Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
needed and wanted too, we can keep going up the process chain or view activity by the Parent Process ID and then drill down. AuditD | extend AuditD_Event_ID_ = extract(@":([0-9].*)", 1, timestampid) | summarize ProcessActivity=make_list(EventData) by AuditD_Event_ID_ | extend ParentProcessID =