DEMO Read-only showcase seeded with synthetic data. Sign-in, reviewing, rules, retention and alerts are disabled. Browse every page and session freely. Install on your fleet →

Find processes by spawn chain

Search every session's process tree for an image, optionally filtered to cases where a specific ancestor sits above it in the chain. Case-insensitive substring match.

What process are you hunting?

Type the image name you're looking for (e.g. curl, powershell, bash). Optionally narrow to spawn chains where a specific ancestor image appears above the match — useful when looking for "agent X ran tool Y indirectly".

Examples: curl under claude · powershell under codex · bash under cursor