01 · PREDICT

Choose the evidence before the tool

Before tracing, what event and identity fields would distinguish a new process execution from a process that was merely already running?

This starts one fixed fixture. You cannot submit commands or code.