Digital Shadows Incident Creation for exclude-app

Requête originale, sans modification.

let DSSearchLight_view  = view () { DigitalShadows_V2_CL | project-rename app_s = App, title_s = Title, raised_t = TimeRaised, updated_t = TimeUpdated, classification_s = Classification, risk_level_s = RiskLevel, risk_assessment_risk_level_s = RiskAssessmentRiskLevel, gm_link_s = GreyMatterLink, assets_s = Assets, comments_s = Comments, description_s = Description, impact_description_s = ImpactDescription, mitigation_s = Mitigation, risk_factors_s = RiskFactors, portal_id_s = PortalId, id_d = IncidentId, id_g = AlertId, status_s = Status, triage_id_g = TriageId, triage_raised_time_t = TriageRaisedTime, triage_updated_time_t = TriageUpdatedTime | where app_s == "exclude" | extend EventVendor="Digital Shadows", EventProduct="SearchLight",Type="DigitalShadows_V2_CL",EventStartTime=raised_t,EventMessage=title_s,EventOriginalUid=triage_id_g,EventOriginalType=classification_s | extend EventOriginalSeverity=iif(isempty(risk_level_s), risk_assessment_risk_level_s, risk_level_s) | extend EventSeverity = case(EventOriginalSeverity == 'none', 'Informational', EventOriginalSeverity == 'very-low', 'Low',EventOriginalSeverity == 'low', 'Low',EventOriginalSeverity == 'medium', 'Medium',EventOriginalSeverity == 'high', 'High',EventOriginalSeverity == 'very-high', 'High','Informational') | extend EventReportUrl = column_ifexists('gm_link_s', '') | extend AdditionalFields = pack("assets", assets_s, "comments", comments_s, "description", description_s, "incident_id", id_d, "alert_id", id_g, "short_code", portal_id_s, "impact", impact_description_s, "mitigation", mitigation_s, "risk_factors", risk_factors_s, "triage_status", status_s, "triage_id", triage_id_g, "triage_raised", triage_raised_time_t,"triage_updated", triage_updated_time_t, "updated", updated_t) | project TimeGenerated, EventVendor,EventProduct, Type, EventStartTime,EventMessage, EventOriginalUid, EventOriginalType,EventOriginalSeverity, EventSeverity, EventReportUrl,AdditionalFields};DSSearchLight_view | summarize arg_max(TimeGenerated, *) by EventOriginalUid | extend description = AdditionalFields.description | extend impact = AdditionalFields.impact | extend mitigation = AdditionalFields.mitigation | extend status = AdditionalFields.triage_status | extend comments = AdditionalFields.comments