Forum Discussion

pager2055's avatar
pager2055
Copper Contributor
Nov 08, 2020

Azure Monitor Process Information

Hey All, Been working with Azure monitor and I'm trying to add some improvements to some existing queries that I have. One bit of information I am looking for is capturing what account is running ...
azure monitor
Noa Kuperberg's avatar
Noa Kuperberg
Icon for Microsoft rankMicrosoft
Nov 17, 2020

pager2055 ,

AFAIK Perf doesn't hold that data, but the SecurityEvent table (built by the security solution) will create it and collect user data as well:

 

  • pager2055's avatar
    pager2055
    Copper Contributor
    Nov 17, 2020

    Noa Kuperberg 

    Thanks for that 😄

    So the security event table, would I be able to match up the process ID's to something in the security table in order to match the processes to users? 

    • MawandaH's avatar
      MawandaH
      Brass Contributor
      Nov 19, 2020

      pager2055In theory, yes, by the use of "union" / "join" to combine data from two separate tables.
      https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/joinoperator?pivots=azuredataexplorer

Resources