diff --git a/ChangeLog.md b/ChangeLog.md
index b25365acc968..1b85a50847f4 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,5 @@
+## 2016.02.02 version 1.1.1
+* Azure RemoteApp: Organizational Unit in Azure RemoteApp RDFE cmdlets now accepts Unicode characters.
## 2016.01.12 version 1.1.0
* Azure SQL Database: Threat Detection policies:
* Using new Threat Detection Types
diff --git a/setup/azurecmd.wxs b/setup/azurecmd.wxs
index a689a7f200e6..a4d9d7660211 100644
--- a/setup/azurecmd.wxs
+++ b/setup/azurecmd.wxs
@@ -6,8 +6,6 @@
-
-
-
+
VersionNT64
-
+
NOT VersionNT64
@@ -63,10 +61,6 @@
-
@@ -81,7 +75,7 @@
-
+
@@ -97,41 +91,17 @@
-
-
-
-
-
-
- NOT Installed
- NOT Installed
- NOT Installed
- NOT Installed
-
-
diff --git a/setup/azurecmdfiles.wxi b/setup/azurecmdfiles.wxi
index 3e5f3f831b86..663c34a5902a 100644
--- a/setup/azurecmdfiles.wxi
+++ b/setup/azurecmdfiles.wxi
@@ -415,6 +415,9 @@
+
+
+
@@ -980,6 +983,9 @@
+
+
+
@@ -989,6 +995,15 @@
+
+
+
+
+
+
+
+
+
@@ -1054,6 +1069,9 @@
+
+
+
@@ -1146,6 +1164,9 @@
+
+
+
@@ -1808,6 +1829,9 @@
+
+
+
@@ -2533,6 +2557,9 @@
+
+
+
@@ -3226,6 +3253,9 @@
+
+
+
@@ -3938,6 +3968,9 @@
+
+
+
@@ -4891,6 +4924,7 @@
+
@@ -5076,9 +5110,13 @@
+
+
+
+
@@ -5100,6 +5138,7 @@
+
@@ -5130,6 +5169,7 @@
+
@@ -5346,6 +5386,7 @@
+
@@ -5583,6 +5624,7 @@
+
@@ -5808,6 +5850,7 @@
+
@@ -6032,6 +6075,7 @@
+
diff --git a/src/Common/Commands.Common.Storage/Commands.Common.Storage.csproj b/src/Common/Commands.Common.Storage/Commands.Common.Storage.csproj
index 9733d3382a04..67d3b12ec307 100644
--- a/src/Common/Commands.Common.Storage/Commands.Common.Storage.csproj
+++ b/src/Common/Commands.Common.Storage/Commands.Common.Storage.csproj
@@ -49,7 +49,7 @@
False
- ..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
False
@@ -73,17 +73,17 @@
False
- ..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -111,9 +111,9 @@
False
..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
+
False
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.2.0.3\lib\net40\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
False
@@ -151,7 +151,7 @@
-
+
False
..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/Common/Commands.Common.Storage/packages.config b/src/Common/Commands.Common.Storage/packages.config
index 4a1381799789..2e9f171b50a7 100644
--- a/src/Common/Commands.Common.Storage/packages.config
+++ b/src/Common/Commands.Common.Storage/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
@@ -17,7 +17,7 @@
-
+
diff --git a/src/Common/Commands.Common/AzurePSCmdlet.cs b/src/Common/Commands.Common/AzurePSCmdlet.cs
index f560a494619f..6cfddec82999 100644
--- a/src/Common/Commands.Common/AzurePSCmdlet.cs
+++ b/src/Common/Commands.Common/AzurePSCmdlet.cs
@@ -27,6 +27,8 @@
using System.Text;
using System.Linq;
using System.Threading;
+using Microsoft.Rest;
+using Microsoft.ApplicationInsights;
namespace Microsoft.WindowsAzure.Commands.Utilities.Common
{
@@ -40,14 +42,20 @@ public abstract class AzurePSCmdlet : PSCmdlet, IDisposable
private RecordingTracingInterceptor _httpTracingInterceptor;
private DebugStreamTraceListener _adalListener;
+
+ private ServiceClientTracingInterceptor _serviceClientTracingInterceptor;
+
protected static AzurePSDataCollectionProfile _dataCollectionProfile = null;
protected static string _errorRecordFolderPath = null;
- protected const string _fileTimeStampSuffixFormat = "yyyy-MM-dd-THH-mm-ss-fff";
+ protected static string _sessionId = Guid.NewGuid().ToString();
+ protected const string _fileTimeStampSuffixFormat = "yyyy-MM-dd-THH-mm-ss-fff";
+ protected string _clientRequestId = Guid.NewGuid().ToString();
+ protected MetricHelper _metricHelper;
protected AzurePSQoSEvent QosEvent;
protected virtual bool IsUsageMetricEnabled {
- get { return false; }
+ get { return true; }
}
protected virtual bool IsErrorMetricEnabled
@@ -57,7 +65,7 @@ protected virtual bool IsErrorMetricEnabled
///
/// Gets the PowerShell module name used for user agent header.
