: "msedgewebview2.exe", category: "browsing", detection_label: "none", pid: 40497, command_source: "temp_folder", started_at: new Date("2025-09-08T23:54:11Z") }, { id: 545, app_process_id: 571, endpoint_id: 11, parent_pid: 7435, process_name: "chrome.exe", category: "browsing", detection_label: "none", pid: 36946, command_source: "local_disk", started_at: new Date("2025-09-13T01:12:13Z") }, { id: 546, app_process_id: 352, endpoint_id: 18, parent_pid: 39809, process_name: "excelcnv.exe", category: "office", detection_label: "none", pid: 45022, command_source: "local_disk", started_at: new Date("2025-09-10T19:59:12Z") }, ], }); } main() .then(() => prisma.$disconnect()) .catch(async error => { console.error(error); await prisma.$disconnect(); process.exit(1); });