Processes - Windows

Host All | inputlookup windows_hostmon_system | dedup Host | sort Host Host Host * * Name All | inputlookup windows_hostmon_process_details | dedup Name | sort Name Name Name * *

eventtype=windows_index_windows eventtype=hostmon_windows Type=Process host="$HostMonitoringHost$" Name="$HostProcessName$" | dedup host, Name | table host, Name, StartTime, CommandLine 0 truefalsecellnone10