- /// By default uses "Azurepowershell"
+ /// By default uses "Azure PowerShell"
///
protected virtual string ModuleName { get { return "AzurePowershell"; } }
@@ -77,6 +85,13 @@ protected virtual bool IsErrorMetricEnabled
public AzurePSCmdlet()
{
_debugMessages = new ConcurrentQueue();
+
+ //TODO: Inject from CI server
+ _metricHelper = new MetricHelper();
+ _metricHelper.AddTelemetryClient(new TelemetryClient
+ {
+ InstrumentationKey = "7df6ff70-8353-4672-80d6-568517fed090"
+ });
}
///
@@ -95,12 +110,12 @@ protected static void InitializeDataCollectionProfile()
{
if (string.Equals(value, bool.FalseString, StringComparison.OrdinalIgnoreCase))
{
- // Disable data collection only if it is explictly set to 'false'.
+ // Disable data collection only if it is explicitly set to 'false'.
_dataCollectionProfile = new AzurePSDataCollectionProfile(true);
}
else if (string.Equals(value, bool.TrueString, StringComparison.OrdinalIgnoreCase))
{
- // Enable data collection only if it is explictly set to 'true'.
+ // Enable data collection only if it is explicitly set to 'true'.
_dataCollectionProfile = new AzurePSDataCollectionProfile(false);
}
}
@@ -216,13 +231,15 @@ protected override void BeginProcessing()
_httpTracingInterceptor = _httpTracingInterceptor ?? new RecordingTracingInterceptor(_debugMessages);
_adalListener = _adalListener ?? new DebugStreamTraceListener(_debugMessages);
+ _serviceClientTracingInterceptor = _serviceClientTracingInterceptor ?? new ServiceClientTracingInterceptor(_debugMessages);
RecordingTracingInterceptor.AddToContext(_httpTracingInterceptor);
DebugStreamTraceListener.AddAdalTracing(_adalListener);
+ ServiceClientTracing.AddTracingInterceptor(_serviceClientTracingInterceptor);
ProductInfoHeaderValue userAgentValue = new ProductInfoHeaderValue(
ModuleName, string.Format("v{0}", ModuleVersion));
AzureSession.ClientFactory.UserAgents.Add(userAgentValue);
- AzureSession.ClientFactory.AddHandler(new CmdletInfoHandler(this.CommandRuntime.ToString(), this.ParameterSetName));
+ AzureSession.ClientFactory.AddHandler(new CmdletInfoHandler(this.CommandRuntime.ToString(), this.ParameterSetName, this._clientRequestId));
base.BeginProcessing();
}
@@ -237,6 +254,7 @@ protected override void EndProcessing()
RecordingTracingInterceptor.RemoveFromContext(_httpTracingInterceptor);
DebugStreamTraceListener.RemoveAdalTracing(_adalListener);
+ ServiceClientTracingInterceptor.RemoveTracingInterceptor(_serviceClientTracingInterceptor);
FlushDebugMessages();
AzureSession.ClientFactory.UserAgents.RemoveWhere(u => u.Product.Name == ModuleName);
@@ -246,7 +264,7 @@ protected override void EndProcessing()
protected string CurrentPath()
{
- // SessionState is only available within Powershell so default to
+ // SessionState is only available within PowerShell so default to
// the CurrentDirectory when being run from tests.
return (SessionState != null) ?
SessionState.Path.CurrentLocation.Path :
@@ -266,7 +284,6 @@ protected bool IsVerbose()
{
QosEvent.Exception = errorRecord.Exception;
QosEvent.IsSuccess = false;
- LogQosEvent(true);
}
base.WriteError(errorRecord);
@@ -431,7 +448,7 @@ private void RecordDebugMessages()
///
/// Invoke this method when the cmdlet is completed or terminated.
///
- protected void LogQosEvent(bool waitForMetricSending = false)
+ protected void LogQosEvent()
{
if (QosEvent == null)
{
@@ -454,8 +471,8 @@ protected void LogQosEvent(bool waitForMetricSending = false)
try
{
- MetricHelper.LogQoSEvent(QosEvent, IsUsageMetricEnabled, IsErrorMetricEnabled);
- MetricHelper.FlushMetric(waitForMetricSending);
+ _metricHelper.LogQoSEvent(QosEvent, IsUsageMetricEnabled, IsErrorMetricEnabled);
+ _metricHelper.FlushMetric();
WriteDebug("Finish sending metric.");
}
catch (Exception e)
diff --git a/src/Common/Commands.Common/CmdletInfoHandler.cs b/src/Common/Commands.Common/CmdletInfoHandler.cs
index 28d22359c7e8..e2a2c053012d 100644
--- a/src/Common/Commands.Common/CmdletInfoHandler.cs
+++ b/src/Common/Commands.Common/CmdletInfoHandler.cs
@@ -33,16 +33,23 @@ public class CmdletInfoHandler : DelegatingHandler, ICloneable
/// The name of the parameter set specified by user.
