Query Details

Track The Working Directories Of Processes

Query

// Use Case: Analyzing and auditing system processes for security or operational efficiency by listing their names, IDs, working directories, start times, and command lines in chronological order.
Process
| project ProcessName, ProcessId, CurrentWorkingDirectory, StartDateTime, CommandLine
| where isnotnull(CurrentWorkingDirectory) and CurrentWorkingDirectory != '' // Filter out null or empty working directories
| order by ProcessName, StartDateTime

Explanation

This query is designed to analyze and audit system processes for security or operational efficiency. It retrieves a list of processes, including their names, IDs, working directories, start times, and command lines. The query filters out any processes that have a null or empty working directory. Finally, it sorts the results first by the process name and then by the start time, presenting the information in chronological order.