[Chencheng Xie (Microsoft) (melmarsezio)]

Required items, please complete

Change(s):

• Fixed inline fixture datatable serialization:
  • Missing Kusto string values are emitted as empty strings rather than invalid string(null) expressions.
  • Typed null expressions remain in use for nullable non-string columns.
• Corrected QTP/ITP parity comparison:
  • Excludes the platform-managed Type column from intersect_schema and filtered row comparison.
  • Retains Type in complete qtp_rows and itp_rows artifacts for diagnostics.
  • Keeps shared-column type consistency validation unchanged.
• Improved parity failure summaries:
  • Reports QTP missing-row and ITP extra-row counts.
  • Reports top differing columns from stable-key diagnostics.
  • Falls back to comparing persisted missing/extra examples when stable-key diagnostics are unavailable.
  • Reports shared-column type mismatches and missing columns directly in the parity stage detail.
• Updated the ingestion validation README and regression coverage.

Reason for Change(s):

• Workflow run 39882249717 for [ASIM] Add Salesforce Audit Trail and Login History ingestion-time parsers #15390 exposed two independent validator defects:
  • Legacy Salesforce fixtures failed before parser-DCR creation because nullable source string fields generated string(null), which Kusto could not parse.
  • Both V2 parsers completed required parser validation, ASimDataTester, QTP replay, and QTP execution, but parity marked every row missing/extra solely because QTP and native ASIM tables intentionally return different Type values.
• Type identifies the source or physical destination table and is not a normalized semantic field suitable for parity.
• Generic Query-time and ingestion-time outputs differ summaries did not identify the actual mismatch, even though detailed artifact diagnostics were available.

Version Updated:

• Not applicable. No Detections or Analytic Rule templates are changed.

Testing Completed:

• python -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_*.py" — Passed, 140 tests.
• python -m compileall -q .script\tests\asimParsersTest\ingestTimeParser — Passed.
• python -m pyflakes .script\tests\asimParsersTest\ingestTimeParser — Passed.
• git diff --check — Passed.
• Replayed the legacy Audit Trail and Login History artifacts from run 39882249717 — Passed: regenerated filter queries contain no string(null) values and serialize missing strings as @''.
• Recomputed parity from the persisted Audit Trail V2 and Login History V2 QTP/ITP datasets — Passed:
  • Type is excluded from the parity intersection.
  • Both targets report 10 QTP rows and 10 ITP rows.
  • Both targets report zero missing rows and zero extra rows.
• GitHub Actions workflow lint was not rerun because this PR does not modify workflow YAML.
• A new live Azure validation run was not performed from this branch.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. All local regression, compilation, lint, artifact replay, and patch-integrity checks listed above pass.