[kingwil]

Change(s):

• Investigation: fix JSON-array message-ID exports in eleven selection queries and dependent drill-downs.
• Native Detections and Insights: fix Teams Subject queries, AIR time binding and clipped Release rate label.
• Retain IDs, Sentinel content, attribution and historical approvals. Add reviewed-update evidence, V3.1 package and one short release note; no duplicate raw source or Sentinel parent.

Reason for Change(s):

• Fix issues found in Defender testing; follow-up to merged Microsoft Defender for Office 365: add XDR workbook #15324.

Version Updated:

• Solution and both XDR workbooks: 3.2.0 -> 3.2.1.

Testing Completed:

• Per supplied changelog: all 19 investigation panels checked, including corrected selection/drill-downs.
• Native edition: differential comparison plus seven targeted queries at 24 hours, all HTTP 200; remaining 230 queries not independently rerun. Six workspace-required notices remain intentional.
• User visually accepted all five workbooks at 24 hours on 15 October; original defaults retained.

Checked that the validations are passing and have addressed any issues that are present:

• Scoped workbook checks pass (2/2); user payloads/IDs and ZIP consistency confirmed.
• Automatic ARM-TTK: 47 passes, six failures plus existing null-Path diagnostic. Full suite not rerun as previously requested; no new deployment or release acceptance claimed.
• Reproducible update tooling: Support reviewed workbook updates with clean public artifacts and local audit evidence oferInbar/Azure-Sentinel#9.