Pstree nodaliser

The PSTree Nodaliser for Splunk reconstructs process trees from Sysmon-style parent/child events and outputs one row per parent/child edge with full lineage metadata. Unlike traditional process tree tools that render ASCII art or indented text, this app nodalises the result by emitting individual rows for each parent/child relationship, annotated with depth and ancestor lineage. This output format is designed to feed directly into node/link visualizations such as force-directed graphs, dendrograms, and Sankey diagrams without requiring additional reshaping in SPL. The app processes Sysmon or similar process creation events that contain parent/child process information, enabling analysts to reconstruct process lineage comparable to memory forensics tools. The primary use case is converting linear process event logs into a graph-ready format for visual analysis of execution chains and lateral movement.