msticpy/data/queries/kql_sent_winevent_proc.yaml [117:136]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    args:
      query: '
        let start = datetime({start});
        let end = datetime({end});
        let sourceProcessId = "{process_id}";
        let sourceLogonId = "{logon_session_id}";
        let sourceProcess =
        materialize(
            {table}
            {event_filter}
            {query_project}
            | where {subscription_filter}
            | where Computer has "{host_name}"
            | where TimeGenerated >= start
            | where TimeGenerated <= end
            | where SubjectLogonId == sourceLogonId
            | where NewProcessId == sourceProcessId
            | where NewProcessName =~ "{process_name}"
            | extend NodeRole = "source", Level = 0
            | top 1 by TimeCreatedUtc desc nulls last);
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



msticpy/data/queries/kql_sent_winevent_proc.yaml [235:254]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    args:
      query: '
        let start = datetime({start});
        let end = datetime({end});
        let sourceProcessId = "{process_id}";
        let sourceLogonId = "{logon_session_id}";
        let sourceProcess =
        materialize(
            {table}
            {event_filter}
            {query_project}
            | where {subscription_filter}
            | where Computer has "{host_name}"
            | where TimeGenerated >= start
            | where TimeGenerated <= end
            | where SubjectLogonId == sourceLogonId
            | where NewProcessId == sourceProcessId
            | where NewProcessName =~ "{process_name}"
            | extend NodeRole = "source", Level = 0
            | top 1 by TimeCreatedUtc desc nulls last);
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



