https://knowledge.broadcom.com/external/article/290642/cb-response-why-are-childproc-counts-dif.html
CB Response: Why are childproc counts different across API calls
cbresponsecountsdifferentacross
https://knowledge.broadcom.com/external/article/292250/edr-event-forwarder-does-not-present-a-c.html
EDR: Event Forwarder does not present a correctly formatted parent_guid for a childproc raw event