diff --git a/process-events.md b/process-events.md
index ff62065..202f3fb 100644
--- a/process-events.md
+++ b/process-events.md
@@ -26,7 +26,11 @@ Event ID 4624, making the login of this event important.
 
 The ProcessGUID depending on the event and where in the process tree it
 is, it will also be known by other names by its relation to the action
-monitored
+monitored.
+
+ProcessGUID is generated by Sysmon when Sysmon logs the event.  ProcessGUID 
+specifically is not an attribute of the internal Windows process data structs
+(EPROCESS).  Sysmon keeps track of the GUID until the process exits.
 
 ![ProcessGUID Relation](./media/image32.png)