Track The Working Directories Of Processes
Query
// Use Case: Analyzing and auditing system processes for security or operational efficiency by listing their names, IDs, working directories, start times, and command lines in chronological order.
Process
| project ProcessName, ProcessId, CurrentWorkingDirectory, StartDateTime, CommandLine
| where isnotnull(CurrentWorkingDirectory) and CurrentWorkingDirectory != '' // Filter out null or empty working directories
| order by ProcessName, StartDateTimeExplanation
This query is designed to analyze and audit system processes for security or operational efficiency. It retrieves a list of processes, including their names, IDs, working directories, start times, and command lines. The query filters out any processes that have a null or empty working directory. Finally, it sorts the results first by the process name and then by the start time, presenting the information in chronological order.
Details
Ugur Koc
Released: December 13, 2024
Tables
Process
Keywords
Process
Operators
projectwhereisnotnullorder by