deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-19 12:23:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Joey Caparas
2018-03-28 15:43:49 -07:00
parent 9bbb8ec4f9
commit 363d430686
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md
View File

@ -39,8 +39,9 @@ The following best practices serve as a guideline of query performance best prac
## Query tips and pitfalls ## Query tips and pitfalls
### Unique Process IDs ### Unique Process IDs
Process IDs are recycled in Windows and reused for new processes, so cannot serve as a unique identifier for a specific process. Process IDs are recycled in Windows and reused for new processes and therefore can<EFBFBD>t serve as a unique identifier for a specific process.
To address this issue, the time the process was created. You can use the time process together with the process ID which can then serve as a unique ID on a specific machine. To address this issue, Windows Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either MachineId or ComputerName), a process ID (ProcessId or InitiatingProcessId) and the process creation time (ProcessCreationTime or InitiatingProcessCreationTime) So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either MachineId or ComputerName), a process ID (ProcessId or InitiatingProcessId) and the process creation time (ProcessCreationTime or InitiatingProcessCreationTime)