Update data connectors and workbooks

[nlepagnez]

Change(s):

• Updating Data Connector to correct errors on "LastReceived" values and IsConnected values
• Updating the 2 workbooks to include new information and a comparison
• Adding 2 new workbooks to analyze OfficeActivityLogs
• Adding Parsers to support the new and updated workbooks.

Reason for Change(s):

• Bug correction and enhancements

Version Updated:

• Workbooks version updated
• Dataconnector versions updated
• Solution Version updated

[nlepagnez]

Hi,
I don't understand why my "Azure Deploy" JSON file is processed as a Workbook file and 3 tests crash because of that. I didn't find any file to add my deploy ARM Template to ignore.

Also, for the KQLValidation file, I have 2 errors that I don't understand :

• An error on the SecurityEvents table that is not known. It's a standard table, why ?
• An error on a column "TargetObject" that is created by an extend command and passed to a function T(*). It's a good query. Why the KQL Validation doesn't accept that ?

[v-prasadboke]

Hello @nlepagnez, Thanks for raising this PR.
I see you have some concerns about KQL validation errors.

I'll investigate the errors and get back to you by 06 March, 2024

[v-prasadboke]

Hello @nlepagnez, Try adding TargetObject to watchlist EchangeOnline.
And as for SecurityEvents I'll try updating this branch from master if that solves it, its good.
Else we can add this connector id to skipvalidation

Also please try resolve workbooks error

[nlepagnez]

Hello @nlepagnez, Try adding TargetObject to watchlist EchangeOnline. And as for SecurityEvents I'll try updating this branch from master if that solves it, its good. Else we can add this connector id to skipvalidation

Also please try resolve workbooks error

Hi @v-prasadboke, thank you for this update.

Concerning Workbook error, it's concerning the "azuredeploy_ESI_ExchangeOnlineCollector_Automation.json" file, the error is corrected.

[nlepagnez]

Hello @nlepagnez, Try adding TargetObject to watchlist EchangeOnline. And as for SecurityEvents I'll try updating this branch from master if that solves it, its good. Else we can add this connector id to skipvalidation

Also please try resolve workbooks error

Also , for the TargetObject Attribute, I'm not sure to understand what you ask to do. Do you want I add a column "targetObject" in the watchlist "ExchOnlineVIP" ? If it's that, this will add a column not understandable on a customer point of view and I have a doubt on how this will resolve the problem as the "TargetObject" attribute is on the Left part of the join but the watchlist is on the right part of the join.

[v-prasadboke]

Hello @nlepagnez, Try adding TargetObject to watchlist EchangeOnline. And as for SecurityEvents I'll try updating this branch from master if that solves it, its good. Else we can add this connector id to skipvalidation
Also please try resolve workbooks error

Also , for the TargetObject Attribute, I'm not sure to understand what you ask to do. Do you want I add a column "targetObject" in the watchlist "ExchOnlineVIP" ? If it's that, this will add a column not understandable on a customer point of view and I have a doubt on how this will resolve the problem as the "TargetObject" attribute is on the Left part of the join but the watchlist is on the right part of the join.

Looking in it

[v-prasadboke]

Hello @nlepagnez, Try adding TargetObject to watchlist EchangeOnline. And as for SecurityEvents I'll try updating this branch from master if that solves it, its good. Else we can add this connector id to skipvalidation
Also please try resolve workbooks error

Also , for the TargetObject Attribute, I'm not sure to understand what you ask to do. Do you want I add a column "targetObject" in the watchlist "ExchOnlineVIP" ? If it's that, this will add a column not understandable on a customer point of view and I have a doubt on how this will resolve the problem as the "TargetObject" attribute is on the Left part of the join but the watchlist is on the right part of the join.

Pardon me if I'm wrong, Nicolas but I believe the watchlist is on the left side.
let SearchUserDisplayName = T | join Watchlist on $left.TargetObject == $right.DisplayName | project TargetObject,SearchKey;

[nlepagnez]

Pardon me if I'm wrong, Nicolas but I believe the watchlist is on the left side.
let SearchUserDisplayName = T | join Watchlist on $left.TargetObject == $right.DisplayName | project TargetObject,SearchKey;

Hi @v-prasadboke, sorry to insist but if I decompose the query :

• T | join Watchlist => T is on the left, Watchlist is on the right
• This is confirmed by this [documentation] (https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/join-operator?pivots=azuredataexplorer#syntax)
• on $left.TargetObject == $right.DisplayName => We use "TargetObject" property in "T" and "DisplayName" in "Watchlist

So, TargetObject is used in T table that is the parameter of the function.
If I add TargetObject in the Watchlist :

• This doesn't resolve the problem
• This completly brake the user experience as he will see a TargetObject column to fill in the watchlist that is linked to nothing

Am I wrong on my analysis ?

[v-prasadboke]

Hello @nlepagnez,
Got it. Understood the query.
We can move it to skipvalidation.
Until then can you please try to resolve branch conflicts.

Thanks.

[nlepagnez]

Hello @nlepagnez, Got it. Understood the query. We can move it to skipvalidation. Until then can you please try to resolve branch conflicts.

Thanks.

Hi @v-prasadboke , I'm not able to solve conflicts as it requires write access that I don't have. How can I do that ?

[v-prasadboke]

Hello @nlepagnez,
2 days ago I was facing the same issue while trying to push some commits. I had write access to the authors branch as I was in the contributor's list.
Maybe try after sometime.

[nlepagnez]

Hello @nlepagnez, 2 days ago I was facing the same issue while trying to push some commits. I had write access to the authors branch as I was in the contributor's list. Maybe try after sometime.

Hi @v-prasadboke, I confirm that today also, afetr few days, I'm not able to resolve the conflict, no permission to do that.

[v-prasadboke]

Maybe you can close this PR and raise a new one. I could have resolve the branch conflicts but you have made changes to data connector and it has conflicts.
Resolving that conflicts from my end can lead to unrequired things.

[nlepagnez]

I do that.