You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-cloudprocessevents-table.md
+50-29Lines changed: 50 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: CloudProcessEvents table in the advanced hunting schema
3
-
description: Learn about
3
+
description: Learn about the CloudProcessEvents table in the advanced hunting schema, which contains information about process events in multicloud hosted environments.
The `CloudProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about events involving accounts and objects in Office 365 and other [cloud apps and services](#apps-and-services-covered). Use this reference to construct queries that return information from this table.
31
+
The `CloudProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about process events in multicloud hosted environments such as Azure Kubernetes Service, Amazon Elastic Kubernetes Service, and Google Kubernetes Engine. Use this reference to construct queries that return information from this table.
32
32
33
+
> [!IMPORTANT]
34
+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
33
35
34
36
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
35
37
36
38
| Column name | Data type | Description |
37
39
|-------------|-----------|-------------|
38
40
|`Timestamp`|`datetime`| Date and time when the event was recorded |
39
-
|`ActionType`|`string`| Type of activity that triggered the event |
40
-
|`Application`|`string`| Application that performed the recorded action |
41
-
|`ApplicationId`|`int`| Unique identifier for the application |
42
-
43
-
44
-
45
-
46
-
## Apps and services covered
47
-
48
-
The __CloudAppEvents__ table contains enriched logs from all SaaS applications connected to Microsoft Defender for Cloud Apps, such as:
49
-
- Office 365 and Microsoft Applications, including:
50
-
- Exchange Online
51
-
- SharePoint Online
52
-
- Microsoft Teams
53
-
- Dynamics 365
54
-
- Skype for Business
55
-
- Viva Engage
56
-
- Power Automate
57
-
- Power BI
58
-
- Dropbox
59
-
- Salesforce
60
-
- GitHub
61
-
- Atlassian
62
-
63
-
Connect supported cloud apps for instant, out-of-the-box protection, deep visibility into the app's user and device activities, and more. For more information, see [Protect connected apps using cloud service provider APIs](/defender-cloud-apps/protect-connected-apps).
41
+
|`AzureResourceId`|`string`| Unique identifier of the Azure resource associated with the process |
42
+
|`AwsResourceName`|`string`| Unique identifier specific to Amazon Web Services devices, containing the Amazon resource name|
43
+
|`GcpFullResourceName`|`string`| Unique identifier specific to Google Cloud Platform devices, containing a combination of zone and ID for GCP |
44
+
|`ContainerImageName`|`string`| UThe container image name or ID, if it exists |
45
+
|`KubernetesNamespace`|`string`| The Kubernetes namespace name |
46
+
|`KubernetesPodName`|`string`| The Kubernetes pod name |
47
+
|`KubernetesResource`|`string`| Identifier value that includes namespace, resource type and name |
48
+
|`ContainerName`|`string`| Name of the container in Kubernetes or another runtime environment |
49
+
|`ContainerId`|`string`| The container identifier in Kubernetes or another runtime environment|
50
+
|`ActionType`|`string`| Type of activity that triggered the event. See the in-portal schema reference for details.|
51
+
|`FileName`|`string`| Name of the file that the recorded action was applied to |
52
+
|`FolderPath`|`string`| Folder containing the file that the recorded action was applied to|
53
+
|`ProcessId`|`long`| Process ID (PID) of the newly created process |
54
+
|`ProcessName`|`string`| The name of the process |
55
+
|`ParentProcessName`|`string`| The name of the parent process |
56
+
|`ParentProcessId`|`string`| The process ID (PID) of the parent process|
57
+
|`ProcessCommandLine`|`string`| Command line used to create the new process|
58
+
|`ProcessCreationTime`|`datetime`| Date and time the process was created |
59
+
|`ProcessCurrentWorkingDirectory`|`string`| Current working directory of the running process |
60
+
|`AccountName`|`string`| User name of the account |
61
+
|`LogonId`|`long`| Identifier for a logon session. This identifier is unique on the same pod or container between restarts. |
62
+
|`InitiatingProcessId`|`string`| Process ID (PID) of the process that initiated the event |
63
+
|`AdditionalFields`|`string`| Additional information about the event in JSON array format |
64
+
65
+
66
+
## Sample queries
67
+
68
+
You can use this table to get detailed information on processes invoked in a cloud environment. The information is useful in hunting scenarios and can discover threats that can be observed through process details, like malicious processes or command-line signatures.
69
+
70
+
You can also investigate security alerts provided by Defender for Cloud that make use of the cloud process events data in advanced hunting to understand details in the process tree for processes that include a security alert.
71
+
72
+
### Process events by command-line arguments
73
+
To hunt for process events including a given term (represented by "x" in the query below) in the command-line arguments:
74
+
75
+
```kusto
76
+
CloudProcessEvents | where ProcessCommandLine has "x"
77
+
```
78
+
79
+
### Rare process events for a pod in a Kuberentes cluster
80
+
To investigate unusual process events invoked as part of a pod in a Kubernetes cluster:
81
+
82
+
```kusto
83
+
CloudProcessEvents | where AzureResourceId = "x" and KubernetesNamespace = "y" and KubernetesPodName = "z" | summarize count() by ProcessName | top 10 by count_ asc
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-schema-tables.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -62,6 +62,7 @@ The following reference lists all the tables in the schema. Each table name link
62
62
|**[BehaviorInfo](advanced-hunting-behaviorinfo-table.md)** (Preview) | Alerts from Microsoft Defender for Cloud Apps (not available for GCC) |
63
63
|**[CloudAppEvents](advanced-hunting-cloudappevents-table.md)**| Events involving accounts and objects in Office 365 and other cloud apps and services |
64
64
|**[CloudAuditEvents](advanced-hunting-cloudauditevents-table.md)**| Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
65
+
|**[CloudProcessEvents](advanced-hunting-cloudprocessevents-table.md)** (Preview)| Cloud process events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
65
66
|**[DeviceEvents](advanced-hunting-deviceevents-table.md)**| Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection |
66
67
|**[DeviceFileCertificateInfo](advanced-hunting-DeviceFileCertificateInfo-table.md)**| Certificate information of signed files obtained from certificate verification events on endpoints |
67
68
|**[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)**| File creation, modification, and other file system events |
Copy file name to clipboardExpand all lines: defender-xdr/whats-new.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,6 +29,8 @@ For more information on what's new with other Microsoft Defender security produc
29
29
30
30
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
31
31
32
+
## November 2024
33
+
- (Preview) The [CloudProcessEvents](advanced-hunting-cloudprocessevents-table.md) table is now available for preivew in advanced hunting. It contains information about process events in multicloud hosted environments. You can use it to discover threats that can be observed through process details, like malicious processes or command-line signatures.
0 commit comments