Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
AuditD_Event_ID_ == "#####" | extend ParentProcessID = extract(" ppid=([0-9]{1,20}) ", 1, tostring(ProcessActivity)) | extend THISProcessID = extract(" pid=([0-9]{1,20}) ", 1, tostring(ProcessActivity)) This will give us a complete view of all the activity associated with that AuditD ID Now lets do