Merge pull request Azure#8982 from oded-weber/OktaConnector

Okta connector

.script/tests/KqlvalidationsTests/CustomTables/OktaSSO.json

@@ -0,0 +1,301 @@
+{
+  "Name": "OktaSSO",
+  "Properties": [
+    {
+      "Name": "TenantId",
+      "Type": "String"
+    },
+    {
+      "Name": "SourceSystem",
+      "Type": "String"
+    },
+    {
+      "Name": "MG",
+      "Type": "String"
+    },
+    {
+      "Name": "ManagementGroupName",
+      "Type": "String"
+    },
+    {
+      "Name": "TimeGenerated",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "Computer",
+      "Type": "String"
+    },
+    {
+      "Name": "RawData",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_initiationType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_logOnlySecurityData_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_threatDetections_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_signOnMode_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_attributesModified_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_attributesAdded_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_attributesDeleted_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_groupAppAssignmentId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_authnRequestId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_userAgent_rawUserAgent_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_userAgent_os_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_userAgent_browser_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_zone_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_device_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_ipAddress_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_geographicalContext_city_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_geographicalContext_state_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_geographicalContext_country_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_geographicalContext_postalCode_s",
+      "Type": "String"
+    },
+    {
+      "Name": "client_geographicalContext_geolocation_lat_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "client_geographicalContext_geolocation_lon_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "outcome_reason_s",
+      "Type": "String"
+    },
+    {
+      "Name": "securityContext_asNumber_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "securityContext_asOrg_s",
+      "Type": "String"
+    },
+    {
+      "Name": "securityContext_isp_s",
+      "Type": "String"
+    },
+    {
+      "Name": "securityContext_domain_s",
+      "Type": "String"
+    },
+    {
+      "Name": "securityContext_isProxy_b",
+      "Type": "Boolean"
+    },
+    {
+      "Name": "debugContext_debugData_loginResult_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_requestId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_requestUri_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_url_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_deviceFingerprint_g",
+      "Type": "String"
+    },
+    {
+      "Name": "authenticationContext_authenticationProvider_s",
+      "Type": "String"
+    },
+    {
+      "Name": "authenticationContext_credentialProvider_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_factor_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_countryCallingCode_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_smsProvider_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_transactionId_g",
+      "Type": "String"
+    },
+    {
+      "Name": "authenticationContext_credentialType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "actor_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "actor_type_s",
+      "Type": "String"
+    },
+    {
+      "Name": "actor_alternateId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "actor_displayName_s",
+      "Type": "String"
+    },
+    {
+      "Name": "authenticationContext_authenticationStep_d",
+      "Type": "Double"
+    },
+    {
+      "Name": "authenticationContext_externalSessionId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "displayMessage_s",
+      "Type": "String"
+    },
+    {
+      "Name": "eventType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "outcome_result_s",
+      "Type": "String"
+    },
+    {
+      "Name": "published_t",
+      "Type": "DateTime"
+    },
+    {
+      "Name": "severity_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_jobId_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_importType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_appname_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_importLastToken_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_importTrigger_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_threatSuspected_s",
+      "Type": "String"
+    },
+    {
+      "Name": "legacyEventType_s",
+      "Type": "String"
+    },
+    {
+      "Name": "transaction_type_s",
+      "Type": "String"
+    },
+    {
+      "Name": "transaction_id_s",
+      "Type": "String"
+    },
+    {
+      "Name": "uuid_g",
+      "Type": "String"
+    },
+    {
+      "Name": "version_s",
+      "Type": "String"
+    },
+    {
+      "Name": "request_ipChain_s",
+      "Type": "String"
+    },
+    {
+      "Name": "target_s",
+      "Type": "String"
+    },
+    {
+      "Name": "debugContext_debugData_detailedmessage_s",
+      "Type": "String"
+    },
+    {
+      "Name": "Type",
+      "Type": "String"
+    },
+    {
+      "Name": "_ResourceId",
+      "Type": "String"
+    },
+    {
+        "Name": "_ItemId",
+        "Type": "String"
+    }
+  ]
+}