process_tree_widget 0.1.0

Interactive process tree visualization widget for security and forensics analysis in marimo notebooks

process-tree-widget

An interactive process tree visualization widget for security and forensics analysis, built for marimo notebooks using the anywidget framework.

Please refer to this blog post for background and context.

Overview

The widget ingests OS process telemetry from two sources:

• MDE (Microsoft Defender for Endpoint) ProcessCreated events
• Volatility pstree memory forensics output

Both are normalized to a common ASIM schema, assembled into a tree structure, and rendered as an interactive D3-backed visualization with expand/collapse, zoom, right-click context menu, and an optional time-range filter.

JavaScript rendering

The widget uses a vendored copy of DependenTree (located in js/dependentree/) for the D3 tree layout, bundled directly by esbuild — no CDN fetch at runtime.

Development setup

Python:

uv venv --python 3.12
uv sync
source .venv/bin/activate

JavaScript:

npm install
npm run dev   # watches js/ (including js/dependentree/) and rebuilds on change

Demo notebook:

marimo edit notebooks/demo_mde.py
# or
marimo edit notebooks/demo_vol.py

Build commands

npm run build    # bundle js/ → src/process_tree_widget/static/ (esbuild, ESM, minified)
npm run dev      # same with inline sourcemaps + watch mode
uv build         # full Python package build (triggers npm run build via hatch-jupyter-builder)