Hi there,
I am trying to get some data from MS Defender into a Splunk query.
My original KQL query in azure contains | JOIN KIND INNER. to concat DeviceProcess and DeviceRegistry tables.
The Splunk app I am using:
Splunk https://splunkbase.splunk.com/app/5518
So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt in splunk SPL. Is there a suitable Splunk query for this kind of purpose?
