#event_simpleName=ProcessRollup2
| aid=?{aid=*}
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/
| join({
    #event_simpleName=ProcessRollup2
    | aid=?{aid=*}
    | ParentBaseFileName =~ wildcard(?{ParentBaseFileName="*"}, ignoreCase=true)
    | ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true)
    | MD5 := MD5HashData
    | ImageFileName=/(\/|\\)(?<ChildFileName>\w*\.?\w*)$/
    | ChildCLI := CommandLine
    | ChildUser := UserName
  }, key=ParentProcessId, field=TargetProcessId, include=[MD5, ChildFileName, ChildCLI, ChildUser], limit=200000)
| groupBy([aid, ComputerName, UserName, ChildUser, FileName, CommandLine, ChildFileName, ChildCLI, MD5], limit=max)