table

DeviceProcessEvents

DeviceProcessEvents contains process creation and related endpoint process activity available for advanced hunting.

tablesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiDeviceEvents
Related tabletableDeviceFileEvents
Related tabletableDeviceNetworkEvents
Related tabletableDeviceRegistryEvents
Related tabletableDeviceImageLoadEvents
Related tabletable

Schema

FieldTypeDescriptionCopy
TimestampdatetimeDate and time when the event was recorded.
DeviceIdstringUnique identifier for the device in the service.
DeviceNamestringFully qualified domain name of the device.
ActionTypestringType of activity that triggered the event.
FileNamestringName of the file that the recorded action was applied to.
ProcessCommandLinestringCommand line used to create the new process.
InitiatingProcessAccountSidstringSecurity identifier of the account context that initiated the process.

Sample KQL

Suspicious PowerShell process creation

Find recent PowerShell executions with command-line indicators commonly used during hands-on-keyboard activity.

kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "EncodedCommand", "Invoke-WebRequest", "DownloadString")
| project Timestamp, DeviceName, InitiatingProcessAccountSid, FileName, ProcessCommandLine
| order by Timestamp desc