diff --git a/Solutions/Microsoft Defender for Office 365/Data/Solution_MicrosoftDefenderforOffice365.json b/Solutions/Microsoft Defender for Office 365/Data/Solution_MicrosoftDefenderforOffice365.json index 526f372c706..0afad338a2f 100644 --- a/Solutions/Microsoft Defender for Office 365/Data/Solution_MicrosoftDefenderforOffice365.json +++ b/Solutions/Microsoft Defender for Office 365/Data/Solution_MicrosoftDefenderforOffice365.json @@ -18,7 +18,7 @@ "Solutions/Microsoft Defender for Office 365/Playbooks/O365DefenderPlaybooks/o365-DeleteMaliciousInboxRule/azuredeploy.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\", - "Version": "3.2.0", + "Version": "3.2.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ diff --git a/Solutions/Microsoft Defender for Office 365/Package/3.2.1.zip b/Solutions/Microsoft Defender for Office 365/Package/3.2.1.zip new file mode 100644 index 00000000000..d6030351cfb Binary files /dev/null and b/Solutions/Microsoft Defender for Office 365/Package/3.2.1.zip differ diff --git a/Solutions/Microsoft Defender for Office 365/Package/mainTemplate.json b/Solutions/Microsoft Defender for Office 365/Package/mainTemplate.json index 5b8e2740c11..88d0e4fc5f6 100644 --- a/Solutions/Microsoft Defender for Office 365/Package/mainTemplate.json +++ b/Solutions/Microsoft Defender for Office 365/Package/mainTemplate.json @@ -69,7 +69,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Defender for Office 365", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.1", "solutionId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "OfficeATP", @@ -149,7 +149,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Defender for Office 365 data connector with template version 3.2.0", + "description": "Microsoft Defender for Office 365 data connector with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -311,7 +311,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftDefenderForOffice365 Workbook with template version 3.2.0", + "description": "MicrosoftDefenderForOffice365 Workbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -404,7 +404,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "O365_Defender_FunctionAppConnector Playbook with template version 3.2.0", + "description": "O365_Defender_FunctionAppConnector Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -511,7 +511,7 @@ }, { "name": "AzureWebJobsStorage", - "value": "[[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2023-04-01').keys[0].value)]" + "value": "[[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';EndpointSuffix=', environment().suffixes.storage, ';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), '2025-06-01').keys[0].value)]" }, { "name": "FUNCTIONS_EXTENSION_VERSION", @@ -580,7 +580,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "o365-BlockMalwareFileExtension Playbook with template version 3.2.0", + "description": "o365-BlockMalwareFileExtension Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -1286,7 +1286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "o365-BlockSender Playbook with template version 3.2.0", + "description": "o365-BlockSender Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -1918,7 +1918,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "o365-BlockSender-EntityTrigger Playbook with template version 3.2.0", + "description": "o365-BlockSender-EntityTrigger Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -2426,7 +2426,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "o365-BlockSpamDomain Playbook with template version 3.2.0", + "description": "o365-BlockSpamDomain Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -3333,7 +3333,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "o365-DeleteMaliciousInboxRule Playbook with template version 3.2.0", + "description": "o365-DeleteMaliciousInboxRule Playbook with template version 3.2.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion6')]", @@ -4079,7 +4079,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Defender for Office 365", @@ -4152,12 +4152,12 @@ { "kind": "DefenderWorkbook", "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", - "version": "3.2.0" + "version": "3.2.1" }, { "kind": "DefenderWorkbook", "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", - "version": "3.2.0" + "version": "3.2.1" } ] }, @@ -4652,7 +4652,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Senders", "timeContext": { @@ -4720,7 +4720,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| sort by DistinctMessages", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| sort by DistinctMessages", "size": 0, "title": "Top Recipients", "timeContext": { @@ -4770,7 +4770,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Recipient Domains", "timeContext": { @@ -5004,7 +5004,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Senders", "timeContext": { @@ -5072,7 +5072,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipients", "timeContext": { @@ -5122,7 +5122,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipient Domains", "timeContext": { @@ -5220,7 +5220,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=make_set(NetworkMessageId) by FileName, FileType, SHA256", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=tostring(make_set(NetworkMessageId)) by FileName, FileType, SHA256", "size": 0, "showAnalytics": true, "timeContext": { @@ -5409,7 +5409,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Senders", "timeContext": { @@ -5476,7 +5476,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipients", "timeContext": { @@ -5525,7 +5525,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipient Domains", "timeContext": { @@ -5622,7 +5622,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=make_set(NetworkMessageId) by Url, UrlDomain", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=tostring(make_set(NetworkMessageId)) by Url, UrlDomain", "size": 0, "showAnalytics": true, "timeContext": { @@ -5794,9 +5794,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", - "contentVersion": "3.2.0" + "contentVersion": "3.2.1" } } } @@ -6284,7 +6284,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Senders", "timeContext": { @@ -6352,7 +6352,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| sort by DistinctMessages", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| sort by DistinctMessages", "size": 0, "title": "Top Recipients", "timeContext": { @@ -6402,7 +6402,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Recipient Domains", "timeContext": { @@ -6636,7 +6636,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Senders", "timeContext": { @@ -6704,7 +6704,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipients", "timeContext": { @@ -6754,7 +6754,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipient Domains", "timeContext": { @@ -6852,7 +6852,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=make_set(NetworkMessageId) by FileName, FileType, SHA256", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=tostring(make_set(NetworkMessageId)) by FileName, FileType, SHA256", "size": 0, "showAnalytics": true, "timeContext": { @@ -7041,7 +7041,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Senders", "timeContext": { @@ -7108,7 +7108,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipients", "timeContext": { @@ -7157,7 +7157,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipient Domains", "timeContext": { @@ -7254,7 +7254,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=make_set(NetworkMessageId) by Url, UrlDomain", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=tostring(make_set(NetworkMessageId)) by Url, UrlDomain", "size": 0, "showAnalytics": true, "timeContext": { @@ -7426,9 +7426,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", - "contentVersion": "3.2.0" + "contentVersion": "3.2.1" } } } @@ -7436,21 +7436,21 @@ } }, "packageKind": "Solution", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "packageName": "Microsoft Defender for Office 365", "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", "contentSchemaVersion": "3.0.0", "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", "contentKind": "DefenderWorkbook", "displayName": "MicrosoftDefenderForOffice365", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','3b0f3eee-3047-526b-aae0-e259182d264d','-','3.2.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','3b0f3eee-3047-526b-aae0-e259182d264d','-','3.2.0')))]", - "version": "3.2.0", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','3b0f3eee-3047-526b-aae0-e259182d264d','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','3b0f3eee-3047-526b-aae0-e259182d264d','-','3.2.1')))]", + "version": "3.2.1", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", - "contentVersion": "3.2.0", + "contentVersion": "3.2.1", "requiredWorkloads": [ { "workload": "mdo", @@ -16668,7 +16668,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -16698,7 +16698,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -21482,7 +21482,7 @@ "style": "decimal" } }, - "tagText": "Quarantine Release Percentage", + "tagText": "Release rate", "valueFontStyle": "mega", "tagTextPosition": "bottom" }, @@ -22143,6 +22143,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "timeContext": { @@ -22392,9 +22393,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", - "contentVersion": "3.2.0" + "contentVersion": "3.2.1" } } } @@ -31604,7 +31605,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -31634,7 +31635,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -36418,7 +36419,7 @@ "style": "decimal" } }, - "tagText": "Quarantine Release Percentage", + "tagText": "Release rate", "valueFontStyle": "mega", "tagTextPosition": "bottom" }, @@ -37079,6 +37080,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "timeContext": { @@ -37328,9 +37330,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", - "contentVersion": "3.2.0" + "contentVersion": "3.2.1" } } } @@ -37338,21 +37340,21 @@ } }, "packageKind": "Solution", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "packageName": "Microsoft Defender for Office 365", "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", "contentSchemaVersion": "3.0.0", "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", "contentKind": "DefenderWorkbook", "displayName": "Microsoft Defender for Office 365 Detections and Insights - ISOC", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','55a394cc-f0af-55c1-8ff2-ec483e3e68a3','-','3.2.