Kill Process with Descendants

## Kill Process with Descendants

**Value proposition**
In real-world attacks, malicious processes routinely spawn child and grandchild processes that continue executing after the parent is killed, leaving orphaned threats active on the endpoint. This epic extends the `kill-process` response action with the option to also kill the descendants, enabling analysts and detection rules to terminate entire process trees in a single operation, closing this gap in containment coverage.

**Expected outcome**

- Analysts can kill a process and all its recursive descendants from the Response Console in a single action
- Detection engineers can configure automated response actions in detection rules to kill full process trees without manual intervention
- Partial failures are surfaced clearly — showing which processes were killed, which failed, and why — so analysts can assess residual risk
- All termination attempts are logged in Response Actions History for auditability and compliance purposes

**Key user stories / use cases**

**As a** Security Analyst,
**I want to** kill a malicious process and all of its descendant processes from the Response Console,
**so that** no orphaned malicious processes continue running on the endpoint after containment.

**As a** Detection Engineer,
**I want to** configure an automated response action that kills a process tree,
**so that** multi-stage malware is reliably contained without requiring manual intervention.

**As a** SOC Lead / Auditor,
**I want to** see detailed logs of all descendant process termination attempts,
**so that** response actions are transparent, explainable, and auditable for compliance purposes.