VQL Reference Windows token token Function Arg Description Type pid The PID to get the token for. int64 (required) Required permissions: MACHINE_STATE Description Extract process token.