testing asim _ASim_RegistryEvent_MicrosoftSecurityEventV03

[v-amolpatil]

Required items, please complete

Change(s):

• This is a testing pr

Reason for Change(s):

• See guidance below

Version Updated:

• Required only for Detections/Analytic Rule templates
• See guidance below

Testing Completed:

• See guidance below

Checked that the validations are passing and have addressed any issues that are present:

• See guidance below

Fixed by below:
Name to sample file with extension csv: Microsoft_Security Events_Authentication_IngestedLogs
In Sample data, Added a new column "ParentProcessId", I was getting error for DCR column having missmatch of data types as it was getting string to guid. InterfaceUuid, LogonGuid, SourceComputerId , SubcategoryGuid, TargetLogonGuid

Below is the error:
Response of DCR creation: {"error":{"code":"InvalidPayload","message":"Data collection rule is invalid","details":[{"code":"InvalidTransformOutput","message":"Types of transform output columns do not match the ones defined by the output stream: InterfaceUuid [produced:'String', output:'Guid'], LogonGuid [produced:'String', output:'Guid'], SourceComputerId [produced:'String', output:'Guid'], SubcategoryGuid [produced:'String', output:'Guid'], TargetLogonGuid [produced:'String', output:'Guid']","target":"properties.dataFlows[0]"}]}}

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[contentautomationbot]

ASIM parsers have been changed. ARM templates were regenerated from the updated KQL function YAML files.
To find the new ARM templates, pull your branch.

[v-amolpatil]

done with testing so closing