Disk Activity: Capture Image, PID, and File via performance counters?

Question

I have a high disk write kb spikes condition on one of our Azure VMs (windows server 2016).

As such, trying to figure out root cause. Resource Monitor shows which process (image) and file is in real time, which would be very helpful in finding the root cause. But I can't be sitting in front and watching this constantly.

As such, I was hoping to use Performance Monitor alerts or capture this type of information by monitoring and setting alert thresholds based on disk write kb. But from what I can tell, it just records that metric, not additional information, like that which is shown in the Resource Monitor, specifically the Image and File information.

Am I missing anything or is there a way to get a snapshot of the Disk Activity's image and file information at the time that a Disk Write KB threshold is met?