Reconstruct the ancestry of six alerted processes from merged Sysmon process-creation events by ProcessGuid…

Reconstruct the ancestry of six alerted processes from merged Sysmon process-creation events by ProcessGuid…: a task in pool-desk (Harbor dataset). Our EDR raised alerts on six processes on workstation WORKSTATION5. For the incident write-up I need each alerted process's ancestry, reconstructed…