1. A computer-implemented method for identifying a source of a suspect event, comprising: registering system events in a database, wherein the system events include detected process launch events; detecting a first process being launched, the first process being one of the detected process launch events; detecting a suspicious event associated with the first process; querying the registered system events in the database; analyzing a result of the query, the result of the query indicating an association between a second process and the first process, the second process being different from the first process; based at least in part on analyzing the result of the query, determining the second process launches the first process; and based at least in part on determining the second process launches the first process, identifying the first process as being one of a plurality of potential puppet processes.