Improvements / Clarifications to process.* fields

I received this feedback from some potential users:

> I've checked model for process and couldn't find "commandline", "image" and "parent commandline" fields. These are basics...
>
> Actually, you have both image and commandline fields for process execution:
> - process.executable — that's how you named image (from sysmon)
> - process.args — that's how you named command line arguments
>
> It would be better to have such explanation in description of fields, because it's not self-explanatory, let’s say, it’s not obvious from the first sight.