Auditd, Sentinel, Threat Detection, Incident Response, Blue Team.
the same but lets grab the Process ID and lets see everything that was done by the process. AuditD | extend AuditD_Event_ID_ = extract(@":([0-9].*)", 1, timestampid) | summarize ProcessActivity=make_list(EventData) by AuditD_Event_ID_ | parse ProcessActivity with * " pid=" ProcessID " " * | where