security-runhuntingquery-example1-powershell-snippets.md

description	Automatically generated file. DO NOT MODIFY

Import-Module Microsoft.Graph.Beta.Security

$params = @{
	Query = "DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe" | project Timestamp, FileName, InitiatingProcessFileName | order by Timestamp desc | limit 2"
}

Start-MgBetaSecurityHuntingQuery -BodyParameter $params