My ultimate goal is to have some form of CMD line logs sent into Splunk. Due to reasons, Sysmon or any other tool is not possible. We only have AMP logs being sent to Splunk. Currently we only get what CMD line arguments were used if there is a cloud IOC compromise event.
Is it possible to get what CMD line arguments were used even if there is a benign event? For example, I go into Device Trajectory and see the following event. AMP doesn't classify it as a compromise or malicious event so that particular event doesn't get sent into Splunk.
![stipend_0-1680717079357.png stipend_0-1680717079357.png](https://community.cisco.com/t5/image/serverpage/image-id/180993i7AB4E872B47D21CC/image-size/medium?v=v2&px=400)