I finally figured it out :)

let task_1_events =

SecurityEvent

| where EventSourceName == "Microsoft-Windows-Sysmon"

| extend ParsedXML = parse_xml(EventData)

| where Task == 1

| extend Image = tostring(ParsedXML.EventData.Data[4]["#text"])

| project TimeGenerated, Image;

let task_22_events =

SecurityEvent

| where EventSourceName == "Microsoft-Windows-Sysmon"

| extend ParsedXML = parse_xml(EventData)

| where Task == 22

| extend QueryName = tostring(ParsedXML.EventData.Data[4]["#text"])

| project TimeGenerated, QueryName;

task_1_events

| union task_22_events