BigID DSPM Asset expanding and mapping

[mhebrard-bigid]

Change(s):

• Renamed column "case" to "dspmCase" in BigIDDSPMCatalog_CL table schema
• Renamed column "affectedObjects" to "expand" in BigIDDSPMCatalog_CL table schema
• using ASI/Microsoft/MvExpandTransformer to expand the column "expand" into several entries instead of a list. Result goes eventually to BigIDDSPMAssetStore_CL after DCR
• Added new table BigIDDSPMAssetStore_CL with comprehensive asset tracking schema including 25+ columns for asset metadata, permissions, classification, and risk information

Reason for Change(s):

• Improved column naming clarity to avoid conflicts with reserved keywords ("case")
• Enhanced data structure to support expanded BigID DSPM asset tracking capabilities
• Added comprehensive asset store schema to capture detailed asset information including ownership, permissions, classification, and risk data

Version Updated:

• N/A (Data Connector table schema changes, not a Detection/Analytic Rule template)

Testing Completed:

• Yes - Validated JSON schema structure for both table definitions
• Verified column types and descriptions are properly formatted

[mhebrard-bigid]

@v-shukore @v-maheshbh please proceed with the evaluation of this PR, thank you

[v-maheshbh]

Hi @mhebrard-bigid
Kindly update the release notes with the latest changes and attach a screenshot of the CCF connector in a connected state.
and note that the solution is packaged with version 3.0.0. Kindly confirm whether this is the initial version and whether it is not yet live on the Content Hub?

Additionally, note that the ARM-TTK validation failed due to an empty property in the main template—please remove it if not required or fix it.

Thanks!

[mhebrard-bigid]

Hi,
Thannk for your comment and your review

• I've updated the release notes.
• Screenshot for connected connector

• I confirm this is the initial version and it's not yet live.
• The arm TTK validation is incorrect as this is a valid use case of an empty value. Removing the property isn't equal to have an empty string here, as the default value is something different from "".

Thank you for your attention on this.