You are reviewing Linux syslog records on a CentOS/RHEL 7.x server. You notice entries for shell commands that access system configuration files under /etc/security. Determine exactly which configuration file was being inspected by the command.

DeviceProcessEvents
| where ProcessCommandLine contains "/etc/security/"
| project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents
| where InitiatingProcessCommandLine has '/etc/security/' or FileName has '/etc/security/'
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName

DeviceProcessEvents
| where ProcessCommandLine contains "/etc/security/"
| extend ConfigFileAccessed = extract(@"/etc/security/([^\s]+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, ConfigFileAccessed
| order by TimeGenerated desc

let linux_cmds = @"(?i)\b(cat|less|more|tail|head|vi|vim|nano|sed|awk|grep|strings|stat)\b";
let etc_prefix = "/etc/security";

union isfuzzy=true
(
  DeviceProcessEvents
  | project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem
),
(
  DeviceEvents
  | project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem
),
(
  DeviceFileEvents
  | project TimeGenerated, DeviceId, DeviceName, AccountName = RequestAccountName, InitiatingProcessAccountName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, ProcessId = InitiatingProcessId, InitiatingProcessId, InitiatingProcessFileName, FileName, FolderPath, SourceSystem
)
| extend CmdLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine, "")
// Keep events that reference /etc/security in cmdline or file fields
| where CmdLine contains etc_prefix or (isnotempty(FileName) and FileName startswith etc_prefix) or (isnotempty(FolderPath) and FolderPath startswith etc_prefix)
// Extract exact /etc/security paths from command lines (handles quoted paths). The pattern excludes whitespace and quotes inside the path token.
| extend MatchedPaths = extract_all('(/etc/security(?:/[^ \t\r\n''"]*)*)', CmdLine)
| mv-expand MatchedPaths to typeof(string)
| extend MatchedPaths = trim('''"', MatchedPaths)
| where isnotempty(MatchedPaths)
// Prefer likely inspection commands or shells/editors, but allow direct file events too
| where CmdLine matches regex(linux_cmds) or tostring(InitiatingProcessFileName) in~ ("bash","sh","sshd","sudo","su","vi","vim","nano","less","more") or FileName startswith etc_prefix
// Enrich with latest DeviceInfo per device (best-effort)
| join kind=leftouter (
    DeviceInfo
    | summarize arg_max(TimeGenerated, *) by DeviceId
    | project DeviceId, OSDistribution, OSVersion, DeviceNameInfo = DeviceName
) on DeviceId
// Summarize by device and the exact matched path
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), DeviceNames = make_set(coalesce(DeviceName, DeviceNameInfo), 5), Accounts = make_set(AccountName, 5), InitiatingAccounts = make_set(InitiatingProcessAccountName,5), InitiatingProcesses = make_set(InitiatingProcessFileName,5), ProcessIds = make_set(ProcessId,5), CmdLines = make_set(CmdLine,20) by DeviceId, MatchedFile = MatchedPaths, OSDistribution, OSVersion
| project DeviceId, DeviceName = tostring(DeviceNames[0]), MatchedFile, Count, FirstSeen, LastSeen, Accounts, InitiatingAccounts, InitiatingProcesses, ProcessIds, CmdLines, OSDistribution, OSVersion
| order by FirstSeen desc

DeviceProcessEvents
| join kind=leftouter (
    DeviceInfo
    | where OSPlatform contains "Linux"
) on DeviceId
| where ProcessCommandLine contains "/etc/security"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName, OSPlatform
| order by Timestamp desc

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "/etc/security"
| extend AccessedFile = extract(@"(/etc/security/[^ ]+)", 1, InitiatingProcessCommandLine)
| where isnotempty(AccessedFile)
| distinct AccessedFile
| order by AccessedFile asc

union DeviceProcessEvents, DeviceFileEvents
| where FolderPath contains "/etc/security" or ProcessCommandLine contains "/etc/security"
| where ActionType in ("FileAccessed", "FileOpened", "FileRead", "FileModified", "ProcessCreated", "ProcessLaunched")
| project TimeGenerated, DeviceName, FolderPath, FileName, ProcessCommandLine, ActionType
| order by TimeGenerated desc

// Search across file and process event tables for references to files under /etc/security
union DeviceFileEvents, DeviceProcessEvents
| where FolderPath contains "/etc/security" or ProcessCommandLine has "/etc/security" or InitiatingProcessCommandLine has "/etc/security"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "/etc/security"
| extend InspectedFile = tostring(extract(@"(/etc/security/\S+)", 1, InitiatingProcessCommandLine))
| where isnotempty(InspectedFile)
| distinct TimeGenerated, InspectedFile, InitiatingProcessCommandLine
| order by TimeGenerated desc

union isfuzzy=true
    (
      DeviceFileEvents
      | where FolderPath startswith "/etc/security"
      | extend FullPath = strcat(FolderPath, "/", FileName)
      | project Timestamp = TimeGenerated,
                DeviceName,
                AccountName = InitiatingProcessAccountName,
                InitiatingProcessFileName,
                CommandLine = InitiatingProcessCommandLine,
                FullPath
    ),
    (
      DeviceProcessEvents
      | where ProcessCommandLine contains "/etc/security/"
      | extend FullPath = extract(@"(/etc/security/\S+)", 1, ProcessCommandLine)
      | project Timestamp = ProcessCreationTime,
                DeviceName,
                AccountName = InitiatingProcessAccountName,
                InitiatingProcessFileName,
                CommandLine = ProcessCommandLine,
                FullPath
    )
| sort by Timestamp desc

DeviceProcessEvents
| where FileName in ("cat","less","more","tail","head","grep","vi","vim","nano","sed","awk")
| where ProcessCommandLine contains "/etc/security/"
| extend ConfigFile = extract(@"(/etc/security/\S+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName = AccountUpn, ShellCommand = FileName, ProcessCommandLine, ConfigFile
| order by TimeGenerated desc