.execute database script <|
// Setting up helper functions to extract information from the raw telemetry
.create-or-alter function YaccWorkloadStartsProcess() {
    YaccProcessEvents
    | where EventType == 'ProcessStart'
    | parse-where Message with "Workload '" WorkloadId:string "' starts new process '" ProcessName "' PID=" ProcessId:long "on machine '" MachineId "'"
    | project Time, WorkloadId, MachineId, ProcessId, ProcessName, Key=strcat(MachineId, ':', ProcessId)
}
.create-or-alter function YaccProcessStartsProcess() {
    YaccProcessEvents
    | where EventType == 'ProcessStart'
    | where Message startswith "Process"
    | parse-where Message with "Process" * "starts new process '" NewProcessName "' PID=" NewProcessId:long "on machine '" NewMachineId "'"
    | project Time, MachineId=NewMachineId, ProcessId=NewProcessId, ProcessName=NewProcessName, SourceId=strcat(MachineId, ':', ProcessId), TargetId=strcat(NewMachineId, ':', NewProcessId)
}
.create-or-alter graph_model YaccGraph ```
{
  "Schema": {
    "Nodes": {
      "Application": { "AppName":"string", "AppId":"string", "HostingIp":"string" },
      "Workloads":   { "WorkloadId":"string"},
      "Process":     { "ProcessId":"long", "MachineId":"string", "ProcessName":"string", "Key":"string" }
    },   
  },
  "Definition": {
    "Steps": [
        { 
          "Kind": "AddNodes",
          "Query": "YaccApplications",
          "NodeIdColumn": "AppId",
          "Labels": ["Application"]
        },
        { 
          "Kind": "AddEdges",
          "Query": "YaccApplications_Workloads",
          "SourceColumn": "AppId",
          "TargetColumn": "WorkloadId"
        },
        {
          "Kind": "AddNodes",
          "Query": "YaccWorkloadStartsProcess() | project MachineId, ProcessId, ProcessName, Key",
          "NodeIdColumn": "Key",
          "Labels": ["Process"]
        },
        {
          "Kind": "AddEdges",
          "Query": "YaccWorkloadStartsProcess() | project Time, WorkloadId, Key",
          "SourceColumn": "WorkloadId",
          "TargetColumn": "Key"
        },
        {
          "Kind": "AddNodes",
          "Query": "YaccProcessStartsProcess() | project MachineId, ProcessId, ProcessName, Key=TargetId",
          "NodeIdColumn": "Key",
          "Labels": ["Process"]
        },
        {
          "Kind": "AddEdges",
          "Query": "YaccProcessStartsProcess() | project Time, SourceId, TargetId",
          "SourceColumn": "SourceId",
          "TargetColumn": "TargetId"
        },
    ]
  }
}
``` 
.make graph_snapshot YaccGraphSnapshot from YaccGraph 
// Now you can use: 
// "graph('YaccGraph') | graph-match ..." for running graph queries! Sooooo cool!