Forum Discussion

pager2055's avatar
pager2055
Copper Contributor
Nov 08, 2020

Azure Monitor Process Information

Hey All, Been working with Azure monitor and I'm trying to add some improvements to some existing queries that I have. One bit of information I am looking for is capturing what account is running ...
azure monitor
pager2055's avatar
pager2055
Copper Contributor
Nov 17, 2020

Noa Kuperberg 

Thanks for that 😄

So the security event table, would I be able to match up the process ID's to something in the security table in order to match the processes to users? 

MawandaH's avatar
MawandaH
Brass Contributor
Nov 19, 2020

pager2055In theory, yes, by the use of "union" / "join" to combine data from two separate tables.
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator?pivots=azuredataexplorer

Resources