///
public string ParameterSet { get; private set; }
+
+ ///
+ /// The unique client request id.
+ ///
+ public string ClientRequestId { get; private set; }
///
/// Initializes an instance of a CmdletInfoHandler with the name of the cmdlet and the parameter set.
///
/// the name of the cmdlet
/// the name of the parameter set specified by user
- public CmdletInfoHandler(string cmdlet, string parameterSet)
+ /// the unique clientRequestId
+ public CmdletInfoHandler(string cmdlet, string parameterSet, string clientRequestId)
{
this.Cmdlet = cmdlet;
this.ParameterSet = parameterSet;
+ this.ClientRequestId = clientRequestId;
}
protected override Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
@@ -55,12 +62,20 @@ protected override Task SendAsync(HttpRequestMessage reques
{
request.Headers.Add("ParameterSetName", ParameterSet);
}
+ if (ClientRequestId != null)
+ {
+ if (request.Headers.Contains("x-ms-client-request-id"))
+ {
+ request.Headers.Remove("x-ms-client-request-id");
+ }
+ request.Headers.TryAddWithoutValidation("x-ms-client-request-id", ClientRequestId);
+ }
return base.SendAsync(request, cancellationToken);
}
public object Clone()
{
- return new CmdletInfoHandler(this.Cmdlet, this.ParameterSet);
+ return new CmdletInfoHandler(this.Cmdlet, this.ParameterSet, this.ClientRequestId);
}
}
}
diff --git a/src/Common/Commands.Common/Commands.Common.csproj b/src/Common/Commands.Common/Commands.Common.csproj
index 7f364df1de6e..ef67e08bc2db 100644
--- a/src/Common/Commands.Common/Commands.Common.csproj
+++ b/src/Common/Commands.Common/Commands.Common.csproj
@@ -52,7 +52,7 @@
False
- ..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\packages\Microsoft.ApplicationInsights.1.1.1-beta\lib\net45\Microsoft.ApplicationInsights.dll
@@ -72,7 +72,7 @@
False
- ..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -107,7 +107,7 @@
True
- ..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
True
@@ -149,6 +149,7 @@
+
@@ -170,6 +171,7 @@
+
diff --git a/src/Common/Commands.Common/ConcurrentQueueExtensions.cs b/src/Common/Commands.Common/ConcurrentQueueExtensions.cs
new file mode 100644
index 000000000000..8d47736950a2
--- /dev/null
+++ b/src/Common/Commands.Common/ConcurrentQueueExtensions.cs
@@ -0,0 +1,44 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using System.Collections.Concurrent;
+
+namespace Microsoft.WindowsAzure.Commands.Common
+{
+ public static class ConcurrentQueueExtensions
+ {
+ private const int Capacity = 500;
+ public static void CheckAndEnqueue(this ConcurrentQueue queue, string item)
+ {
+ if (queue == null || item == null)
+ {
+ return;
+ }
+ lock(queue)
+ {
+ while (queue.Count >= Capacity)
+ {
+ string result;
+ queue.TryDequeue(out result);
+ }
+ queue.Enqueue(item);
+ }
+ }
+ }
+}
diff --git a/src/Common/Commands.Common/DebugStreamTraceListener.cs b/src/Common/Commands.Common/DebugStreamTraceListener.cs
index bae605aeff87..c75fa3fe7bb9 100644
--- a/src/Common/Commands.Common/DebugStreamTraceListener.cs
+++ b/src/Common/Commands.Common/DebugStreamTraceListener.cs
@@ -34,7 +34,7 @@ public static void AddAdalTracing(DebugStreamTraceListener listener)
public ConcurrentQueue Messages;
public override void Write(string message)
{
- Messages.Enqueue(message);
+ Messages.CheckAndEnqueue(message);
}
public override void WriteLine(string message)
diff --git a/src/Common/Commands.Common/MetricHelper.cs b/src/Common/Commands.Common/MetricHelper.cs
index 9bb3d20e4296..cd5b8c9c0736 100644
--- a/src/Common/Commands.Common/MetricHelper.cs
+++ b/src/Common/Commands.Common/MetricHelper.cs
@@ -1,37 +1,93 @@
-using System;
-using System.Collections.Generic;
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using System;
using System.Diagnostics;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Microsoft.ApplicationInsights;
-using Microsoft.ApplicationInsights.Channel;
-using Microsoft.ApplicationInsights.DataContracts;
using Microsoft.ApplicationInsights.Extensibility;
-using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using Microsoft.ApplicationInsights.DataContracts;
+using System.Collections.Generic;
namespace Microsoft.WindowsAzure.Commands.Common
{
- public static class MetricHelper
+ public class MetricHelper
{
private const int FlushTimeoutInMilli = 5000;
- private static readonly TelemetryClient TelemetryClient;
- static MetricHelper()
- {
- TelemetryClient = new TelemetryClient();
- // TODO: InstrumentationKey shall be injected in build server
- TelemetryClient.InstrumentationKey = "7df6ff70-8353-4672-80d6-568517fed090";
- // Disable IP collection
- TelemetryClient.Context.Location.Ip = "0.0.0.0";
+ ///
+ /// The collection of telemetry clients.
