Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
ParentProcessID == "#####" Hopefully this helps you use AuditD events and start doing some deep level investigations. — ☕ Like what you read? Did it help you? Send some coffee and love https://buymeacoffee.com/truvis :) Your support helps pay for licenses, research & development, and other costs