Description
Process execution events can be traced system-wide to understand which programs are being started and by whom.
This is a powerful diagnostic and auditing tool. It can reveal command lines, paths, and user activity, so use it only with permission and handle logs as sensitive data.