Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
https://medium.com/@truvis.thornton/part-2-threat-detection-engineering-and-incident-response-with-auditd-and-sentinel-combine-a3384e1164e6 Syslog | where ProcessName == "AuditD" | extend CDW = tostring(parse_json(tostring(parse_json(SyslogMessage).CWD)).cwd) | extend USER =