Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
replace_strings(tostring(pack_array(parse_json(tostring(parse_json(tostring(parse_json(SyslogMessage).PROCTITLE)).ARGV)))), dynamic(['[', ']', '"', ","]), dynamic(['', '', '', ' '])) | extend full_cli = iff(isnotnull(full_cli_PROCTITLE),full_cli_PROCTITLE,full_cli_EXE) | project-away