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','55a394cc-f0af-55c1-8ff2-ec483e3e68a3','-','3.2.0')))]", - "version": "3.2.0", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','55a394cc-f0af-55c1-8ff2-ec483e3e68a3','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','55a394cc-f0af-55c1-8ff2-ec483e3e68a3','-','3.2.1')))]", + "version": "3.2.1", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforo365", - "packageVersion": "3.2.0", + "packageVersion": "3.2.1", "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", - "contentVersion": "3.2.0", + "contentVersion": "3.2.1", "requiredWorkloads": [ { "workload": "mda", diff --git a/Solutions/Microsoft Defender for Office 365/ReleaseNotes.md b/Solutions/Microsoft Defender for Office 365/ReleaseNotes.md index 056f65122dd..f4c01730cc9 100644 --- a/Solutions/Microsoft Defender for Office 365/ReleaseNotes.md +++ b/Solutions/Microsoft Defender for Office 365/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------------| +| 3.2.1 | 15-10-2026 | Fixed selection filters, queries and labels in **XDR Workbooks**. | | 3.2.0 | 15-10-2026 | Added the investigation **XDR Workbook** and native Defender **Detections and Insights XDR Workbook**, preserving the existing Sentinel workbook, connector and playbooks. | | 3.0.3 | 07-04-2025 | Updated ConnectivityCriteria Type in **Data Connector**. | | 3.0.2 | 24-04-2024 | Updated link for **Custom Connector** redirection in playbooks | diff --git a/Solutions/Microsoft Defender for Office 365/SolutionMetadata.json b/Solutions/Microsoft Defender for Office 365/SolutionMetadata.json index 5966a6a086e..afb57893a81 100644 --- a/Solutions/Microsoft Defender for Office 365/SolutionMetadata.json +++ b/Solutions/Microsoft Defender for Office 365/SolutionMetadata.json @@ -13,5 +13,5 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" }, - "version": "3.2.0" + "version": "3.2.1" } diff --git a/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365.json b/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365.json index e84440fbbed..e3d63372baf 100644 --- a/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365.json +++ b/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365.json @@ -448,7 +448,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Senders", "timeContext": { @@ -516,7 +516,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| sort by DistinctMessages", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| sort by DistinctMessages", "size": 0, "title": "Top Recipients", "timeContext": { @@ -566,7 +566,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| sort by DistinctMessages desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| sort by DistinctMessages desc", "size": 0, "title": "Top Recipient Domains", "timeContext": { @@ -800,7 +800,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Senders", "timeContext": { @@ -868,7 +868,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipients", "timeContext": { @@ -918,7 +918,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", "size": 0, "title": "Top Attachment Recipient Domains", "timeContext": { @@ -1016,7 +1016,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=make_set(NetworkMessageId) by FileName, FileType, SHA256", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=tostring(make_set(NetworkMessageId)) by FileName, FileType, SHA256", "size": 0, "showAnalytics": true, "timeContext": { @@ -1205,7 +1205,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Senders", "timeContext": { @@ -1272,7 +1272,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipients", "timeContext": { @@ -1321,7 +1321,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", + "query": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=tostring(make_set(NetworkMessageId)) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", "size": 0, "title": "Top Url Recipient Domains", "timeContext": { @@ -1418,7 +1418,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=make_set(NetworkMessageId) by Url, UrlDomain", + "query": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=tostring(make_set(NetworkMessageId)) by Url, UrlDomain", "size": 0, "showAnalytics": true, "timeContext": { @@ -1591,7669 +1591,13 @@ "xdrMetadata": { "contentId": "3b0f3eee-3047-526b-aae0-e259182d264d", "instanceId": "e3cfc632-a943-5434-a5f9-471b080254ba", - "version": "3.2.0", + "version": "3.2.1", "schemaVersion": "1.0.0", "displayName": "MicrosoftDefenderForOffice365" }, "contentProvenance": { - "source": { - "path": "Workbooks/MicrosoftDefenderForOffice365.json", - "sha256": "f5a3bf4c9e78da40ecf14db1e2f71fe04c2e3bec9b51cc304f7fbaa3d75b03b6", - "contentId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Microsoft Defender for Office 365", - "originalMetadataVersion": null - }, - "conversion": { - "tool": "sentinel-xdr-migration", - "version": "0.1.0", - "reviewRequired": false, - "queries": [ - { - "sourcePath": "/items/1/content/parameters/1/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "49d6e69eb90170912b1e70a4d8c01d3f19d11b10c46b8a72ba0fda4cfc4a6257", - "targetSha256": null - }, - { - "sourcePath": "/items/4/content/parameters/0/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "7f54b87b3feb094d04d4d4005a9f3aedf53ecfa4fe7a98936125c3634ea3a838" - }, - "conversion": { - "sourceId": "/items/4/content/parameters/0/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| summarize Count=count() by EmailDirection\r\n| sort by Count desc\r\n| project EmailDirection, Label=strcat(EmailDirection, ' - ', Count, ' messages')", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/parameters/0/query", - "sourceSha256": "7f54b87b3feb094d04d4d4005a9f3aedf53ecfa4fe7a98936125c3634ea3a838", - "targetSha256": "7f54b87b3feb094d04d4d4005a9f3aedf53ecfa4fe7a98936125c3634ea3a838" - }, - { - "sourcePath": "/items/4/content/parameters/3/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "401ad405a538f1d6bf18b4ddda22dfb3dc43af22b62126b5b7af8b7f7f1a2a2d" - }, - "conversion": { - "sourceId": "/items/4/content/parameters/3/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| summarize Messages=count() by RecipientDomain\r\n| sort by Messages desc\r\n| project RecipientDomain, strcat(RecipientDomain, ' - ', Messages, ' messages')", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/parameters/3/query", - "sourceSha256": "401ad405a538f1d6bf18b4ddda22dfb3dc43af22b62126b5b7af8b7f7f1a2a2d", - "targetSha256": "401ad405a538f1d6bf18b4ddda22dfb3dc43af22b62126b5b7af8b7f7f1a2a2d" - }, - { - "sourcePath": "/items/4/content/parameters/4/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "20ebec2f05e9277cdeb1fee33107843071509781d6f112850759b947dfd5cf44" - }, - "conversion": { - "sourceId": "/items/4/content/parameters/4/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n//| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| summarize Messages=count() by SenderMailFromDomain\r\n| sort by Messages desc\r\n| project SenderMailFromDomain, strcat(SenderMailFromDomain, ' - ', Messages, ' messages')", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/parameters/4/query", - "sourceSha256": "20ebec2f05e9277cdeb1fee33107843071509781d6f112850759b947dfd5cf44", - "targetSha256": "20ebec2f05e9277cdeb1fee33107843071509781d6f112850759b947dfd5cf44" - }, - { - "sourcePath": "/items/4/content/parameters/6/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "2ccdaa784725b2a65a8f381ed39f1d053eb36879948ab0bc52508acdc47dbfea" - }, - "conversion": { - "sourceId": "/items/4/content/parameters/6/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "range x from 0 to 10 step 1", - "resolvedTables": [], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/parameters/6/query", - "sourceSha256": "2ccdaa784725b2a65a8f381ed39f1d053eb36879948ab0bc52508acdc47dbfea", - "targetSha256": "2ccdaa784725b2a65a8f381ed39f1d053eb36879948ab0bc52508acdc47dbfea" - }, - { - "sourcePath": "/items/4/content/parameters/7/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "e19eb4f4d503984f28cd04aba8a7975c0ff909046d9c3f980c2033c16aaf61d4" - }, - "conversion": { - "sourceId": "/items/4/content/parameters/7/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "range x from 0 to 20 step 1", - "resolvedTables": [], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/parameters/7/query", - "sourceSha256": "e19eb4f4d503984f28cd04aba8a7975c0ff909046d9c3f980c2033c16aaf61d4", - "targetSha256": "e19eb4f4d503984f28cd04aba8a7975c0ff909046d9c3f980c2033c16aaf61d4" - }, - { - "sourcePath": "/items/5/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "5130357556304e1822967ca2d3d4ec9e725c3d77e54dc8433c51bdfbdbfd6fd6" - }, - "conversion": { - "sourceId": "/items/5/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize Count=count() by EmailDirection\r\n| sort by Count desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/0/content/query", - "sourceSha256": "5130357556304e1822967ca2d3d4ec9e725c3d77e54dc8433c51bdfbdbfd6fd6", - "targetSha256": "5130357556304e1822967ca2d3d4ec9e725c3d77e54dc8433c51bdfbdbfd6fd6" - }, - { - "sourcePath": "/items/5/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "30207d66db6f1f6958218ce4c293cc0324c5e6dda7f495f168ac1715af0067d8" - }, - "conversion": { - "sourceId": "/items/5/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize Count=count() by DeliveryAction\r\n| sort by Count desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/1/content/query", - "sourceSha256": "30207d66db6f1f6958218ce4c293cc0324c5e6dda7f495f168ac1715af0067d8", - "targetSha256": "30207d66db6f1f6958218ce4c293cc0324c5e6dda7f495f168ac1715af0067d8" - }, - { - "sourcePath": "/items/5/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "0a650d806076bf2dbdec9b4be3a1fcd8278a60152ae6ad40c8a15ea3d629b295" - }, - "conversion": { - "sourceId": "/items/5/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), EmailDirection", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/2/content/query", - "sourceSha256": "0a650d806076bf2dbdec9b4be3a1fcd8278a60152ae6ad40c8a15ea3d629b295", - "targetSha256": "0a650d806076bf2dbdec9b4be3a1fcd8278a60152ae6ad40c8a15ea3d629b295" - }, - { - "sourcePath": "/items/5/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "e35a12f2504594c80042fde446d6e57f0e2bc4fc01ab67ee5c580cfbbb8cc55e" - }, - "conversion": { - "sourceId": "/items/5/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| sort by DistinctMessages desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/3/content/query", - "sourceSha256": "e35a12f2504594c80042fde446d6e57f0e2bc4fc01ab67ee5c580cfbbb8cc55e", - "targetSha256": "e35a12f2504594c80042fde446d6e57f0e2bc4fc01ab67ee5c580cfbbb8cc55e" - }, - { - "sourcePath": "/items/5/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "9ad60f3b5a2ffc57f40962c092561de44dc08eb8364e5dc0316534b44a1f6238" - }, - "conversion": { - "sourceId": "/items/5/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| sort by DistinctMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/4/content/query", - "sourceSha256": "9ad60f3b5a2ffc57f40962c092561de44dc08eb8364e5dc0316534b44a1f6238", - "targetSha256": "9ad60f3b5a2ffc57f40962c092561de44dc08eb8364e5dc0316534b44a1f6238" - }, - { - "sourcePath": "/items/5/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "5c729d067c07c67e8bb7704a87e5dfc5cbebb83bc1da0cd58bfec01dd895e10b" - }, - "conversion": { - "sourceId": "/items/5/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize