[Chencheng Xie (Microsoft) (melmarsezio)]

Required items, please complete

Change(s):

• Canonicalize every returned TimeGenerated value through exact Kusto ticks before comparison or counting:
  • Applies to inline filter-count results.
  • Applies to Log Analytics exact-row visibility polling.
  • Treats equivalent representations such as .863843Z and .8638430Z as the same timestamp.
• Persist optional QTP raw-replay observations in validation-result.json:
  • observedSchema
  • observedRows
  • observedCountsByTimestamp
  • Persists observations on successful visibility and on unexpected, duplicate, or incomplete exact-row failures.
  • Removes the internal raw query table from top-level exception details after normalization to avoid duplicate large payloads.
• Tighten optional QTP replay failure behavior:
  • Raw table or raw DCR establishment failures remain warnings and block QTP/parity without failing required ITP validation.
  • Once the raw DCR exists, raw upload or visibility failures fail the target.
  • QTP execution and parity failures continue to fail the target.
  • QTP/parity are explicitly marked blocked when raw ingestion fails.
• Updated reporting, documentation, and regression coverage for the new failure boundary and replay evidence.

Reason for Change(s):

• Workflow run 39992368738 for [ASIM] Add Salesforce Audit Trail and Login History ingestion-time parsers #15390 exposed two validator gaps:
  • Legacy Audit Trail filter validation rejected 2026-10-23T16:24:47.863843Z as outside the expected timestamp set even though it is the same Kusto instant as 2026-10-23T16:24:47.8638430Z.
  • Login History V2 raw replay observed two rows for every timestamp after the raw DCR and upload succeeded, but the workflow treated the visibility failure as warning-only and passed required validation.
• Timestamp matching must use Kusto tick identity rather than serialized string formatting.
• A failure after raw DCR establishment indicates the optional replay ran but produced invalid or incomplete source data, so the target must fail instead of silently skipping parity.
• Persisted observed rows are required to determine whether failures come from duplicate ingestion, contamination, or incomplete delivery.

Version Updated:

• Not applicable. No Detections or Analytic Rule templates are changed.

Testing Completed:

• python -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_*.py" — Passed, 144 tests.
• python -m compileall -q .script\tests\asimParsersTest\ingestTimeParser — Passed.
• python -m pyflakes .script\tests\asimParsersTest\ingestTimeParser — Passed.
• git diff --check — Passed.
• Replayed the exact legacy Audit Trail timestamp from run 39992368738 — Passed: .863843Z canonicalizes to .8638430Z and counts against the expected timestamp.
• Regression-tested raw visibility with duplicate observed rows — Passed:
  • Observed schema, rows, and counts remain in qtpSourceReplay.
  • Raw ingestion is failed.
  • QTP execution and parity are blocked.
  • Overall target validation fails.
• Regression-tested raw DCR creation failure — Passed: it remains warning-only and does not fail required ITP validation.
• GitHub Actions workflow lint was not rerun because this PR does not modify workflow YAML.
• A new live Azure validation run was not performed from this branch.

Checked that the validations are passing and have addressed any issues that are present:

• Yes. All local regression, compilation, lint, timestamp replay, artifact persistence, and patch-integrity checks listed above pass.