Hi,
If I have process Events like
PID | ProcessName | CommandLine | SpawnedByPID
100 | process_1 | process_1_commandLine | 99
101 | process_2 | process_2_commandLine | 100
200 | process_3 | process_3_commandLine | 199
201 | process_4 | process_4_commandLine | 200
Is there any Viz that will map processes in some Folder/EDR like tree (where I can also click on node and get mora info).
For example, final results are based on PID but Viz looks like something like
| -> process_name_99
|----> process_1 (on hower or Click will get token process_1_commandLine)
|--------> process_2
| -> process_name_99
|----> process_3
|-------->process_4
Something like psTree just more advanced and connected by PID not names.
It's good app but not good enough 😞
Missing few additional fields.
For example:
Parent_Process_Label (at least). <<< always Parent_Process_PID is "folder name".