DistinctMessages=dcount(InternetMessageId), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| sort by DistinctMessages desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/5/content/query", - "sourceSha256": "5c729d067c07c67e8bb7704a87e5dfc5cbebb83bc1da0cd58bfec01dd895e10b", - "targetSha256": "5c729d067c07c67e8bb7704a87e5dfc5cbebb83bc1da0cd58bfec01dd895e10b" - }, - { - "sourcePath": "/items/5/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "a776ed212051d494eb950e8eff9b94268f8f0ff9b1365edef92edbc2a8fd6f08" - }, - "conversion": { - "sourceId": "/items/5/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailEvents\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| where \"{Direction}\" == \"All\" or EmailDirection == \"{Direction}\"\r\n| where \"{DeliveryAction}\" == \"All\" or DeliveryAction == \"{DeliveryAction}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| project TimeGenerated, SenderMailFromAddress, RecipientEmailAddress, Subject, EmailDirection, EmailLanguage, DeliveryAction, ConfidenceLevel, AttachmentCount, UrlCount, NetworkMessageId", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/6/content/query", - "sourceSha256": "a776ed212051d494eb950e8eff9b94268f8f0ff9b1365edef92edbc2a8fd6f08", - "targetSha256": "a776ed212051d494eb950e8eff9b94268f8f0ff9b1365edef92edbc2a8fd6f08" - }, - { - "sourcePath": "/items/5/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "fe93bf34b6407356389cc1a3c35ec41da425fb9a906d4dcdc10c2b116b35fe2c" - }, - "conversion": { - "sourceId": "/items/5/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailAttachmentInfo\r\n| where NetworkMessageId == \"{NetworkMessageId}\"\r\n| project FileName, FileType, SHA256, ThreatTypes, ThreatNames, DetectionMethods", - "resolvedTables": [ - "EmailAttachmentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailAttachmentInfo", - "ahTable": "EmailAttachmentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/7/content/query", - "sourceSha256": "fe93bf34b6407356389cc1a3c35ec41da425fb9a906d4dcdc10c2b116b35fe2c", - "targetSha256": "fe93bf34b6407356389cc1a3c35ec41da425fb9a906d4dcdc10c2b116b35fe2c" - }, - { - "sourcePath": "/items/5/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "fe68a1c4a3598e9c371edcfd9e64ef444afd0e47ac4f7b6da76d872fd6d2fdcb" - }, - "conversion": { - "sourceId": "/items/5/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailUrlInfo\r\n| where NetworkMessageId == \"{NetworkMessageId}\"\r\n| project Url, UrlDomain", - "resolvedTables": [ - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/8/content/query", - "sourceSha256": "fe68a1c4a3598e9c371edcfd9e64ef444afd0e47ac4f7b6da76d872fd6d2fdcb", - "targetSha256": "fe68a1c4a3598e9c371edcfd9e64ef444afd0e47ac4f7b6da76d872fd6d2fdcb" - }, - { - "sourcePath": "/items/6/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "6478ab01c6c73cabdfa529927c21e777d01a7961dc3b2adab26821c68abd7fc7" - }, - "conversion": { - "sourceId": "/items/6/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/0/content/query", - "sourceSha256": "6478ab01c6c73cabdfa529927c21e777d01a7961dc3b2adab26821c68abd7fc7", - "targetSha256": "6478ab01c6c73cabdfa529927c21e777d01a7961dc3b2adab26821c68abd7fc7" - }, - { - "sourcePath": "/items/6/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "66119dac7b15bc65a3bf460977a6c2fa478018bf109f40b3fb543ba70e5a4067" - }, - "conversion": { - "sourceId": "/items/6/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/1/content/query", - "sourceSha256": "66119dac7b15bc65a3bf460977a6c2fa478018bf109f40b3fb543ba70e5a4067", - "targetSha256": "66119dac7b15bc65a3bf460977a6c2fa478018bf109f40b3fb543ba70e5a4067" - }, - { - "sourcePath": "/items/6/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "199bd5442911b359169912f8ab662b6f5c7715c11496cdf16a747af9639be5c8" - }, - "conversion": { - "sourceId": "/items/6/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalAttachments=sum(AttachmentCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalAttachments > 0\r\n| sort by TotalAttachments desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/2/content/query", - "sourceSha256": "199bd5442911b359169912f8ab662b6f5c7715c11496cdf16a747af9639be5c8", - "targetSha256": "199bd5442911b359169912f8ab662b6f5c7715c11496cdf16a747af9639be5c8" - }, - { - "sourcePath": "/items/6/content/items/3/content/parameters/1/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "3b0adf5e8ce3dfd99b7ccafb5d4f5d39625eceb21ce914ec40709dc880ce137a" - }, - "conversion": { - "sourceId": "/items/6/content/items/3/content/parameters/1/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailAttachmentInfo\r\n| summarize AttachmentCount=count() by FileType\r\n| sort by AttachmentCount desc\r\n| project FileType, strcat(FileType, ' - ', AttachmentCount, ' attachments')", - "resolvedTables": [ - "EmailAttachmentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailAttachmentInfo", - "ahTable": "EmailAttachmentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/3/content/parameters/1/query", - "sourceSha256": "3b0adf5e8ce3dfd99b7ccafb5d4f5d39625eceb21ce914ec40709dc880ce137a", - "targetSha256": "3b0adf5e8ce3dfd99b7ccafb5d4f5d39625eceb21ce914ec40709dc880ce137a" - }, - { - "sourcePath": "/items/6/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "07a7080807951baaa81964b822364a92ba9c760922948e1ff7350e6f5dae1a92" - }, - "conversion": { - "sourceId": "/items/6/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where FileName contains \"{AttachmentName}\"\r\n| where \"*\" in ({AttachmentType}) or FileType in ({AttachmentType})\r\n| summarize UniqueEmailsWithThisAttachment=dcount(NetworkMessageId), NetworkMessageIdWithFile=make_set(NetworkMessageId) by FileName, FileType, SHA256", - "resolvedTables": [ - "EmailAttachmentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailAttachmentInfo", - "ahTable": "EmailAttachmentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/4/content/query", - "sourceSha256": "07a7080807951baaa81964b822364a92ba9c760922948e1ff7350e6f5dae1a92", - "targetSha256": "07a7080807951baaa81964b822364a92ba9c760922948e1ff7350e6f5dae1a92" - }, - { - "sourcePath": "/items/6/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "644af21a178c327b6a22eb97f318c22c1c1d16ee074f12585c12de467f873f17" - }, - "conversion": { - "sourceId": "/items/6/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let ids = dynamic({NetworkMessageIdWithFile});\r\nEmailAttachmentInfo\r\n| where NetworkMessageId in (ids)\r\n| distinct NetworkMessageId\r\n| join kind=leftouter (EmailEvents) on NetworkMessageId\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| project TimeGenerated, SenderMailFromAddress, RecipientEmailAddress, Subject, EmailDirection, EmailLanguage, DeliveryAction, ConfidenceLevel, AttachmentCount, UrlCount, NetworkMessageId", - "resolvedTables": [ - "EmailAttachmentInfo", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailAttachmentInfo", - "ahTable": "EmailAttachmentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/5/content/query", - "sourceSha256": "644af21a178c327b6a22eb97f318c22c1c1d16ee074f12585c12de467f873f17", - "targetSha256": "644af21a178c327b6a22eb97f318c22c1c1d16ee074f12585c12de467f873f17" - }, - { - "sourcePath": "/items/7/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "1798f6d6a52e4cd7ae1eaf2388f4dd7362c9389c98a904cd0b22e896a3b7806e" - }, - "conversion": { - "sourceId": "/items/7/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctRecipients=dcount(RecipientEmailAddress), DistinctRecipientDomains=dcount(RecipientDomain), NetworkMessageIds=make_set(NetworkMessageId) by SenderMailFromAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/0/content/query", - "sourceSha256": "1798f6d6a52e4cd7ae1eaf2388f4dd7362c9389c98a904cd0b22e896a3b7806e", - "targetSha256": "1798f6d6a52e4cd7ae1eaf2388f4dd7362c9389c98a904cd0b22e896a3b7806e" - }, - { - "sourcePath": "/items/7/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "5d15d2cfc9a904b328f1e125aee8a43be22a743880f6639239601fa9d3ad3cdd" - }, - "conversion": { - "sourceId": "/items/7/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientEmailAddress\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/1/content/query", - "sourceSha256": "5d15d2cfc9a904b328f1e125aee8a43be22a743880f6639239601fa9d3ad3cdd", - "targetSha256": "5d15d2cfc9a904b328f1e125aee8a43be22a743880f6639239601fa9d3ad3cdd" - }, - { - "sourcePath": "/items/7/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "053552593226491eb95fad35412acb6c8ad49eda9011d3a596d293286f64c2ce" - }, - "conversion": { - "sourceId": "/items/7/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection in ({EmailDirection})\r\n| where AttachmentCount >= {MinimumAttachmentCount} and UrlCount >= {MinimumURLCount}\r\n| where isempty(\"{Sender}\") or SenderMailFromAddress =~ \"{Sender}\"\r\n| where \"{Sender2}\" == \"All\" or SenderMailFromAddress =~ \"{Sender2}\"\r\n| where isempty(\"{Recipient}\") or RecipientEmailAddress =~ \"{Recipient}\"\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| where \"*\" in ({RecipientDomain}) or RecipientDomain in ({RecipientDomain})\r\n| where \"*\" in ({SenderDomain}) or SenderMailFromDomain in ({SenderDomain})\r\n| where isempty(\"{Subject}\") or Subject contains \"{Subject}\"\r\n| summarize TotalUrls=sum(UrlCount), DistinctSenders=dcount(SenderMailFromAddress), NetworkMessageIds=make_set(NetworkMessageId) by RecipientDomain\r\n| where TotalUrls > 0\r\n| sort by TotalUrls desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/2/content/query", - "sourceSha256": "053552593226491eb95fad35412acb6c8ad49eda9011d3a596d293286f64c2ce", - "targetSha256": "053552593226491eb95fad35412acb6c8ad49eda9011d3a596d293286f64c2ce" - }, - { - "sourcePath": "/items/7/content/items/3/content/parameters/1/query", - "parameter": true, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "bcb564f29d1b232472686d4957887149e202de4237056bede37cd9c6c99d033a" - }, - "conversion": { - "sourceId": "/items/7/content/items/3/content/parameters/1/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailUrlInfo\r\n| summarize UrlCount=count() by UrlDomain\r\n| sort by UrlCount desc\r\n| project UrlDomain, strcat(UrlDomain, ' - ', UrlCount, ' URLs')", - "resolvedTables": [ - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/3/content/parameters/1/query", - "sourceSha256": "bcb564f29d1b232472686d4957887149e202de4237056bede37cd9c6c99d033a", - "targetSha256": "bcb564f29d1b232472686d4957887149e202de4237056bede37cd9c6c99d033a" - }, - { - "sourcePath": "/items/7/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "37fc28a79b04647d27bc2989c9cd6a579f34ae5d51cfe17b7efeb00d3b469b00" - }, - "conversion": { - "sourceId": "/items/7/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let