Sysmon /operational is not in Event table

I mapped the fields to the corresponding Defender table. Hopefully this helps. Please mark "Solved" if this works. 

G.

DeviceProcessEvents | where EventID == 1 | extend Image = tostring(parse_json(AdditionalFields).Image) | where OriginalFileName has_any (procList) and not (Image has_any (procList)) | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, DeviceName, InitiatingProcessAccountName, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, FileName, ProcessId, ProcessCommandLine, FileDescription, FileName, FolderPath, SHA1 | extend HostName = iif(DeviceName has '.',substring(DeviceName,0,indexof(DeviceName,'.')),DeviceName), DnsDomain = iif(DeviceName has '.',substring(DeviceName,indexof(DeviceName,'.')+1),'')