Question Analysis

DeviceProcessEvents | where FileName == "ping" | project DeviceName, ProcessCommandLine, TimeGenerated

DeviceProcessEvents | where FileName == "ping" | extend ping_target = extract(@"ping\s+(-[\w\s]+\s+)?([\d\.]+)", 2, ProcessCommandLine) | where isnotempty(ping_target) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ping_target

DeviceProcessEvents | where ProcessCommandLine startswith "ping" | project ProcessCommandLine | extend IPAddress = extract(@"\d+\.\d+\.\d+\.\d+", 0, ProcessCommandLine) | project IPAddress | where isnotempty(IPAddress) | distinct IPAddress

DeviceProcessEvents | where ProcessCommandLine contains "ping" | project InitiatingProcessCommandLine, DeviceId, DeviceName, TenantId, TimeGenerated

DeviceProcessEvents | where ProcessCommandLine contains "ping" | join kind=inner ( DeviceInfo | where OSPlatform contains "Linux" ) on DeviceId | extend ExtractedIP = extract("[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+", 0, ProcessCommandLine) | where isnotempty(ExtractedIP) | project DeviceName, ProcessCreationTime, ProcessCommandLine, ExtractedIP | order by ProcessCreationTime desc

let linuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; DeviceProcessEvents | where DeviceId in (linuxDevices) | where FileName =~ "ping" | extend TargetIP = extract(@"\\b\\d{1,3}\\\.\\d{1,3}\\\.\\d{1,3}\\\.\\d{1,3}\\b", 0, ProcessCommandLine) | summarize arg_max(TimeGenerated, TargetIP, TimeGenerated) by DeviceId | project DeviceId, TargetIP, TimeGenerated | order by TimeGenerated desc

let LinuxDevices = DeviceInfo | where OSPlatform == "Linux" | distinct DeviceId; LinuxDevices | join (DeviceProcessEvents | where FileName == "ping" or ProcessCommandLine has "ping") on DeviceId | extend TargetIp = extract("([0-9]+(?:\\.[0-9]+){3})", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, TargetIp | order by TimeGenerated desc

DeviceProcessEvents | where FileName == "ping" | extend RawTarget = extract(@"ping\s+([^\s]+)", 1, ProcessCommandLine) | join kind=inner ( DeviceInfo | where OSPlatform == "Linux" | project DeviceId, DeviceName ) on DeviceId | extend PingIP = extract(@"(\d{1,3}(?:\\.\d{1,3}){3})", 0, RawTarget) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, RawTarget, PingIP | order by TimeGenerated desc

DeviceProcessEvents | where InitiatingProcessCommandLine contains "ping" | extend targetIP = extract(@"\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\b", 0, InitiatingProcessCommandLine) | where isnotempty(targetIP) | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, targetIP | sort by TimeGenerated desc

DeviceProcessEvents | where ProcessCommandLine contains "ping" | where FileName endswith "ping" | extend TargetIP = extract(@"(\b\d{1,3}(?:\.\d{1,3}){3}\b)", 0, ProcessCommandLine) | where isnotempty(TargetIP) | project TimeGenerated, DeviceName, ProcessCommandLine, TargetIP | order by TimeGenerated desc

// Identify Linux devices let linuxDevices = DeviceInfo | where OSPlatform contains "Linux" | project DeviceId, DeviceName; // Network-based ping events (ICMP by ping) let pingNetwork = DeviceNetworkEvents | where DeviceId in (linuxDevices | project DeviceId) | where Protocol == "ICMP" | where InitiatingProcessFileName in ("ping", "ping6") | extend ProcessCommandLine = InitiatingProcessCommandLine | project TimeGenerated, DeviceId, PingTarget = RemoteIP, ProcessCommandLine; // Process-based ping events (extract IP from command line) let pingProcess = DeviceProcessEvents | where DeviceId in (linuxDevices | project DeviceId) | where FileName in ("ping", "ping6") | extend PingTarget = extract(@"(\d+\.\d+\.\d+\.\d+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceId, PingTarget, ProcessCommandLine; // Combine, enrich, filter, and sort union pingNetwork, pingProcess | where isnotempty(PingTarget) | join kind=inner linuxDevices on DeviceId | sort by TimeGenerated desc | project TimeGenerated, DeviceName, PingTarget, ProcessCommandLine