Process Crash event.name change?

[StrangerThing]

I had a "Crash Alerter" Workflow that was looking for event.name containing "Process crashed". This trigger used to work just fine and catch all the process crash events I was looking for. However, recently I noticed that the event.name has changed for this event type (and potentially others). Is there a way to be notified when important events like that have a name (or other field) change? I'm assuming this was rolled out with some tenant release, but I haven't checked the release notes yet. This was a breaking change for me and we missed out on some crucial alerting with my event-driven Workflow. 

[m3tomlins]

Maybe changes like this were in the release notes, but we missed it?

[p_devulapalli]

@StrangerThing I still see the "event.name: Process crashed" showing up in events , what is that its changed to in your environment ?

[StrangerThing]

It's changed to "<process name> has crashed" in all my tenants.

[p_devulapalli]

@StrangerThing I think these changes could be due to the version of OneAgent used rather than a cluster version.  I see older OneAgents are still using the "event.name: Process crashed" but its different for hosts with new OneAgent versions . At least this is what I observed .

You might still be able to use "event.group_label:Process crashed" instead to trigger the workflow as that's available.

[StrangerThing]

I've already changed my workflow to make sure I catch crashes through three different fields. My point is that I don't think this kind of change was very well communicated. 

[p_devulapalli]

@StrangerThing Agreed, this should have been better documented