Consider adding an equivalent field to endgame.parent_process_name in ECS

[andrew-goldstein]

In the current version of ECS (1.2 at the time of this writing), the ECS Process fields have a field to store parent process id:

process.ppid

, however I'm not seeing a field to store the parent process name, which would be equivalent to:

endgame.parent_process_name

Please consider adding an equivalent field to endgame.parent_process_name in ECS.

Originally posted by @andrew-goldstein in #589 (comment)

[webmat]

I agree with this, makes a lot of sense.