Question Analysis
During investigation of a Linux device, you see evidence of a process that reports system locale details. Identify the tool used.
07ce871a-b3c3-44a3-97fa-a20118fdc7c9
Question ID
1/16
Models Correct
1
Valid Answer
6%
Success Rate
Reference Answer
Human-validated correct answer for this question
localectl
Model Performance Comparison
See how different AI models performed on this question
| Model | Answer | KQL Query | Status | Attempts | Time | Cost |
|---|---|---|---|---|---|---|
| gemini-2.5-flash-preview-04-17 | locale | DeviceProcessEvents
| where ProcessCommandLine has "locale" or ProcessCommandLine has "localectl"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | Incorrect | 1 | 11.04s | 0.0056 |
| gpt-35-turbo | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0106 |
| gpt-4-turbo-2024-04-09 | locale | DeviceProcessEvents
| where ProcessCommandLine has 'locale' or ProcessCommandLine has 'localectl'
| project DeviceId, DeviceName, ProcessCommandLine, ProcessCreationTime, FileName, FolderPath
| distinct DeviceName, ProcessCommandLine, ProcessCreationTime, FileName, FolderPath | Incorrect | 1 | 10.86s | 0.0791 |
| gpt-4.1 | locale | DeviceProcessEvents
| join kind=inner (
DeviceInfo
| where OSPlatform == "Linux"
| project DeviceId
) on DeviceId
| where FileName in ("locale", "localectl") or ProcessCommandLine has_any ("locale", "localectl", "/etc/locale.conf", "/etc/default/locale", "LANG=")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
| order by TimeGenerated desc
| take 100 | Incorrect | 3 | 20.66s | 0.0595 |
| gpt-4.1-finetuned | locale, localectl, cat, curl (system reporting scripts) | DeviceProcessEvents | where InitiatingProcessCommandLine contains "locale" or ProcessCommandLine contains "locale" | extend AccountCustomEntity = InitiatingProcessAccountUpn, HostCustomEntity = DeviceName, FileCustomEntity = InitiatingProcessCommandLine | project-away InitiatingProcessLogonId,InitiatingProcessParentId,InitiatingProcessSessionId | Correct | 2 | 57.27s | 0.0733 |
| gpt-4.1-mini | locale | DeviceProcessEvents
| where DeviceName contains "linux" or SourceSystem == "Linux" or InitiatingProcessFileName endswith ".sh" or InitiatingProcessFileName contains "bash" or ProcessCommandLine contains "locale" or ProcessCommandLine contains "localectl" or ProcessCommandLine contains "language"
| where ProcessCommandLine contains "locale" or ProcessCommandLine contains "localectl" or ProcessCommandLine contains "language" or InitiatingProcessCommandLine contains "locale" or InitiatingProcessCommandLine contains "localectl" or InitiatingProcessCommandLine contains "language"
| project DeviceName, ProcessCommandLine, FileName
| distinct DeviceName, ProcessCommandLine, FileName
| extend ToolUsed = FileName
| project DeviceName, ToolUsed, ProcessCommandLine
| sort by DeviceName asc | Incorrect | 2 | 24.03s | 0.0044 |
| gpt-4.1-nano | No answer provided | No query generated | Incorrect | 5 | 0.00s | 0.0015 |
| gpt-4o | locale | DeviceProcessEvents
| where ProcessCommandLine contains "locale" or InitiatingProcessCommandLine contains "locale"
| project DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId, ProcessCommandLine, TimeGenerated | Incorrect | 1 | 3.45s | 0.0252 |
| grok-3-beta | locale | DeviceProcessEvents
| join kind=inner DeviceInfo on DeviceId
| where OSPlatform == 'Linux'
| where ProcessCommandLine has 'locale' or InitiatingProcessFileName has 'locale' or ProcessCommandLine has 'localectl'
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, Timestamp
| order by Timestamp desc | Incorrect | 1 | 26.54s | 0.0609 |
| grok-3-mini-beta | locale | DeviceInfo
| where OSPlatform contains "Linux"
| project DeviceId, DeviceName
| join kind=inner (
DeviceProcessEvents
| where ProcessCommandLine contains "locale"
| project DeviceId, ProcessCommandLine, FileName, TimeGenerated
) on DeviceId
| project DeviceName, ProcessCommandLine, FileName, TimeGenerated
| order by TimeGenerated desc
| summarize arg_max(TimeGenerated, *) by DeviceName, FileName | Incorrect | 1 | 14.92s | 0.0021 |
| o1-high | locale | DeviceProcessEvents
| where DeviceId in (DeviceInfo
| where OSPlatform =~ "Linux"
| distinct DeviceId)
| where ProcessCommandLine has_any("locale", "localectl") or FileName in~ ("locale", "localectl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc | Incorrect | 1 | 90.24s | 0.6374 |
| o1-low | locale | DeviceInfo
| where OSPlatform =~ "Linux"
| join kind=inner (
DeviceProcessEvents
| where ProcessCommandLine has_any ("locale", "localectl")
) on DeviceId
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath | Incorrect | 1 | 42.92s | 0.4811 |
| o3-mini-high | locale | DeviceProcessEvents
| where tolower(InitiatingProcessCommandLine) contains "locale"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| distinct DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| Incorrect | 1 | 11.36s | 0.0091 |
| o3-mini-low | locale | DeviceProcessEvents
| where ProcessCommandLine has "locale"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine
| summarize EventCount = count() by FileName, ProcessCommandLine
| sort by EventCount desc | Incorrect | 1 | 14.87s | 0.0105 |
| o4-mini-high | locale | DeviceProcessEvents
| where ProcessCommandLine has "locale"
| join kind=inner (
DeviceInfo
| where OSPlatform has "Linux"
| project DeviceId
) on DeviceId
| project TimeGenerated, DeviceName, FileName, ProcessId, ProcessCommandLine | Incorrect | 1 | 26.76s | 0.0253 |
| o4-mini-low | locale | // Search for executions of the 'locale' tool on Linux devices
let linuxDevices = DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId;
DeviceProcessEvents
| where DeviceId in (linuxDevices)
| where FileName == "locale" or ProcessCommandLine startswith "locale"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc | Incorrect | 1 | 45.95s | 0.0110 |