Edit process_cmd_line function template to accept list as parameter (#835)

* Cyberint risk key none value

* Update process_cmd_line template

* indentation

---------

Co-authored-by: Meroujan.Antonyan <meroujan.antonyan.external@axa.com>
Co-authored-by: Ian Hellen <ianhelle@microsoft.com>

Author: 3 people

docs/source/data_acquisition/DataQueries.rst

@@ -84,7 +84,7 @@ M365D               list_host_processes               Return all process creatio
 M365D               mail_message_alerts               Lists alerts associated with a specified mail message                                                                               end (datetime), message_id (str), start (datetime)                                                               AlertInfo
 M365D               mailbox_alerts                    Lists alerts associated with a specified mailbox                                                                                    end (datetime), mailbox (str), start (datetime)                                                                  AlertInfo
 M365D               process_alerts                    Lists alerts associated with a specified process                                                                                    end (datetime), file_name (str), start (datetime)                                                                AlertInfo
-M365D               process_cmd_line                  Lists all processes with a command line containing a string (all hosts)                                                             cmd_line (str), end (datetime), start (datetime)                                                                 DeviceProcessEvents
+M365D               process_cmd_line                  Lists all processes with a command line containing a list of strings (all hosts)                                                    cmd_line (list), end (datetime), start (datetime)                                                                DeviceProcessEvents
 M365D               process_creations                 Return all processes with matching name or hash (all hosts)                                                                         end (datetime), process_identifier (str), start (datetime)                                                       DeviceProcessEvents
 M365D               process_paths                     Return all processes with a matching path (part path) (all hosts)                                                                   end (datetime), file_path (str), start (datetime)                                                                DeviceProcessEvents
 M365D               protocol_connections              Returns connections associated with a specified protocol (port number)                                                              end (datetime), protocol (str), start (datetime)                                                                 DeviceNetworkEvents
@@ -232,7 +232,7 @@ M365D           list_host_processes            Return all process creations for
 M365D           mail_message_alerts            Lists alerts associated with a specified mail message                                                                               end (datetime), message_id (str), start (datetime)          AlertInfo
 M365D           mailbox_alerts                 Lists alerts associated with a specified mailbox                                                                                    end (datetime), mailbox (str), start (datetime)             AlertInfo
 M365D           process_alerts                 Lists alerts associated with a specified process                                                                                    end (datetime), file_name (str), start (datetime)           AlertInfo
-M365D           process_cmd_line               Lists all processes with a command line containing a string (all hosts)                                                             cmd_line (str), end (datetime), start (datetime)            DeviceProcessEvents
+M365D           process_cmd_line               Lists all processes with a command line containing a list of strings (all hosts)                                                    cmd_line (list), end (datetime), start (datetime)           DeviceProcessEvents
 M365D           process_creations              Return all processes with matching name or hash (all hosts)                                                                         end (datetime), process_identifier (str), start (datetime)  DeviceProcessEvents
 M365D           process_paths                  Return all processes with a matching path (part path) (all hosts)                                                                   end (datetime), file_path (str), start (datetime)           DeviceProcessEvents
 M365D           protocol_connections           Returns connections associated with a specified protocol (port number)                                                              end (datetime), protocol (str), start (datetime)            DeviceNetworkEvents

msticpy/data/queries/m365d/kql_m365_process.yaml

@@ -71,16 +71,16 @@ sources:
         description: full or partial path
         type: str
   process_cmd_line:
-    description: Lists all processes with a command line containing a string (all hosts)
+    description: Lists all processes with a command line containing a list of strings (all hosts)
     metadata:
     args:
       query: '
         {table}
         | where {time_column} >= datetime({start})
         | where {time_column} <= datetime({end})
-        | where ProcessCommandLine contains "{cmd_line}"
+        | where ProcessCommandLine has_any ({cmd_line})
         {add_query_items}'
     parameters:
       cmd_line:
-        description: Command line artifact to search for
-        type: str
+        description: Command line artifacts to search for
+        type: list

msticpy/data/queries/mde/kql_mdatp_process.yaml

@@ -87,7 +87,7 @@ sources:
         description: full or partial path
         type: str
   process_cmd_line:
-    description: Lists all processes with a command line containing a string (all hosts)
+    description: Lists all processes with a command line containing a list of strings (all hosts)
     metadata:
       pivot:
         short_name: processes_by_cmdline
@@ -96,9 +96,9 @@ sources:
         {table}
         | where Timestamp >= datetime({start})
         | where Timestamp <= datetime({end})
-        | where ProcessCommandLine contains "{cmd_line}"
+        | where ProcessCommandLine has_any ({cmd_line})
         {add_query_items}'
     parameters:
       cmd_line:
-        description: Command line artifact to search for
+        description: Command line artifacts to search for
         type: str