Adding msg_s column in AzureFirewall DNS parsers

[dhanunjaya1054]

Required items, please complete

Change(s):

• Added msg_s = column_ifexists("msg_s", "") to both legacy AzureDiagnostics branches in ASimDnsAzureFirewall and vimDnsAzureFirewall DNS parsers.

Reason for Change(s):

• In resource-specific mode (logs go only to AZFWDnsQuery), msg_s doesn't exist in AzureDiagnostics, causing 'Failed to resolve scalar expression named 'msg_s'' which aborted the whole union. column_ifexists makes the reference safe and backward-compatible.

Version Updated:

• Both parsers bumped 0.4.0 → 0.4.1 (N/A for Detections/Analytic Rules).

Testing Completed:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Azure Firewall DNS ASIM parsers to safely reference msg_s in AzureDiagnostics by using column_ifexists, preventing unions from failing when the column is absent (e.g., resource-specific logging scenarios).

Changes:

• Bumped parser versions from 0.4.0 to 0.4.1 and updated LastUpdated dates.
• Added extend msg_s = column_ifexists("msg_s", "") to legacy AzureDiagnostics branches in both parsers.
• Added explanatory comments describing why column_ifexists is required.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Parsers/ASimDns/Parsers/vimDnsAzureFirewall.yaml	Makes msg_s access safe in AzureDiagnostics DNS proxy branches to avoid union aborts.
Parsers/ASimDns/Parsers/ASimDnsAzureFirewall.yaml	Same msg_s safety fix for the main ASIM parser, plus version/date bump.

[yummyblabla]

@dhanunjaya1054 Update the changelog files that you've made the change to the two parsers.