[kingwil]

Change(s):

• Endpoint: fix time filters, daily chart/counts, Tor cutoff and empty labels.
• Identity: fix time filters, port chart, account fallbacks and weighted logon totals/trends.
• Detections and Insights: fix Teams Subject queries, consistent incident/true-positive totals, time bindings and Defender guidance.
• Retain IDs, Sentinel content, attribution and historical conversion evidence. Add reviewed-update evidence, V3.1 package and one short release note.

Reason for Change(s):

• Fix issues found in Defender testing; follow-up to merged Add Defender XDR 3.2.1 workbook-only candidate package #15323.

Version Updated:

• Solution and all three XDR workbooks: 3.2.1 -> 3.2.2.

Testing Completed:

• Per supplied changelog: Endpoint/Identity re-imported and 21 surfaces each checked; all 243 Detections queries returned HTTP 200 at seven days.
• User visually accepted all five workbooks at 24 hours on 15 October. Empty panels lack populated-rendering proof; full 90-day workload was not rerun.

Checked that the validations are passing and have addressed any issues that are present:

• Scoped workbook checks pass (3/3); user payloads/IDs and ZIP consistency confirmed.
• Automatic ARM-TTK still fails inner-template extraction. Full suite not rerun as previously requested; no new deployment or release acceptance claimed.
• Reproducible update tooling: Support reviewed workbook updates with clean public artifacts and local audit evidence oferInbar/Azure-Sentinel#9.