Add guidance on the representation of process parentage

[mlmitch]

This document adds prescriptive guidance on how to effectively represent endpoint process parentage in OCSF

[mikeradka]

@mlmitch , I recall a while back that @zschmerber was utilizing a Figma diagram to demonstrate parentage. Of course, this was prior to the process_entity / ancestry being added to OCSF in 1.4.0. Could the addition of a simple diagram be useful for this doc?

[zschmerber]

Here is what i had for process but i agree a picture speaks a thousand words in this case.

https://www.figma.com/board/nJKySDnnN7v2CwNpM9HoFV/Actor.process?t=ovxFyOOVmcQNo5TX-0

[mlmitch]

Great. I can incorporate something like that and some sample data I think.

[mlmitch]

Ready for review. I didn't end up including a diagram as there is already some good stuff in the blog I link and Zach's diagram was more about general process relationships than parentage specifically.

I added a sample 1.4.0 event demonstrating all the concepts though.

[floydtree]

Thank you for this excellent article.

@mlmitch One thing you can do is, add this as a "Reference" in the dictionary definition of the process object. So that people are directly linked to this article as they browse the schema. It will be similar to how I had done it for observables, in case you need a sample.

[mlmitch]

Good suggestion Rajas. Mike recommended something similar. Will do.

[mlmitch]

ocsf/ocsf-schema#1349