// Sentinel Syslog; replace with the exact appliance Computer value.
let Appliance = "REPLACE_WITH_NETSCALER_COMPUTER";
Syslog
| where TimeGenerated >= ago(7d)
| where Computer =~ Appliance
| where SyslogMessage contains "pitboss"
    and SyslogMessage contains "NSPPE"
    and SyslogMessage contains "unexpectedly died"
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc
| take 200