Merge remote-tracking branch 'upstream/master' into whisper-solution-v3.0.24

# Conflicts:
#	Workbooks/WorkbooksMetadata.json

Author: elakkuvan-r

.script/tests/KqlvalidationsTests/CustomFunctions/_Im_AuditEvent.json

@@ -206,7 +206,7 @@
     },
     {
       "Name": "TargetProcessIsHidden",
-      "Type": "SByte"
+      "Type": "Boolean"
     },
     {
       "Name": "TargetProcessInjectedAddress",
@@ -302,7 +302,7 @@
     },
     {
       "Name": "ActingProcessIsHidden",
-      "Type": "SByte"
+      "Type": "Boolean"
     },
     {
       "Name": "ActingProcessInjectedAddress",
@@ -366,7 +366,7 @@
     },
     {
       "Name": "ParentProcessIsHidden",
-      "Type": "SByte"
+      "Type": "Boolean"
     },
     {
       "Name": "ParentProcessInjectedAddress",
@@ -427,6 +427,254 @@
     {
       "Name": "Hash",
       "Type": "String"
+    },
+    {
+      "Name": "EventSchema",
+      "Type": "String"
+    },
+    {
+      "Name": "EventUid",
+      "Type": "String"
+    },
+    {
+      "Name": "EventSeverity",
+      "Type": "String"
+    },
+    {
+      "Name": "EventSubType",
+      "Type": "String"
+    },
+    {
+      "Name": "EventOriginalSeverity",
+      "Type": "String"
+    },
+    {
+      "Name": "EventOriginalSubType",
+      "Type": "String"
+    },
+    {
+      "Name": "EventOriginalResultDetails",
+      "Type": "String"
+    },
+    {
+      "Name": "EventOwner",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcAction",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcDescription",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcDomain",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcDomainType",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcFQDN",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcIdType",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcInterface",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcOriginalAction",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcScope",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcScopeId",
+      "Type": "String"
+    },
+    {
+      "Name": "DvcZone",
+      "Type": "String"
+    },
+    {
+      "Name": "Dst",
+      "Type": "String"
+    },
+    {
+      "Name": "Src",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserType",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorDNUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorOriginalUserType",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorScope",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorScopeId",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorSimpleUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserAadId",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserAWSId",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserOktaId",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserPuid",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserUid",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorUserUpn",
+      "Type": "String"
+    },
+    {
+      "Name": "ActorWindowsUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserType",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetDNUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetOriginalUserType",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetSimpleUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserAadId",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserAWSId",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserOktaId",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserPuid",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserScope",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserScopeId",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserUid",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetUserUpn",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetWindowsUsername",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessCurrentDirectory",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessFileCompany",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessFilename",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessFileInternalName",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessFileOriginalName",
+      "Type": "String"
+    },
+    {
+      "Name": "TargetProcessFileSize",
+      "Type": "Int64"
+    },
+    {
+      "Name": "TargetProcessStatusCode",
+      "Type": "String"
+    },
+    {
+      "Name": "ActingProcessFilename",
+      "Type": "String"
+    },
+    {
+      "Name": "ActingProcessFileCompany",
+      "Type": "String"
+    },
+    {
+      "Name": "ActingProcessFileInternalName",
+      "Type": "String"
+    },
+    {
+      "Name": "ActingProcessFileOriginalName",
+      "Type": "String"
+    },
+    {
+      "Name": "ActingProcessFileSize",
+      "Type": "Int64"
+    },
+    {
+      "Name": "ActingProcessTokenElevation",
+      "Type": "String"
+    },
+    {
+      "Name": "ParentProcessFileCompany",
+      "Type": "String"
+    },
+    {
+      "Name": "ParentProcessTokenElevation",
+      "Type": "String"
     }
   ]
 }