1. A computer-implemented method for identifying a source of a suspect event, comprising: registering system events in a database; detecting a suspicious event associated with a first process; identifying the first process as being one of a plurality of potential puppet processes; and querying the registered system events in the database to identify a second process, the second process detected as launching the first process.