[v-krishnachi (v-krishnachi)]

Fixes: N/A (no linked issue)

Proposed Changes

• Preserve all existing CCF event fields and event identifiers in the OneLogin parser output.
• Prevent user-enrichment joins from multiplying events by selecting one user snapshot per ID using ingestion time; normalize legacy numeric identifiers, GUID strings, and timestamps while retaining TimeGenerated.
• Update parser version to 1.0.2 and solution version to 3.0.5, regenerate the solution template and ZIP, and update the release notes.

Reason for Changes

The parser projected away fields already ingested by the connector, returned empty event identifiers, and joined each event to every matching user record. User-table TimeGenerated is account creation time, so it is not suitable for selecting the most recently observed profile.

Ingestion timestamps are approximate. Freshness depends on ingestion-time metadata being available; records ingested in the same batch can tie.

Testing Completed

• Build and validation command:

  $root = Join-Path $env:LOCALAPPDATA 'Programs\SentinelBuildPrerequisites'
  $env:PATH = (Join-Path $root 'PowerShell-7.6.9') + ';' + (Join-Path $root 'node-v22.23.4-win-x64') + ';' + $env:PATH
  & (Join-Path $root 'PowerShell-7.6.9\pwsh.exe') -NoProfile -File .script\local-validation\build-and-validate.ps1 -SolutionName 'OneLoginIAM' -VersionBump patch -ReleaseNotes 'Fixed **Parser** field mappings and user enrichment.'

  PASSED: regenerated 3.0.5 from the original 3.0.4 baseline; 12 validators passed, 0 failed, and 10 were skipped. ARM-TTK reported 50 passing checks.

• git diff --check — PASSED.

• Verified that both embedded parser queries match the current YAML and that both ZIP entries match the generated templates — PASSED.

• KQL, detection-schema, and non-ASCII .NET validators were not run because the .NET SDK is unavailable.

[Copilot]

🔵 Needs a closer look

The revised KQL has not been compiled or run in Log Analytics, leaving union-schema compatibility, one-row-per-event output, and ingestion-time-based latest-profile selection unverified.

No open issues 🎉

What changed in this PR

This PR updates the OneLoginIAM parser to preserve ingested event fields and identifiers, prevent duplicate events during user enrichment, and normalize legacy data types.

Changes:

• Retains additional event fields and TimeGenerated, and populates event identifiers.
• Selects one user snapshot per ID using ingestion time and normalizes legacy identifiers and timestamps.
• Bumps the parser to 1.0.2 and solution to 3.0.5, with corresponding release notes.

File	Description
Solutions/​OneLoginIAM/​ReleaseNotes.md	Documents the parser fixes in release 3.0.5.
Solutions/​OneLoginIAM/​Parsers/​OneLogin.yaml	Expands field mappings, deduplicates user enrichment, and normalizes legacy values.
Solutions/​OneLoginIAM/​Data/​Solution_OneLoginIAM.json	Updates the solution version to 3.0.5.

_{Review effort: Balanced}

[v-skharode]

Hi v-krishnachi (@v-krishnachi)
Thanks, the screenshots show a successful deployment and populated parser fields. Could you clarify the live-test status and provide evidence for event deduplication and latest-user selection? The deployment screenshot doesn’t identify OneLoginIAM 3.0.5.

[v-krishnachi (v-krishnachi)]

Hi v-krishnachi (@v-krishnachi)

Thanks, the screenshots show a successful deployment and populated parser fields. Could you clarify the live-test status and provide evidence for event deduplication and latest-user selection? The deployment screenshot doesn’t identify OneLoginIAM 3.0.5.

Screenshot has Connected state and 3.0.5.
If you observe parser query it will have logic for latest record will be joined (unify) to prevent the deduction