+ ///
+ private readonly List _telemetryClients =
+ new List();
+ ///
+ /// A read-only, thread-safe collection of telemetry clients. Since
+ /// List is only thread-safe for reads (and adding/removing tracing
+ /// interceptors isn't a very common operation), we simply replace the
+ /// entire collection of interceptors so any enumeration of the list
+ /// in progress on a different thread will not be affected by the
+ /// change.
+ ///
+ private List _threadSafeTelemetryClients =
+ new List();
+
+ ///
+ /// Lock used to synchronize mutation of the tracing interceptors.
+ ///
+ private readonly object _lock = new object();
+
+ public MetricHelper()
+ {
if (TestMockSupport.RunningMocked)
{
TelemetryConfiguration.Active.DisableTelemetry = true;
}
}
- public static void LogQoSEvent(AzurePSQoSEvent qos, bool isUsageMetricEnabled, bool isErrorMetricEnabled)
+ ///
+ /// Gets a sequence of the telemetry clients to notify of changes.
+ ///
+ internal IEnumerable TelemetryClients
+ {
+ get { return _threadSafeTelemetryClients; }
+ }
+
+ ///
+ /// Add a telemetry client.
+ ///
+ /// The telemetry client.
+ public void AddTelemetryClient(TelemetryClient client)
+ {
+ if (client == null)
+ {
+ throw new ArgumentNullException("client");
+ }
+
+ lock (_lock)
+ {
+ // TODO: Investigate whether this needs to be disabled
+ client.Context.Location.Ip = "0.0.0.0";
+ _telemetryClients.Add(client);
+ _threadSafeTelemetryClients = new List(_telemetryClients);
+ }
+ }
+
+ public void LogQoSEvent(AzurePSQoSEvent qos, bool isUsageMetricEnabled, bool isErrorMetricEnabled)
{
if (!IsMetricTermAccepted())
{
@@ -49,58 +105,95 @@ public static void LogQoSEvent(AzurePSQoSEvent qos, bool isUsageMetricEnabled, b
}
}
- private static void LogUsageEvent(AzurePSQoSEvent qos)
+ private void LogUsageEvent(AzurePSQoSEvent qos)
{
- var tcEvent = new RequestTelemetry(qos.CmdletType, qos.StartTime, qos.Duration, string.Empty, qos.IsSuccess);
- tcEvent.Context.User.Id = qos.Uid;
- tcEvent.Context.User.UserAgent = AzurePowerShell.UserAgentValue.ToString();
- tcEvent.Context.Device.OperatingSystem = Environment.OSVersion.VersionString;
-
- TelemetryClient.TrackRequest(tcEvent);
+ foreach (TelemetryClient client in TelemetryClients)
+ {
+ var pageViewTelemetry = new PageViewTelemetry
+ {
+ Name = qos.CommandName ?? "empty",
+ Duration = qos.Duration,
+ Timestamp = qos.StartTime
+ };
+ LoadTelemetryClientContext(qos, pageViewTelemetry.Context);
+ PopulatePropertiesFromQos(qos, pageViewTelemetry.Properties);
+ client.TrackPageView(pageViewTelemetry);
+ }
}
-
- private static void LogExceptionEvent(AzurePSQoSEvent qos)
+ private void LogExceptionEvent(AzurePSQoSEvent qos)
{
- //Log as custome event to exclude actual exception message
- var tcEvent = new EventTelemetry("CmdletError");
- tcEvent.Properties.Add("ExceptionType", qos.Exception.GetType().FullName);
- tcEvent.Properties.Add("StackTrace", qos.Exception.StackTrace);
- if (qos.Exception.InnerException != null)
+ if(qos == null || qos.Exception == null)
{
- tcEvent.Properties.Add("InnerExceptionType", qos.Exception.InnerException.GetType().FullName);
- tcEvent.Properties.Add("InnerStackTrace", qos.Exception.InnerException.StackTrace);
+ return;
}
- tcEvent.Context.User.Id = qos.Uid;
- tcEvent.Properties.Add("CmdletType", qos.CmdletType);
+ Dictionary eventMetrics = new Dictionary();
+ eventMetrics.Add("Duration", qos.Duration.TotalMilliseconds);
- TelemetryClient.TrackEvent(tcEvent);
+ foreach (TelemetryClient client in TelemetryClients)
+ {
+ Dictionary eventProperties = new Dictionary();
+ LoadTelemetryClientContext(qos, client.Context);
+ PopulatePropertiesFromQos(qos, eventProperties);
+ // qos.Exception contains exception message which may contain Users specific data.
