KQL Search

Query Details

Configfile

Query

DeviceFileEvents
| where FolderPath contains @"rclone\" and InitiatingProcessParentFileName != @"Install WD Discovery"

References

Comments

About this query

Tags:

Query:

Explanation

This query is searching for DeviceFileEvents where the FolderPath contains "rclone" and the InitiatingProcessParentFileName is not "Install WD Discovery".

Details

Ali Hussein profile picture

Ali Hussein

Released: September 12, 2023

Tables

DeviceFileEvents

Keywords

DeviceFileEventsFolderPathInitiatingProcessParentFileNameInstall WD Discovery

Operators

|wherecontains!=

Actions

GitHub