{
  "event_type": "process_creation",
  "platform": "CrowdStrike",
  "hostname": "demo-workstation-22",
  "username": "demo-user",
  "process_name": "powershell.exe",
  "command_line": "powershell.exe -EncodedCommand <redacted-demo-value>",
  "note": "Synthetic example only. Contains no production telemetry."
}