+ // We should not collect users specific data.
+ eventProperties.Add("StackTrace", qos.Exception.StackTrace);
+ eventProperties.Add("ExceptionType", qos.Exception.GetType().ToString());
+ client.TrackException(null, eventProperties, eventMetrics);
+ }
}
- public static bool IsMetricTermAccepted()
+ private void LoadTelemetryClientContext(AzurePSQoSEvent qos, TelemetryContext clientContext)
{
- return AzurePSCmdlet.IsDataCollectionAllowed();
+ clientContext.User.Id = qos.Uid;
+ clientContext.User.AccountId = qos.Uid;
+ clientContext.Session.Id = qos.SessionId;
+ clientContext.Device.OperatingSystem = "Windows";
}
- public static void FlushMetric(bool waitForMetricSending)
+ private void PopulatePropertiesFromQos(AzurePSQoSEvent qos, IDictionary eventProperties)
{
- if (!IsMetricTermAccepted())
+ eventProperties.Add("IsSuccess", qos.IsSuccess.ToString());
+ eventProperties.Add("ModuleName", qos.ModuleName);
+ eventProperties.Add("ModuleVersion", qos.ModuleVersion);
+ eventProperties.Add("HostVersion", qos.HostVersion);
+ eventProperties.Add("OS", "Windows");
+ eventProperties.Add("CommandParameters", qos.Parameters);
+ eventProperties.Add("UserId", qos.Uid);
+ eventProperties.Add("x-ms-client-request-id", qos.ClientRequestId);
+ eventProperties.Add("UserAgent", AzurePowerShell.UserAgentValue.ToString());
+ if (qos.InputFromPipeline != null)
{
- return;
+ eventProperties.Add("InputFromPipeline", qos.InputFromPipeline.Value.ToString());
}
-
- var flushTask = Task.Run(() => FlushAi());
- if (waitForMetricSending)
+ if (qos.OutputToPipeline != null)
+ {
+ eventProperties.Add("OutputToPipeline", qos.OutputToPipeline.Value.ToString());
+ }
+ foreach (var key in qos.CustomProperties.Keys)
{
- Task.WaitAll(new[] { flushTask }, FlushTimeoutInMilli);
+ eventProperties[key] = qos.CustomProperties[key];
}
}
- private static void FlushAi()
+ public bool IsMetricTermAccepted()
{
+ return AzurePSCmdlet.IsDataCollectionAllowed();
+ }
+
+ public void FlushMetric()
+ {
+ if (!IsMetricTermAccepted())
+ {
+ return;
+ }
+
try
{
- TelemetryClient.Flush();
+ foreach (TelemetryClient client in TelemetryClients)
+ {
+ client.Flush();
+ }
}
catch
{
@@ -109,7 +202,7 @@ private static void FlushAi()
}
///
- /// Gereate a SHA256 Hash string from the originInput.
+ /// Generate a SHA256 Hash string from the originInput.
///
///
///
@@ -117,7 +210,7 @@ public static string GenerateSha256HashString(string originInput)
{
SHA256 sha256 = SHA256.Create();
var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(originInput));
- return Encoding.UTF8.GetString(bytes);
+ return BitConverter.ToString(bytes);
}
}
}
@@ -129,15 +222,25 @@ public class AzurePSQoSEvent
public DateTimeOffset StartTime { get; set; }
public TimeSpan Duration { get; set; }
public bool IsSuccess { get; set; }
- public string CmdletType { get; set; }
+ public string CommandName { get; set; }
+ public string ModuleName { get; set; }
+ public string ModuleVersion { get; set; }
+ public string HostVersion { get; set; }
+ public string Parameters { get; set; }
+ public bool? InputFromPipeline { get; set; }
+ public bool? OutputToPipeline { get; set; }
public Exception Exception { get; set; }
public string Uid { get; set; }
+ public string ClientRequestId { get; set; }
+ public string SessionId { get; set; }
+ public Dictionary CustomProperties { get; private set; }
public AzurePSQoSEvent()
{
StartTime = DateTimeOffset.Now;
_timer = new Stopwatch();
_timer.Start();
+ CustomProperties = new Dictionary();
}
public void PauseQoSTimer()
@@ -159,7 +262,7 @@ public void FinishQosEvent()
public override string ToString()
{
return string.Format(
- "AzureQoSEvent: CmdletType - {0}; IsSuccess - {1}; Duration - {2}; Exception - {3};",
- CmdletType, IsSuccess, Duration, Exception);
+ "AzureQoSEvent: CommandName - {0}; IsSuccess - {1}; Duration - {2}; Exception - {3};",
+ CommandName, IsSuccess, Duration, Exception);
}
}
diff --git a/src/Common/Commands.Common/RecordingTracingInterceptor.cs b/src/Common/Commands.Common/RecordingTracingInterceptor.cs
index ec8400ceb089..3bce7d23a45f 100644
--- a/src/Common/Commands.Common/RecordingTracingInterceptor.cs
+++ b/src/Common/Commands.Common/RecordingTracingInterceptor.cs
@@ -18,6 +18,7 @@
using System.Net.Http;
using Hyak.Common;
using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using Microsoft.WindowsAzure.Commands.Common;
namespace Microsoft.Azure.Common.Authentication.Models
{
@@ -34,17 +35,17 @@ private void Write(string message, params object[] arguments)
{
if (arguments == null || arguments.Length == 0)
{
- MessageQueue.Enqueue(message);
+ MessageQueue.CheckAndEnqueue(message);
}
else
{
