Merge pull request Azure#13211 from fenil-savani/corelight-new-aggregation-parsers

[Corelight][Parsers] - Adding new parsers for corelight aggregation

Author: v-atulyadav

.script/tests/KqlvalidationsTests/CustomTables/Corelight_v2_conn_agg_CL.json

@@ -0,0 +1,285 @@
+{
+  "Name": "Corelight_v2_conn_agg_CL",
+  "Properties": [
+    {
+      "Name": "TimeGenerated",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "_path_s",
+      "Type": "String"
+    },
+    {
+      "Name": "_system_name_s",
+      "Type": "String"
+    },
+    {
+      "Name": "_write_ts_t",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "uid_s",
+      "Type": "String"
+    },
+    {
+      "Name": "id_orig_h_s",
+      "Type": "String"
+    },
+    {
+      "Name": "id_orig_p_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "id_resp_h_s",
+      "Type": "String"
+    },
+    {
+      "Name": "id_resp_p_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "proto_s",
+      "Type": "String"
+    },
+    {
+      "Name": "suri_ids_s",
+      "Type": "String"
+    },
+    {
+      "Name": "local_orig_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "local_resp_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "id_orig_h_n_s",
+      "Type": "String"
+    },
+    {
+      "Name": "id_resp_h_n_s",
+      "Type": "String"
+    },
+    {
+      "Name": "community_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "spcap_url_s",
+      "Type": "String"
+    },
+    {
+      "Name": "service_s",
+      "Type": "String"
+    },
+    {
+      "Name": "app_s",
+      "Type": "String"
+    },
+    {
+      "Name": "corelight_shunted_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "duration_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "resp_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "missed_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_shunted_pkts_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_shunted_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "resp_shunted_pkts_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "resp_shunted_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_pkts_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_ip_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "resp_pkts_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "resp_ip_bytes_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "conn_state_s",
+      "Type": "String"
+    },
+    {
+      "Name": "history_s",
+      "Type": "String"
+    },
+    {
+      "Name": "tunnel_parents_s",
+      "Type": "String"
+    },
+    {
+      "Name": "netskope_site_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "netskope_user_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "id_vlan_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "vlan_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "inner_vlan_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "orig_inst_org_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_name_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_az_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_vpc_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_subnet_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_sg_ids_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_project_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_network_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_network_tags_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_resource_group_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_subscription_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_os_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_location_s",
+      "Type": "String"
+    },
+    {
+      "Name": "orig_inst_nsg_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_org_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_name_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_az_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_vpc_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_subnet_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_sg_ids_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_project_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_network_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_network_tags_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_resource_group_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_subscription_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_os_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_location_s",
+      "Type": "String"
+    },
+    {
+      "Name": "resp_inst_nsg_s",
+      "Type": "String"
+    }
+  ]
+}