Please check this addon: https://docs.splunk.com/Documentation/AddOns/released/MSSysmon/About Documentation says is CIM compatible: "The Splunk Add-on for Sysmon allows a Splunk software administrator to create a Splunk software data input and CIM-compliant field extractions for Microsoft Sysmon." If the addon feeds the Endpoint.Processes datamodel, then the use case you are interested in might work.
... View more