- MessageQueue.Enqueue(string.Format(message, arguments));
+ MessageQueue.CheckAndEnqueue(string.Format(message, arguments));
}
}
public void Information(string message)
{
- MessageQueue.Enqueue(message);
+ MessageQueue.CheckAndEnqueue(message);
}
public void Configuration(string source, string name, string value)
diff --git a/src/Common/Commands.Common/ServiceClientTracingInterceptor.cs b/src/Common/Commands.Common/ServiceClientTracingInterceptor.cs
new file mode 100644
index 000000000000..f31983f778c7
--- /dev/null
+++ b/src/Common/Commands.Common/ServiceClientTracingInterceptor.cs
@@ -0,0 +1,79 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using Microsoft.Rest;
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+namespace Microsoft.WindowsAzure.Commands.Common
+{
+ class ServiceClientTracingInterceptor : IServiceClientTracingInterceptor
+ {
+ public ServiceClientTracingInterceptor(ConcurrentQueue queue)
+ {
+ MessageQueue = queue;
+ }
+
+ public ConcurrentQueue MessageQueue { get; private set; }
+
+ public void Configuration(string source, string name, string value)
+ {
+ // Ignore
+ }
+
+ public void EnterMethod(string invocationId, object instance, string method, IDictionary parameters)
+ {
+ // Ignore
+ }
+
+ public void ExitMethod(string invocationId, object returnValue)
+ {
+ // Ignore
+ }
+
+ public void Information(string message)
+ {
+ MessageQueue.CheckAndEnqueue(message);
+ }
+
+ public void ReceiveResponse(string invocationId, System.Net.Http.HttpResponseMessage response)
+ {
+ string responseAsString = response == null ? string.Empty : response.AsFormattedString();
+ MessageQueue.CheckAndEnqueue(responseAsString);
+ }
+
+ public void SendRequest(string invocationId, System.Net.Http.HttpRequestMessage request)
+ {
+ string requestAsString = request == null ? string.Empty : request.AsFormattedString();
+ MessageQueue.CheckAndEnqueue(requestAsString);
+ }
+
+ public void TraceError(string invocationId, Exception exception)
+ {
+ // Ignore
+ }
+
+ public static void RemoveTracingInterceptor(ServiceClientTracingInterceptor interceptor)
+ {
+ if (interceptor != null)
+ {
+ ServiceClientTracing.RemoveTracingInterceptor(interceptor);
+ }
+ }
+ }
+}
diff --git a/src/Common/Commands.Common/packages.config b/src/Common/Commands.Common/packages.config
index 56e45db6a9ea..8e0e6b34d330 100644
--- a/src/Common/Commands.Common/packages.config
+++ b/src/Common/Commands.Common/packages.config
@@ -1,12 +1,12 @@
-
+
-
+
@@ -15,5 +15,5 @@
-
+
\ No newline at end of file
diff --git a/src/Common/Commands.ScenarioTests.Common/Commands.ScenarioTests.Common.csproj b/src/Common/Commands.ScenarioTests.Common/Commands.ScenarioTests.Common.csproj
index 6b5b2ba95958..9ce8e7651511 100644
--- a/src/Common/Commands.ScenarioTests.Common/Commands.ScenarioTests.Common.csproj
+++ b/src/Common/Commands.ScenarioTests.Common/Commands.ScenarioTests.Common.csproj
@@ -40,7 +40,7 @@
- ..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -54,7 +54,7 @@
False
- ..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\packages\Microsoft.Azure.Test.Framework.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.Framework.dll
diff --git a/src/Common/Commands.ScenarioTests.Common/packages.config b/src/Common/Commands.ScenarioTests.Common/packages.config
index dd5cac117636..628912e1af92 100644
--- a/src/Common/Commands.ScenarioTests.Common/packages.config
+++ b/src/Common/Commands.ScenarioTests.Common/packages.config
@@ -1,10 +1,10 @@
-
+
-
+
diff --git a/src/Common/Storage/Commands.Storage.ScenarioTest/Commands.Storage.ScenarioTest.csproj b/src/Common/Storage/Commands.Storage.ScenarioTest/Commands.Storage.ScenarioTest.csproj
index 424eae6b10b8..bfca2da11775 100644
--- a/src/Common/Storage/Commands.Storage.ScenarioTest/Commands.Storage.ScenarioTest.csproj
+++ b/src/Common/Storage/Commands.Storage.ScenarioTest/Commands.Storage.ScenarioTest.csproj
@@ -58,15 +58,15 @@
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
True
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -82,8 +82,8 @@
False
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.2.0.3\lib\net40\Microsoft.WindowsAzure.Configuration.dll
+
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
@@ -106,7 +106,7 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/Common/Storage/Commands.Storage.ScenarioTest/packages.config b/src/Common/Storage/Commands.Storage.ScenarioTest/packages.config
index 7ba0a670b0f8..77ed416f55d3 100644
--- a/src/Common/Storage/Commands.Storage.ScenarioTest/packages.config
+++ b/src/Common/Storage/Commands.Storage.ScenarioTest/packages.config
@@ -10,7 +10,7 @@
-
+
