Glossary: Logs and Data Sources for Investigations

Process tree

An EDR view that shows each program under the program that started it. It showed sshd starting a shell for Sam that ran four commands, including cp and two curl commands.