diff --git a/.script/tests/KqlvalidationsTests/CustomTables/InformationProtectionLogs_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/InformationProtectionLogs_CL.json index f06776b0f9..c9f8b2eb7a 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/InformationProtectionLogs_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/InformationProtectionLogs_CL.json @@ -10,12 +10,68 @@ "Type": "string" }, { - "Name": "TimeGenerated [UTC]", + "Name": "MG", + "Type": "string" + }, + { + "Name": "ManagementGroupName", + "Type": "string" + }, + { + "Name": "TimeGenerated", "Type": "datetime" }, + { + "Name": "Computer", + "Type": "string" + }, + { + "Name": "RawData", + "Type": "string" + }, + { + "Name": "PK_LA___Content_Types__xml_MN_0_H_nY_t_Q_Ic_g_b_2p_J_6_oE_V_P_t_3_vX_I_u_p_e_nd_z_Q_Q_K_oH_X_U_s", + "Type": "string" + }, + { + "Name": "ProtectionTime_s", + "Type": "string" + }, + { + "Name": "Protected_s", + "Type": "string" + }, { "Name": "TimeGenerated_s", - "Type": "datetime" + "Type": "string" + }, + { + "Name": "TimeGenerated_UTC__s", + "Type": "string" + }, + { + "Name": "TemplateId_g_g", + "Type": "string" + }, + { + "Name": "ProtectionType_s_s", + "Type": "string" + }, + { + "Name": "ProtectionOwner_s_s", + "Type": "string" + }, + { + "Name": "ContentId_g_g", + "Type": "string" + }, + { + "Name": "ProtectionTime_t_UTC__s", + "Type": "string" + }, + { + "Name": "ProcessVersion_s_s", + "Type": "string" }, { "Name": "AadTenantId_g_g", @@ -45,10 +101,22 @@ "Name": "Operation_s_s", "Type": "string" }, + { + "Name": "Protected_b_s", + "Type": "string" + }, { "Name": "Platform_s_s", "Type": "string" }, + { + "Name": "Activity_s_s", + "Type": "string" + }, + { + "Name": "DataState_s_s", + "Type": "string" + }, { "Name": "LogId_g_g", "Type": "string" @@ -57,6 +125,110 @@ "Name": "IPv4_s_s", "Type": "string" }, + { + "Name": "MatchedLabelId_g", + "Type": "string" + }, + { + "Name": "MatchedLabelName_s", + "Type": "string" + }, + { + "Name": "ProtectionTypeBefore_s", + "Type": "string" + }, + { + "Name": "TemplateIdBefore_g", + "Type": "string" + }, + { + "Name": "ParentLabelNameBefore_s", + "Type": "string" + }, + { + "Name": "LabelIdBeforeAction_g", + "Type": "string" + }, + { + "Name": "SensitivityChange_s", + "Type": "string" + }, + { + "Name": "LabelNameBefore_s", + "Type": "string" + }, + { + "Name": "ActionIdBefore_g", + "Type": "string" + }, + { + "Name": "TemplateId_g", + "Type": "string" + }, + { + "Name": "ProtectionType_s", + "Type": "string" + }, + { + "Name": "ProtectionOwner_s", + "Type": "string" + }, + { + "Name": "ContentId_g", + "Type": "string" + }, + { + "Name": "ProtectionTime_t", + "Type": "datetime" + }, + { + "Name": "ProcessVersion_s", + "Type": "string" + }, + { + "Name": "DeviceId_s", + "Type": "string" + }, + { + "Name": "InformationTypes_s", + "Type": "string" + }, + { + "Name": "DiscoveredInformationTypes_s", + "Type": "string" + }, + { + "Name": "InformationTypesAbove55_s", + "Type": "string" + }, + { + "Name": "InformationTypesAbove65_s", + "Type": "string" + }, + { + "Name": "InformationTypesAbove75_s", + "Type": "string" + }, + { + "Name": "InformationTypesAbove85_s", + "Type": "string" + }, + { + "Name": "InformationTypesAbove95_s", + "Type": "string" + }, + { + "Name": "DeviceRisk_s", + "Type": "string" + }, + { + "Name": "MachineId_s", + "Type": "string" + }, + { + "Name": "ActionSource_s", + "Type": "string" + }, { "Name": "DeviceId_g", "Type": "string" @@ -65,6 +237,14 @@ "Name": "AadTenantId_g", "Type": "string" }, + { + "Name": "LabelName_s", + "Type": "string" + }, + { + "Name": "ParentLabelName_s", + "Type": "string" + }, { "Name": "UserId_s", "Type": "string" @@ -93,14 +273,50 @@ "Name": "Operation_s", "Type": "string" }, + { + "Name": "ObjectId_s", + "Type": "string" + }, + { + "Name": "LabelId_g", + "Type": "string" + }, + { + "Name": "Protected_b", + "Type": "bool" + }, + { + "Name": "ProtectedBeforeAction_b", + "Type": "bool" + }, { "Name": "Platform_s", "Type": "string" }, + { + "Name": "Activity_s", + "Type": "string" + }, + { + "Name": "Location_s", + "Type": "string" + }, { "Name": "ApplicationId_g", "Type": "string" }, + { + "Name": "DataState_s", + "Type": "string" + }, + { + "Name": "IsLabelChanged_b", + "Type": "bool" + }, + { + "Name": "IsProtectionChanged_b", + "Type": "bool" + }, { "Name": "ProductVersion_s", "Type": "string" @@ -109,6 +325,10 @@ "Name": "LogId_g", "Type": "string" }, + { + "Name": "ActionId_g", + "Type": "string" + }, { "Name": "IPv4_s", "Type": "string" @@ -116,6 +336,10 @@ { "Name": "Type", "Type": "string" + }, + { + "Name": "_ResourceId", + "Type": "string" } ] }