Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
then run the query, we will get our hits. The part we are most interested in is the :##### We can use this query to dig deeper into researching: AuditD | extend AuditD_Event_ID_ = extract(@":([0-9].*)", 1, timestampid) | summarize ProcessActivity=make_list(EventData) by AuditD_Event_ID_ | where