I am not sure if it is what I need, but let assume that a new process is executed and I registered an event, if the process name is X I want to query the processes table to find out the parent name