ids = array_concat(dynamic({NetworkMessageIdsSender}),dynamic({NetworkMessageIdsRecipient}),dynamic({NetworkMessageIdsDomain}));\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids) or array_length(ids) == 0\r\n| where Url contains \"{Url}\"\r\n| where \"*\" in ({UrlDomain}) or UrlDomain in ({UrlDomain})\r\n| summarize UniqueMessagesWithUrl=dcount(NetworkMessageId), NetworkMessageIdWithUrl=make_set(NetworkMessageId) by Url, UrlDomain", - "resolvedTables": [ - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/4/content/query", - "sourceSha256": "37fc28a79b04647d27bc2989c9cd6a579f34ae5d51cfe17b7efeb00d3b469b00", - "targetSha256": "37fc28a79b04647d27bc2989c9cd6a579f34ae5d51cfe17b7efeb00d3b469b00" - }, - { - "sourcePath": "/items/7/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "User approval 2026-10-14 against e63e9f85f96128834e2d334990adc0eea1b5e904cf3c7d0e5dc754817653c9b4; all source query hashes unchanged after authorized literal-range fix", - "planSha256": "17829f17e44e7cf201227e0d797d9ab584b39d22523b502a0089ba8f4154fa8d", - "decision": "accept", - "querySha256": "f1f231be6c48d158095ac2c171a67c10401244333c91a1f82803393d33efa9bd" - }, - "conversion": { - "sourceId": "/items/7/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let ids = dynamic({NetworkMessageIdWithUrl});\r\nEmailUrlInfo\r\n| where NetworkMessageId in (ids)\r\n| distinct NetworkMessageId\r\n| join kind=leftouter (EmailEvents) on NetworkMessageId\r\n| extend RecipientDomain = tostring(split(RecipientEmailAddress, \"@\", 1)[0])\r\n| project TimeGenerated, SenderMailFromAddress, RecipientEmailAddress, Subject, EmailDirection, EmailLanguage, DeliveryAction, ConfidenceLevel, AttachmentCount, UrlCount, NetworkMessageId\r\n| sort by TimeGenerated desc", - "resolvedTables": [ - "EmailEvents", - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/5/content/query", - "sourceSha256": "f1f231be6c48d158095ac2c171a67c10401244333c91a1f82803393d33efa9bd", - "targetSha256": "f1f231be6c48d158095ac2c171a67c10401244333c91a1f82803393d33efa9bd" - } - ] - }, + "format": "public-workbook-v1", + "origin": "sentinel-migration", "requiredWorkloads": [ { "workload": "mdo", @@ -9265,6 +1609,6 @@ } ], "requiredDataConnectors": [], - "dependencyReviewRequired": false + "requiredWorkspaceFunctions": [] } } diff --git a/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365DetectionsAndInsights.json b/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365DetectionsAndInsights.json index 329376bf24f..76709ddfbc5 100644 --- a/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365DetectionsAndInsights.json +++ b/Solutions/Microsoft Defender for Office 365/XDR Workbooks/MicrosoftDefenderForOffice365DetectionsAndInsights.json @@ -9170,7 +9170,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -9200,7 +9200,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -13984,7 +13984,7 @@ "style": "decimal" } }, - "tagText": "Quarantine Release Percentage", + "tagText": "Release rate", "valueFontStyle": "mega", "tagTextPosition": "bottom" }, @@ -14645,6 +14645,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "timeContext": { @@ -14895,2487 +14896,13 @@ "xdrMetadata": { "contentId": "55a394cc-f0af-55c1-8ff2-ec483e3e68a3", "instanceId": "0eba4431-9e8b-5ffb-9623-2a0391db7b01", - "version": "3.2.0", + "version": "3.2.1", "schemaVersion": "1.0.0", "displayName": "Microsoft Defender for Office 365 Detections and Insights - ISOC" }, "contentProvenance": { + "format": "public-workbook-v1", "origin": "native-xdr", - "canonicalPayloadSha256": "66e8c70ef1e7a966f64f23e78b1ab842c184f1661b0cab41527b546daa34f59f", - "source": { - "path": "Workbook Sources/Native/MicrosoftDefenderForOffice365DetectionsAndInsights.json", - "sha256": "7985b58b9c0f12ca79dd7d7ca33a197243c23953508bf81638082ff3a2663b6b" - }, - "nativeReview": { - "origin": "native-xdr", - "canonicalPayloadSha256": "66e8c70ef1e7a966f64f23e78b1ab842c184f1661b0cab41527b546daa34f59f", - "source": { - "path": "Workbook Sources/Native/MicrosoftDefenderForOffice365DetectionsAndInsights.json", - "sha256": "7985b58b9c0f12ca79dd7d7ca33a197243c23953508bf81638082ff3a2663b6b" - }, - "displayName": "Microsoft Defender for Office 365 Detections and Insights - ISOC", - "actor": "kingwil", - "reference": "Explicit user approval of all 237 source-bound query hashes and MDO/MDA/MTP prerequisites in this session on 2026-10-15. Native upstream Defender workbook; 14 tabs and six Sentinel-only notices retained. Offline review only.", - "requiredWorkloads": [ - { - "workload": "mda", - "dataTypes": [ - "CloudAppEvents" - ] - }, - { - "workload": "mdo", - "dataTypes": [ - "EmailEvents", - "EmailPostDeliveryEvents", - "EmailUrlInfo", - "FileMaliciousContentInfo", - "MessageEvents", - "MessagePostDeliveryEvents", - "MessageUrlInfo", - "UrlClickEvents" - ] - }, - { - "workload": "mtp", - "dataTypes": [ - "AlertEvidence" - ] - } - ], - "requiredDataConnectors": [], - "queries": [ - { - "path": "/items/3/content/items/0/content/items/1/content/items/0/content/query", - "querySha256": "a20e6049790672c279964f006cf8f6b26f5264ec2543c185fc927d68bc008b32", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/0/content/items/1/content/items/0/content/query SHA256 a20e6049790672c279964f006cf8f6b26f5264ec2543c185fc927d68bc008b32; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/0/content/items/1/content/items/1/content/query", - "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/0/content/items/1/content/items/1/content/query SHA256 b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/0/content/items/2/content/items/1/content/query", - "querySha256": "d524bd647ff40942d49725aea7dbbe3a599f9527e2d478e7ffada042ef173893", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/0/content/items/2/content/items/1/content/query SHA256 d524bd647ff40942d49725aea7dbbe3a599f9527e2d478e7ffada042ef173893; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/0/content/items/3/content/items/1/content/query", - "querySha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/0/content/items/3/content/items/1/content/query SHA256 85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/2/content/query", - "querySha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/2/content/query SHA256 54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query", - "querySha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query SHA256 5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query", - "querySha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query SHA256 11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query", - "querySha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query SHA256 28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query", - "querySha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query SHA256 317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query", - "querySha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query SHA256 2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query", - "querySha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query SHA256 6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query", - "querySha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query SHA256 0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query", - "querySha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query SHA256 07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query", - "querySha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query SHA256 e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query", - "querySha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query SHA256 bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query", - "querySha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query SHA256 a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query", - "querySha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query SHA256 ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query", - "querySha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query SHA256 7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/5/content/query", - "querySha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/5/content/query SHA256 29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/7/content/query", - "querySha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/7/content/query SHA256 5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/1/content/items/9/content/query", - "querySha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/1/content/items/9/content/query SHA256 134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/2/content/items/1/content/query", - "querySha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132", - "tables": [ - "CloudAppEvents", - "FileMaliciousContentInfo", - "MessageEvents", - "MessageUrlInfo", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/2/content/items/1/content/query SHA256 554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132; complete discovered native inputs: CloudAppEvents, FileMaliciousContentInfo, MessageEvents, MessageUrlInfo, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/3/content/items/4/content/items/1/content/query", - "querySha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8", - "tables": [], - "decision": "accept", - "evidence": "User approved exact query /items/3/content/items/4/content/items/1/content/query SHA256 a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8; complete discovered native inputs: source-free literal. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/5/content/query", - "querySha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/5/content/query SHA256 1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/6/content/items/2/content/query", - "querySha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/6/content/items/2/content/query SHA256 a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/6/content/items/4/content/query", - "querySha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/6/content/items/4/content/query SHA256 16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/6/content/items/8/content/query", - "querySha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/6/content/items/8/content/query SHA256 ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/6/content/items/9/content/query", - "querySha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/6/content/items/9/content/query SHA256 81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/6/content/items/10/content/query", - "querySha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/6/content/items/10/content/query SHA256 d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/7/content/items/2/content/query", - "querySha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/7/content/items/2/content/query SHA256 a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/7/content/items/4/content/query", - "querySha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/7/content/items/4/content/query SHA256 ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/7/content/items/5/content/query", - "querySha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/7/content/items/5/content/query SHA256 f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/7/content/items/7/content/query", - "querySha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/7/content/items/7/content/query SHA256 de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/7/content/items/8/content/query", - "querySha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/7/content/items/8/content/query SHA256 248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/8/content/items/2/content/query", - "querySha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/8/content/items/2/content/query SHA256 02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/8/content/items/4/content/query", - "querySha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/8/content/items/4/content/query SHA256 26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/10/content/query", - "querySha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/10/content/query SHA256 fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/11/content/items/2/content/query", - "querySha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/11/content/items/2/content/query SHA256 22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/11/content/items/4/content/query", - "querySha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/11/content/items/4/content/query SHA256 e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/11/content/items/7/content/query", - "querySha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/11/content/items/7/content/query SHA256 3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/11/content/items/8/content/query", - "querySha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/11/content/items/8/content/query SHA256 8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/11/content/items/10/content/query", - "querySha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/11/content/items/10/content/query SHA256 05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/12/content/items/2/content/query", - "querySha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/12/content/items/2/content/query SHA256 a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/12/content/items/4/content/query", - "querySha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/12/content/items/4/content/query SHA256 9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/12/content/items/5/content/query", - "querySha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/12/content/items/5/content/query SHA256 183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/12/content/items/7/content/query", - "querySha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/12/content/items/7/content/query SHA256 6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/12/content/items/8/content/query", - "querySha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/12/content/items/8/content/query SHA256 e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/13/content/items/2/content/query", - "querySha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/13/content/items/2/content/query SHA256 0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/13/content/items/4/content/query", - "querySha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/13/content/items/4/content/query SHA256 d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/15/content/query", - "querySha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/15/content/query SHA256 6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/16/content/items/1/content/items/0/content/query", - "querySha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/16/content/items/1/content/items/0/content/query SHA256 a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/16/content/items/1/content/items/1/content/query", - "querySha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf", - "tables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/16/content/items/1/content/items/1/content/query SHA256 238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf; complete discovered native inputs: CloudAppEvents, EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/16/content/items/3/content/query", - "querySha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/16/content/items/3/content/query SHA256 fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/2/content/query", - "querySha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/2/content/query SHA256 c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/4/content/query", - "querySha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/4/content/query SHA256 01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/5/content/query", - "querySha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/5/content/query SHA256 084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/7/content/query", - "querySha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/7/content/query SHA256 a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/8/content/query", - "querySha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/8/content/query SHA256 abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/10/content/query", - "querySha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/10/content/query SHA256 8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/17/content/items/11/content/query", - "querySha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/17/content/items/11/content/query SHA256 51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/18/content/items/2/content/query", - "querySha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/18/content/items/2/content/query SHA256 78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/18/content/items/4/content/query", - "querySha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/18/content/items/4/content/query SHA256 bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/20/content/query", - "querySha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/20/content/query SHA256 c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/2/content/query", - "querySha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/2/content/query SHA256 19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/4/content/query", - "querySha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/4/content/query SHA256 0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/5/content/query", - "querySha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/5/content/query SHA256 222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/7/content/query", - "querySha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/7/content/query SHA256 7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/8/content/query", - "querySha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/8/content/query SHA256 5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/10/content/query", - "querySha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/10/content/query SHA256 83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/12/content/query", - "querySha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/12/content/query SHA256 37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/13/content/query", - "querySha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/13/content/query SHA256 4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/15/content/query", - "querySha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/15/content/query SHA256 6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/16/content/query", - "querySha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/16/content/query SHA256 c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/18/content/query", - "querySha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/18/content/query SHA256 8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/21/content/items/20/content/query", - "querySha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/21/content/items/20/content/query SHA256 c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/2/content/query", - "querySha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/2/content/query SHA256 58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/3/content/query", - "querySha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/3/content/query SHA256 a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/4/content/query", - "querySha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/4/content/query SHA256 41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/5/content/query", - "querySha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/5/content/query SHA256 ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/7/content/query", - "querySha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/7/content/query SHA256 c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/9/content/query", - "querySha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/9/content/query SHA256 47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/22/content/items/11/content/query", - "querySha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/22/content/items/11/content/query SHA256 7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/23/content/items/2/content/query", - "querySha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/23/content/items/2/content/query SHA256 c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/23/content/items/4/content/query", - "querySha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/23/content/items/4/content/query SHA256 3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/25/content/query", - "querySha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714", - "tables": [ - "EmailUrlInfo", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/25/content/query SHA256 b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714; complete discovered native inputs: EmailUrlInfo, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/26/content/items/2/content/query", - "querySha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/26/content/items/2/content/query SHA256 9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/26/content/items/4/content/query", - "querySha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/26/content/items/4/content/query