Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
tostring(parse_json(tostring(parse_json(SyslogMessage).SYSCALL)).UID) | extend EXE = tostring(parse_json(tostring(parse_json(SyslogMessage).SYSCALL)).exe) | extend Key_ = tostring(parse_json(tostring(parse_json(SyslogMessage).SYSCALL)).key) | extend full_cli_EXE =