Process Names in Data Lake Activity
Improvement
Activity records in our data lake now carry the process on the device behind each observation, so you can see which program resolved a domain or opened a connection. For endpoint sources such as SentinelOne and CrowdStrike, filter on actor.process.file.name in REST API, KQL, and MCP searches.