SHA256 c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/26/content/items/7/content/query", - "querySha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071", - "tables": [ - "EmailEvents", - "EmailUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/26/content/items/7/content/query SHA256 136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071; complete discovered native inputs: EmailEvents, EmailUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/26/content/items/8/content/query", - "querySha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169", - "tables": [ - "EmailUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/26/content/items/8/content/query SHA256 3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169; complete discovered native inputs: EmailUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/2/content/query", - "querySha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77", - "tables": [ - "EmailEvents", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/2/content/query SHA256 de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77; complete discovered native inputs: EmailEvents, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/3/content/query", - "querySha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/3/content/query SHA256 d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/6/content/query", - "querySha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197", - "tables": [ - "EmailEvents", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/6/content/query SHA256 744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197; complete discovered native inputs: EmailEvents, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/7/content/query", - "querySha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/7/content/query SHA256 8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/10/content/query", - "querySha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d", - "tables": [ - "EmailEvents", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/10/content/query SHA256 eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d; complete discovered native inputs: EmailEvents, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/11/content/query", - "querySha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/11/content/query SHA256 0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/27/content/items/13/content/query", - "querySha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/27/content/items/13/content/query SHA256 38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/28/content/items/2/content/query", - "querySha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/28/content/items/2/content/query SHA256 db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/28/content/items/4/content/query", - "querySha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/28/content/items/4/content/query SHA256 07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/28/content/items/6/content/query", - "querySha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/28/content/items/6/content/query SHA256 ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/30/content/query", - "querySha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf", - "tables": [ - "MessageEvents", - "MessagePostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/30/content/query SHA256 7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf; complete discovered native inputs: MessageEvents, MessagePostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/31/content/items/2/content/query", - "querySha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/31/content/items/2/content/query SHA256 addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/31/content/items/5/content/query", - "querySha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/31/content/items/5/content/query SHA256 115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/31/content/items/6/content/query", - "querySha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/31/content/items/6/content/query SHA256 0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/32/content/items/1/content/query", - "querySha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/32/content/items/1/content/query SHA256 01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/32/content/items/3/content/query", - "querySha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/32/content/items/3/content/query SHA256 45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/32/content/items/5/content/query", - "querySha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/32/content/items/5/content/query SHA256 f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/32/content/items/7/content/query", - "querySha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/32/content/items/7/content/query SHA256 adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/1/content/query", - "querySha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/1/content/query SHA256 f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/3/content/query", - "querySha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/3/content/query SHA256 e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/5/content/query", - "querySha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/5/content/query SHA256 da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/7/content/query", - "querySha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/7/content/query SHA256 4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/9/content/query", - "querySha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/9/content/query SHA256 661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/11/content/query", - "querySha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/11/content/query SHA256 9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/13/content/query", - "querySha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/13/content/query SHA256 200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/33/content/items/15/content/query", - "querySha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3", - "tables": [ - "CloudAppEvents", - "MessageEvents", - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/33/content/items/15/content/query SHA256 987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3; complete discovered native inputs: CloudAppEvents, MessageEvents, MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/34/content/items/1/content/query", - "querySha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a", - "tables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/34/content/items/1/content/query SHA256 de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a; complete discovered native inputs: MessageEvents, MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/34/content/items/4/content/query", - "querySha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/34/content/items/4/content/query SHA256 c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/34/content/items/5/content/query", - "querySha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4", - "tables": [ - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/34/content/items/5/content/query SHA256 6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4; complete discovered native inputs: UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/34/content/items/7/content/query", - "querySha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a", - "tables": [ - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/34/content/items/7/content/query SHA256 36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a; complete discovered native inputs: MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/2/content/query", - "querySha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/2/content/query SHA256 62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/5/content/query", - "querySha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/5/content/query SHA256 dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/6/content/query", - "querySha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef", - "tables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/6/content/query SHA256 d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef; complete discovered native inputs: MessageEvents, MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/8/content/query", - "querySha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/8/content/query SHA256 95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/10/content/query", - "querySha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f", - "tables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/10/content/query SHA256 a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f; complete discovered native inputs: MessageEvents, MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/12/content/query", - "querySha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a", - "tables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/12/content/query SHA256 f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a; complete discovered native inputs: MessageEvents, MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/35/content/items/14/content/query", - "querySha256": "60927037752038d2fd6d87c837a755835d795e4167f2d549413e0ea05e8bcb21", - "tables": [ - "MessageUrlInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/35/content/items/14/content/query SHA256 60927037752038d2fd6d87c837a755835d795e4167f2d549413e0ea05e8bcb21; complete discovered native inputs: MessageUrlInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/36/content/items/1/content/query", - "querySha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/36/content/items/1/content/query SHA256 4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/36/content/items/3/content/query", - "querySha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/36/content/items/3/content/query SHA256 dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/37/content/items/1/content/query", - "querySha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004", - "tables": [ - "MessagePostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/37/content/items/1/content/query SHA256 d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004; complete discovered native inputs: MessagePostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/37/content/items/4/content/query", - "querySha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0", - "tables": [ - "MessagePostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/37/content/items/4/content/query SHA256 b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0; complete discovered native inputs: MessagePostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/37/content/items/5/content/query", - "querySha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51", - "tables": [ - "MessagePostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/37/content/items/5/content/query SHA256 6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51; complete discovered native inputs: MessagePostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/37/content/items/7/content/query", - "querySha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7", - "tables": [ - "MessagePostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/37/content/items/7/content/query SHA256 5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7; complete discovered native inputs: MessagePostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/1/content/query", - "querySha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/1/content/query SHA256 74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/4/content/query", - "querySha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/4/content/query SHA256 6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/5/content/query", - "querySha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/5/content/query SHA256 d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/8/content/query", - "querySha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/8/content/query SHA256 20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/9/content/query", - "querySha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/9/content/query SHA256 0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/12/content/query", - "querySha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/12/content/query SHA256 04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/13/content/query", - "querySha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/13/content/query SHA256 d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/16/content/query", - "querySha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/16/content/query SHA256 2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/38/content/items/17/content/query", - "querySha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/38/content/items/17/content/query SHA256 97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/39/content/items/2/content/query", - "querySha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/39/content/items/2/content/query SHA256 0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/39/content/items/4/content/query", - "querySha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333", - "tables": [ - "MessageEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/39/content/items/4/content/query SHA256 4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333; complete discovered native inputs: MessageEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/41/content/items/2/content/query", - "querySha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/41/content/items/2/content/query SHA256 9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/41/content/items/4/content/query", - "querySha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/41/content/items/4/content/query SHA256 ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/41/content/items/6/content/query", - "querySha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/41/content/items/6/content/query SHA256 fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/3/content/query", - "querySha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/3/content/query SHA256 5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/4/content/query", - "querySha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/4/content/query SHA256 7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/6/content/query", - "querySha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/6/content/query SHA256 17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/9/content/query", - "querySha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/9/content/query SHA256 0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/10/content/query", - "querySha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/10/content/query SHA256 63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/12/content/query", - "querySha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/12/content/query SHA256 7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/15/content/query", - "querySha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/15/content/query SHA256 f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/42/content/items/16/content/query", - "querySha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/42/content/items/16/content/query SHA256 4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/44/content/items/2/content/query", - "querySha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/44/content/items/2/content/query SHA256 98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/44/content/items/5/content/query", - "querySha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/44/content/items/5/content/query SHA256 08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/44/content/items/6/content/query", - "querySha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/44/content/items/6/content/query SHA256 479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/44/content/items/8/content/query", - "querySha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/44/content/items/8/content/query SHA256 605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/44/content/items/9/content/query", - "querySha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/44/content/items/9/content/query SHA256 fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/45/content/items/2/content/query", - "querySha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/45/content/items/2/content/query SHA256 0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/45/content/items/5/content/query", - "querySha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/45/content/items/5/content/query SHA256 01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/45/content/items/6/content/query", - "querySha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/45/content/items/6/content/query SHA256 5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/46/content/items/2/content/query", - "querySha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/46/content/items/2/content/query SHA256 8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/46/content/items/5/content/query", - "querySha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/46/content/items/5/content/query SHA256 634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/46/content/items/6/content/query", - "querySha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/46/content/items/6/content/query SHA256 39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/47/content/items/2/content/query", - "querySha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/47/content/items/2/content/query SHA256 98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/47/content/items/5/content/query", - "querySha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/47/content/items/5/content/query SHA256 038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/47/content/items/6/content/query", - "querySha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/47/content/items/6/content/query SHA256 11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/48/content/items/1/content/query", - "querySha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/48/content/items/1/content/query SHA256 dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/48/content/items/2/content/query", - "querySha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/48/content/items/2/content/query SHA256 cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/2/content/query", - "querySha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/2/content/query SHA256 6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/5/content/query", - "querySha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/5/content/query SHA256 07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/6/content/query", - "querySha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/6/content/query SHA256 ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/9/content/query", - "querySha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/9/content/query SHA256 c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/10/content/query", - "querySha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/10/content/query SHA256 d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/12/content/query", - "querySha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/12/content/query SHA256 1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/50/content/items/14/content/query", - "querySha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/50/content/items/14/content/query SHA256 747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/2/content/query", - "querySha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/2/content/query SHA256 190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/5/content/query", - "querySha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/5/content/query SHA256 4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/6/content/query", - "querySha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/6/content/query SHA256 bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/8/content/query", - "querySha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/8/content/query SHA256 17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/9/content/query", - "querySha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/9/content/query SHA256 87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/12/content/query", - "querySha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/12/content/query SHA256 7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/13/content/query", - "querySha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/13/content/query SHA256 0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/15/content/query", - "querySha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/15/content/query SHA256 2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/17/content/query", - "querySha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/17/content/query SHA256 5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/19/content/query", - "querySha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/19/content/query SHA256 4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/21/content/query", - "querySha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/21/content/query