[Remco Hofman (SpeedyFireCyclone)]

Change(s):

• TargetProcessName (Defender for IoT): The TargetProcessName is now guaranteed to be a string in both branches of the coalesce where it is assigned.
• AdditionalFields (Microsoft 365 Defender): DeviceProcessEvents stores it as a string, so it's now being converted to a dynamic as intended.
• RuleNumber (Native): ASimProcessEventLogs stores it as a string where the schema declares it an integer.
• Removed unreferenced Defender for IoT parser that was superseded.
• Fix missing actorusername_has filter in Defender parser.

Reason for Change(s):

• Mismatched typing in parsers causes columns to gain type suffixes (i.e. _dynamic, _string), causing failures in analytics rules and workbooks with certain log source combinations.
• Stricter validations do not allow unreferenced parsers or missing filter options to pass.

Version Updated:

• Yes

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, .json, or .csv files. Reject any executable scripts (.ps1, .py, .sh, .exe, etc.).
   ⚠️ CRITICAL: Review KQL and CSV content for abuse:
   • Read the ParserQuery KQL for unauthorized data access/manipulation and reject cross-workspace/cluster references (e.g. workspace(...), cluster(...), externaldata)
   • Inspect the sample-data CSV Type column for path-traversal-shaped or non-allowlisted table names (must match the builtin allowlist or a _CL suffix)
   • Examine sample-data CSVs for injection attempts or sensitive data disclosure
   • Check that queries are read-only and target only the fixed test/canary workspace
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2026-10-27T13:04:02.576Z
Learn more: GitHub Security Lab - Preventing PWN Requests