diff --git a/src/Common/Storage/Commands.Storage.StorageTestLib/Commands.Storage.StorageTestLib.csproj b/src/Common/Storage/Commands.Storage.StorageTestLib/Commands.Storage.StorageTestLib.csproj
index bc0e10b02b11..31142574de44 100644
--- a/src/Common/Storage/Commands.Storage.StorageTestLib/Commands.Storage.StorageTestLib.csproj
+++ b/src/Common/Storage/Commands.Storage.StorageTestLib/Commands.Storage.StorageTestLib.csproj
@@ -49,20 +49,20 @@
..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
True
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
-
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.2.0.3\lib\net40\Microsoft.WindowsAzure.Configuration.dll
+
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
@@ -73,7 +73,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/Common/Storage/Commands.Storage.StorageTestLib/packages.config b/src/Common/Storage/Commands.Storage.StorageTestLib/packages.config
index 93ca2cb78267..2651c1d21a3f 100644
--- a/src/Common/Storage/Commands.Storage.StorageTestLib/packages.config
+++ b/src/Common/Storage/Commands.Storage.StorageTestLib/packages.config
@@ -4,7 +4,7 @@
-
+
diff --git a/src/Common/Storage/Commands.Storage.Test/Commands.Storage.Test.csproj b/src/Common/Storage/Commands.Storage.Test/Commands.Storage.Test.csproj
index 348394ff895d..4ed8113fafd4 100644
--- a/src/Common/Storage/Commands.Storage.Test/Commands.Storage.Test.csproj
+++ b/src/Common/Storage/Commands.Storage.Test/Commands.Storage.Test.csproj
@@ -52,7 +52,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -70,21 +70,21 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
True
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -116,8 +116,8 @@
False
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.2.0.3\lib\net40\Microsoft.WindowsAzure.Configuration.dll
+
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
..\..\..\packages\Microsoft.WindowsAzure.Management.4.1.1\lib\net40\Microsoft.WindowsAzure.Management.dll
@@ -150,7 +150,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/Common/Storage/Commands.Storage.Test/packages.config b/src/Common/Storage/Commands.Storage.Test/packages.config
index 2fb5d9cc1391..c27e522ae1bc 100644
--- a/src/Common/Storage/Commands.Storage.Test/packages.config
+++ b/src/Common/Storage/Commands.Storage.Test/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
@@ -17,7 +17,7 @@
-
+
diff --git a/src/Common/Storage/Commands.Storage/Commands.Storage.csproj b/src/Common/Storage/Commands.Storage/Commands.Storage.csproj
index 3c0dd78eeb66..b7426f2f9a5c 100644
--- a/src/Common/Storage/Commands.Storage/Commands.Storage.csproj
+++ b/src/Common/Storage/Commands.Storage/Commands.Storage.csproj
@@ -43,7 +43,7 @@
False
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
False
@@ -63,17 +63,17 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -105,8 +105,8 @@
False
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.2.0.3\lib\net40\Microsoft.WindowsAzure.Configuration.dll
+
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
..\..\..\packages\Microsoft.WindowsAzure.Management.4.1.1\lib\net40\Microsoft.WindowsAzure.Management.dll
@@ -143,7 +143,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/Common/Storage/Commands.Storage/packages.config b/src/Common/Storage/Commands.Storage/packages.config
index eb46fef74e2c..fd3cb756fb25 100644
--- a/src/Common/Storage/Commands.Storage/packages.config
+++ b/src/Common/Storage/Commands.Storage/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
@@ -16,7 +16,7 @@
-
+
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/Commands.ApiManagement.ServiceManagement.csproj b/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/Commands.ApiManagement.ServiceManagement.csproj
index dc227c8f5803..a2a76454eaeb 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/Commands.ApiManagement.ServiceManagement.csproj
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/Commands.ApiManagement.ServiceManagement.csproj
@@ -54,7 +54,7 @@
..\..\..\packages\AutoMapper.3.1.1\lib\net40\AutoMapper.Net4.dll
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -76,17 +76,17 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -100,9 +100,9 @@
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
+
False
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
False
@@ -136,7 +136,7 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/packages.config b/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/packages.config
index 9caa3c56f9fa..6690f5206b76 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/packages.config
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement.ServiceManagement/packages.config
@@ -1,13 +1,13 @@
-
+
-
+
@@ -18,7 +18,7 @@
-
