[Chencheng Xie (Microsoft) (melmarsezio)]

Required items, please complete

Change(s):

• Simplified ingestion-time parser source validation:
  • Removed obsolete connector-DCR evidence rules SOURCE001, SOURCE002, and SOURCE004 and their repository-scanning helpers.
  • Retained the Workspace InputStream: none requirement as the reordered SOURCE001.
• Corrected shadow-mode workflow behavior:
  • Removed continue-on-error masking so failed steps, matrix jobs, and the overall workflow remain visibly failed.
  • Preserved always-run report generation, artifact upload, and deterministic cleanup.
  • Clarified that merge blocking is controlled by branch-protection required-check configuration.
• Improved validation and report accuracy:
  • Reports fixture preparation as blocked when static template validation fails.
  • Removes non-semantic indentation and // comments outside string literals before creating the parser DCR.
  • Adds KQL044 when the compacted ParserQuery still exceeds Azure's 15,360-character TransformKql limit.
  • Attributes DCR creation and provisioning errors only to the raw or parser DCR stage that actually failed.
  • Removes the obsolete shadow-only-failure report status.
• Added regression coverage for source metadata, shadow failure visibility, blocked fixture reporting, transform-length boundaries, and DCR error attribution.

Reason for Change(s):

• Connector DCR definitions can evolve independently while ingestion-time parsers continue to support legacy connector routes, so repository connector evidence must not invalidate an otherwise valid parser.
• Shadow rollout should make failures visible without converting failed validation into a successful check; whether the check blocks merge belongs in branch-protection configuration.
• Workflow run 39711879637 for [ASIM] Add Salesforce Audit Trail and Login History ingestion-time parsers #15390 exposed two validation gaps:
  • A 16,612-character parser transform passed static validation but Azure rejected it because TransformKql is limited to 15,360 characters.
  • A parser-DCR HTTP 400 error was also displayed as detail on the successfully created raw DCR stage.
• Fixture stages skipped because of template failures should be reported as blocked rather than as independent fixture failures.

Version Updated:

• Not applicable. No Detections or Analytic Rule templates are changed.

Testing Completed:

• python -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_*.py" — Passed, 131 tests.
• python -m compileall -q .script\tests\asimParsersTest\ingestTimeParser — Passed.
• python -m pyflakes .script\tests\asimParsersTest\ingestTimeParser — Passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github\workflows\runAsimIngestionTimeValidation.yaml .github\workflows\runAsimIngestionTimeValidationTests.yaml — Passed.
• git diff --check — Passed.
• Replayed the Audit V2 artifacts from run 39711879637 through the updated code — Passed: ParserQuery compacts from 16,612 to 14,257 characters without changing string contents, no KQL044 is emitted, rawDcr remains passed with empty detail, and the HTTP 400 detail is assigned only to parserDcr.
• A new live Azure workflow run was not performed from this branch.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. All local regression and static checks listed above pass, and the reviewed workflow-reporting issues are covered by regression tests.