Update copilot table name from LLMActivity to CopilotActivity (Azure#13272)

* update copilot table name from LLMActivity to CopilotActivity

* Revert the file change

* fix build error

* Update ReleaseNotes.md

---------

Co-authored-by: v-shukore <[email protected]>

Author: solhaile

Sample Data/MicrosoftCopilot_IngestedLogs.json

@@ -14,14 +14,14 @@
     "Version": 1,
     "AppHost": "Office",
     "AppIdentity": null,
-    "LLMEventData": "{\"AISystemPlugin\":[{\"Id\":\"BingWebSearch\",\"Name\":\"BuiltIn\"}],\"AccessedResources\":[],\"AppHost\":\"Office\",\"Contexts\":[],\"MessageIds\":[],\"Messages\":[{\"Id\":\"1763484903640\",\"JailbreakDetected\":false,\"isPrompt\":true},{\"Id\":\"1763484903942\",\"JailbreakDetected\":false,\"isPrompt\":false}],\"ModelTransparencyDetails\":[{\"ModelName\":\"DEEP_LEO\"}],\"ThreadId\":\"19:Cp0AhBA5TnLBAbkKmlTDhND7jWGZjfXFYr1Da9zyeB01@thread.v2\"}",
+    "LLMEventData": "{\"AISystemPlugin\":[{\"Id\":\"BingWebSearch\",\"Name\":\"BuiltIn\"}],\"AccessedResources\":[],\"AppHost\":\"Office\",\"Contexts\":[],\"MessageIds\":[],\"Messages\":[{\"Id\":\"1763484903640\",\"JailbreakDetected\":false,\"isPrompt\":true},{\"Id\":\"1763484903942\",\"JailbreakDetected\":false,\"isPrompt\":false}],\"ModelTransparencyDetails\":[{\"ModelName\":\"DEEP_LEO\"}],\"ThreadId\":\"19:Cp0AhBA5TnLBAbkKmlTDhND7jWGZjfXFYr1Da9zyeB01[at]thread.v2\"}",
     "AIModelName": "DEEP_LEO",
     "AIModelVersion": null,
     "LogVersion": "1.0.0.0",
     "AgentName": null,
     "AgentId": null,
     "SourceSystem": null,
-    "Type": "LLMActivity"
+    "Type": "CopilotActivity"
   },
   {
     "TenantId": "00000000-0000-0000-0000-000000000000",
@@ -45,7 +45,7 @@
     "AgentName": null,
     "AgentId": null,
     "SourceSystem": null,
-    "Type": "LLMActivity"
+    "Type": "CopilotActivity"
   },
   {
     "TenantId": "00000000-0000-0000-0000-000000000000",
@@ -69,7 +69,7 @@
     "AgentName": null,
     "AgentId": null,
     "SourceSystem": null,
-    "Type": "LLMActivity"
+    "Type": "CopilotActivity"
   },
   {
     "TenantId": "00000000-0000-0000-0000-000000000000",
@@ -93,6 +93,6 @@
     "AgentName": null,
     "AgentId": null,
     "SourceSystem": null,
-    "Type": "LLMActivity"
+    "Type": "CopilotActivity"
   }
 ]

Solutions/Microsoft Copilot/Data Connectors/MicrosoftCopilot_ConnectorDefinition.json

@@ -15,13 +15,13 @@
                 {
                     "metricName": "Total data received",
                     "legend": "Microsoft Copilot",
-                    "baseQuery": "LLMActivity"
+                    "baseQuery": "CopilotActivity"
                 }
             ],
             "sampleQueries": [
                 {
                     "description": "Microsoft Copilot Logs",
-                    "query": "LLMActivity\n            | sort by TimeGenerated"
+                    "query": "CopilotActivity\n            | sort by TimeGenerated"
                 }
             ],
             "connectivityCriteria": [
@@ -31,8 +31,8 @@
             ],
             "dataTypes": [
                 {
-                    "name": "LLMActivity",
-                    "lastDataReceivedQuery": "LLMActivity\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
+                    "name": "CopilotActivity",
+                    "lastDataReceivedQuery": "CopilotActivity\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                 }
             ],
             "availability": {
@@ -63,7 +63,7 @@
             "instructionSteps": [
                 {
                     "title": "Connect Microsoft Copilot audit logs to Microsoft Sentinel",
-                    "description": "This connector uses the Office Management API to get your Microsoft Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **LLMActivity** table.",
+                    "description": "This connector uses the Office Management API to get your Microsoft Copilot audit logs. The logs will be stored and processed in your existing Microsoft Sentinel workspace. You can find the data in the **CopilotActivity** table.",
                     "instructions": [
                         {
                             "type": "ConnectionToggleButton",

Solutions/Microsoft Copilot/Data Connectors/MicrosoftCopilot_DCR.json

@@ -16,13 +16,13 @@
             "dataFlows": [
                 {
                     "streams": [
-                        "Microsoft-LLMActivity"
+                        "Microsoft-CopilotActivity"
                     ],
                     "destinations": [
                         "clv2ws1"
                     ],
                     "transformKql": "source",
-                    "outputStream": "Microsoft-LLMActivity"
+                    "outputStream": "Microsoft-CopilotActivity"
                 }
             ],
             "dataCollectionEndpointId": "{{dataCollectionEndpointId}}"

Solutions/Microsoft Copilot/Data/Solution_MicrosoftCopilot.json

@@ -7,7 +7,7 @@
     "Solutions/Microsoft Copilot/Data Connectors/MicrosoftCopilot_ConnectorDefinition.json"
   ],
   "BasePath": "D:\\forked\\Azure-Sentinel\\Solutions\\Microsoft Copilot",
-  "Version": "3.0.0",
+  "Version": "3.0.1",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true
 }

Solutions/Microsoft Copilot/Package/3.0.1.zip

@@ -77,9 +77,9 @@
       }
     ],
     "outputs": {
-      "workspaceLocation": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+      "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
-      "workspaceName": "[basics('workspace')]"
+      "workspace": "[basics('workspace')]"
     }
   }
 }