Process Event

Event Buff Attribute	Helix Field Destination	Notes
`args`	`args`	The arguments provided to the process
`eventType`	`event_values.eventType`	Start or End of the process
`eventTypeRaw`	event_values.eventTypeRaw	1=Start, 2=End
`md5`	`md5`	The MD5 hash of the PE for the process
`parentPath`	`event_values.parentPath`
`parentPid`	`ppid`	The ID of the parent of the process
`parentProcess`	`parentfileid`	The name of the parent process
`parentProcessPath`	`pprocesspath`	The path for the PE of the parent process
`pid`	`pid`	The process ID
`ppath`	`event_values.ppath`	The path for the PE of the process
`process`	`process`	The name of the process
`processCmdLine`	`cmdarg`	The command line arguments for the process
`processPath`	`processpath`	The path for the PE of the process
`startTime`	`starttime`	The time at which the process started, formatted to ISO-8601
`startTimeRaw`	-	Not currently mapped
`username`	`username`	The owner of the process