Querying Process Creation Events with DeviceProcessEvents

Quick Answer

The answer is the DeviceProcessEvents table. This is the correct choice because it is the dedicated schema in Microsoft 365 Defender’s advanced hunting that captures every process creation event, including the full command line arguments used to launch each process. For a security analyst investigating a malware incident, this table directly provides the necessary visibility into which processes were spawned and how they were executed, making it essential for tracing malicious behavior like payload execution or script-based attacks. On the SC-200 exam, this question tests your ability to map a specific hunting scenario to the correct table, often with traps like confusing DeviceProcessEvents with DeviceEvents or DeviceNetworkEvents. A common memory tip is to think of “Process” in the table name as the key—if you need to see what ran and how it ran, DeviceProcessEvents is your go-to. Remember the mnemonic: “Processes have Parents and Commands,” so always pick the table with “Process” in its name when command-line details are required.