If the parent pro­cess is still running when the monitoring agent captures its snapshot, all further information about the parent is read­ily available.
no mat­ter the event type, this root node needs to be semantically significant.