Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
extract(" ppid=([0-9]{1,20}) ", 1, tostring(ProcessActivity)) | extend THISProcessID = extract(" pid=([0-9]{1,20}) ", 1, tostring(ProcessActivity)) | summarize makelist(pack("Process Activity", ProcessActivity, "Process ID", THISProcessID, "AuditD ID", AuditD_Event_ID_)) by ParentProcessID | where