KQL Search

Query Details

HomeAI ToolsDevice Query

Configfile

Query

Tags:

Query:
DeviceFileEvents
| where FolderPath contains @"rclone\" and InitiatingProcessParentFileName != @"Install WD Discovery"

References

Comments

Explanation

This query is searching for DeviceFileEvents where the FolderPath contains "rclone" and the InitiatingProcessParentFileName is not "Install WD Discovery".

Details

Ali Hussein profile picture

Ali Hussein

Released: September 12, 2023

Tables

DeviceFileEvents

Keywords

DeviceFileEvents,FolderPath,InitiatingProcessParentFileName,InstallWDDiscovery

Operators

|wherecontains!=

Actions