SHA256 076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/23/content/query", - "querySha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/23/content/query SHA256 a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/25/content/query", - "querySha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/25/content/query SHA256 dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/27/content/query", - "querySha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/27/content/query SHA256 ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/51/content/items/29/content/query", - "querySha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/51/content/items/29/content/query SHA256 2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/2/content/query", - "querySha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/2/content/query SHA256 1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/3/content/query", - "querySha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/3/content/query SHA256 84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/6/content/query", - "querySha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/6/content/query SHA256 a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/7/content/query", - "querySha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/7/content/query SHA256 e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/9/content/query", - "querySha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/9/content/query SHA256 4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/11/content/query", - "querySha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/11/content/query SHA256 942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/13/content/query", - "querySha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/13/content/query SHA256 e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/16/content/query", - "querySha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/16/content/query SHA256 cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/53/content/items/17/content/query", - "querySha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/53/content/items/17/content/query SHA256 5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/2/content/query", - "querySha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/2/content/query SHA256 67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/5/content/query", - "querySha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/5/content/query SHA256 8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/6/content/query", - "querySha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56", - "tables": [ - "CloudAppEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/6/content/query SHA256 06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56; complete discovered native inputs: CloudAppEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/8/content/query", - "querySha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/8/content/query SHA256 74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/10/content/query", - "querySha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/10/content/query SHA256 0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/12/content/query", - "querySha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/12/content/query SHA256 3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/14/content/query", - "querySha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/14/content/query SHA256 01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/16/content/query", - "querySha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/16/content/query SHA256 dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/18/content/query", - "querySha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/18/content/query SHA256 e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/54/content/items/20/content/query", - "querySha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2", - "tables": [ - "CloudAppEvents", - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/54/content/items/20/content/query SHA256 574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2; complete discovered native inputs: CloudAppEvents, EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/56/content/query", - "querySha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/56/content/query SHA256 ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/2/content/query", - "querySha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/2/content/query SHA256 3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/4/content/query", - "querySha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/4/content/query SHA256 87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/6/content/query", - "querySha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/6/content/query SHA256 9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/9/content/query", - "querySha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/9/content/query SHA256 83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/10/content/query", - "querySha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/10/content/query SHA256 ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/57/content/items/12/content/query", - "querySha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8", - "tables": [ - "FileMaliciousContentInfo" - ], - "decision": "accept", - "evidence": "User approved exact query /items/57/content/items/12/content/query SHA256 c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8; complete discovered native inputs: FileMaliciousContentInfo. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/59/content/items/3/content/query", - "querySha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/59/content/items/3/content/query SHA256 edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/59/content/items/4/content/query", - "querySha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/59/content/items/4/content/query SHA256 81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/59/content/items/6/content/query", - "querySha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/59/content/items/6/content/query SHA256 b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/2/content/query", - "querySha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/2/content/query SHA256 f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/5/content/query", - "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/5/content/query SHA256 b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/6/content/query", - "querySha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/6/content/query SHA256 3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/8/content/query", - "querySha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/8/content/query SHA256 613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/9/content/query", - "querySha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/9/content/query SHA256 f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/11/content/query", - "querySha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/11/content/query SHA256 25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/12/content/query", - "querySha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/12/content/query SHA256 d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/14/content/query", - "querySha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/14/content/query SHA256 b16218774694e423515732434466775a515223c7db107d015853617ad6951203; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/60/content/items/15/content/query", - "querySha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc", - "tables": [ - "EmailEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/60/content/items/15/content/query SHA256 c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc; complete discovered native inputs: EmailEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/63/content/items/2/content/query", - "querySha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/63/content/items/2/content/query SHA256 db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/63/content/items/4/content/query", - "querySha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/63/content/items/4/content/query SHA256 ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/63/content/items/7/content/query", - "querySha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd", - "tables": [ - "AlertEvidence", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/63/content/items/7/content/query SHA256 5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd; complete discovered native inputs: AlertEvidence, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/63/content/items/8/content/query", - "querySha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0", - "tables": [ - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/63/content/items/8/content/query SHA256 0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0; complete discovered native inputs: EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/63/content/items/9/content/items/1/content/query", - "querySha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c", - "tables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/63/content/items/9/content/items/1/content/query SHA256 914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c; complete discovered native inputs: EmailEvents, EmailPostDeliveryEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/64/content/items/1/content/query", - "querySha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7", - "tables": [ - "EmailEvents", - "EmailUrlInfo", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/64/content/items/1/content/query SHA256 aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7; complete discovered native inputs: EmailEvents, EmailUrlInfo, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - }, - { - "path": "/items/64/content/items/3/content/query", - "querySha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070", - "tables": [ - "EmailEvents", - "EmailUrlInfo", - "UrlClickEvents" - ], - "decision": "accept", - "evidence": "User approved exact query /items/64/content/items/3/content/query SHA256 0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070; complete discovered native inputs: EmailEvents, EmailUrlInfo, UrlClickEvents. Preserve existing Advanced Hunting KQL; no Sentinel connector or workspace function prerequisite. Runtime visibility and parity not verified.", - "blockers": [] - } - ] - }, "requiredWorkloads": [ { "workload": "mda", @@ -17404,6 +14931,6 @@ } ], "requiredDataConnectors": [], - "dependencyReviewRequired": false + "requiredWorkspaceFunctions": [] } }