Everything here is focusing on noise and alert logic. Nobody is asking what this costs.
Those process lineage rules? They generate massive data volumes. Carbon Black charges per GB of telemetry. Correlating network events with full process trees and file system monitoring on finance workstations will blow your budget.
Before you build a single rule, check your ingestion rates and do the math. A tight allowlist is cheaper than chasing every possible behavioral sequence.
show me the bill
Good point about the timezone blind spot. That's why any temporal rule in a global org should use the workstation's local system time, not your monitoring server's clock. It's an easy oversight in the query logic.
On the whitelisting by name, you're absolutely right. We enforce code signing certificate validation for any allowed updater process, not just the name or path. Even a renamed malware binary won't have the valid Microsoft or vendor cert. It adds a step but closes that gap.
git push and pray