How can I identify a grandparent process in Defender ATP detections?

Question

I\'ve got a custom detection in Defender ATP that looks like this:

DeviceEvents
| where Timestamp > ago(1h)
| where ActionType startswith \'AsrLsassCredential