+
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/Commands.ApiManagement.Test.csproj b/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/Commands.ApiManagement.Test.csproj
index 4de09f18f96a..e3a240b6ebf0 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/Commands.ApiManagement.Test.csproj
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/Commands.ApiManagement.Test.csproj
@@ -34,7 +34,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
True
@@ -67,7 +67,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/packages.config b/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/packages.config
index ab7eeaea2fbd..b377a412e7b7 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/packages.config
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement.Test/packages.config
@@ -1,12 +1,12 @@
-
+
-
+
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement/Commands.ApiManagement.csproj b/src/ResourceManager/ApiManagement/Commands.ApiManagement/Commands.ApiManagement.csproj
index 8966b42acb4a..49f67170991b 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement/Commands.ApiManagement.csproj
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement/Commands.ApiManagement.csproj
@@ -53,7 +53,7 @@
..\..\..\packages\AutoMapper.3.1.1\lib\net40\AutoMapper.Net4.dll
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -75,17 +75,17 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -115,9 +115,9 @@
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
+
False
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
False
@@ -143,7 +143,7 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/ApiManagement/Commands.ApiManagement/packages.config b/src/ResourceManager/ApiManagement/Commands.ApiManagement/packages.config
index 9caa3c56f9fa..6690f5206b76 100644
--- a/src/ResourceManager/ApiManagement/Commands.ApiManagement/packages.config
+++ b/src/ResourceManager/ApiManagement/Commands.ApiManagement/packages.config
@@ -1,13 +1,13 @@
-
+
-
+
@@ -18,7 +18,7 @@
-
+
diff --git a/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/Commands.ApiManagement.ServiceManagement.Test.csproj b/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/Commands.ApiManagement.ServiceManagement.Test.csproj
index 7b7f9289e6d0..5e3e5bae4c67 100644
--- a/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/Commands.ApiManagement.ServiceManagement.Test.csproj
+++ b/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/Commands.ApiManagement.ServiceManagement.Test.csproj
@@ -34,7 +34,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
True
@@ -67,7 +67,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -118,7 +118,7 @@
..\..\..\packages\Microsoft.WindowsAzure.Management.Storage.5.1.1\lib\net40\Microsoft.WindowsAzure.Management.Storage.dll
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/packages.config b/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/packages.config
index a7732656eb12..ca01f1350951 100644
--- a/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/packages.config
+++ b/src/ResourceManager/ApiManagement/Commands.SMAPI.Test/packages.config
@@ -1,12 +1,12 @@
-
+
-
+
@@ -21,7 +21,7 @@
-
+
\ No newline at end of file
diff --git a/src/ResourceManager/Automation/Commands.Automation.Test/Commands.Automation.Test.csproj b/src/ResourceManager/Automation/Commands.Automation.Test/Commands.Automation.Test.csproj
index b063401c4886..05770ce7b707 100644
--- a/src/ResourceManager/Automation/Commands.Automation.Test/Commands.Automation.Test.csproj
+++ b/src/ResourceManager/Automation/Commands.Automation.Test/Commands.Automation.Test.csproj
@@ -51,7 +51,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -65,7 +65,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
diff --git a/src/ResourceManager/Automation/Commands.Automation.Test/packages.config b/src/ResourceManager/Automation/Commands.Automation.Test/packages.config
index ae8ac40337b9..ea87477df30a 100644
--- a/src/ResourceManager/Automation/Commands.Automation.Test/packages.config
+++ b/src/ResourceManager/Automation/Commands.Automation.Test/packages.config
@@ -1,10 +1,10 @@
-
+
-
+
diff --git a/src/ResourceManager/Automation/Commands.Automation/Commands.Automation.csproj b/src/ResourceManager/Automation/Commands.Automation/Commands.Automation.csproj
index 48a92c58db78..eb5ac70d3dce 100644
--- a/src/ResourceManager/Automation/Commands.Automation/Commands.Automation.csproj
+++ b/src/ResourceManager/Automation/Commands.Automation/Commands.Automation.csproj
@@ -53,7 +53,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
False
@@ -69,7 +69,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
diff --git a/src/ResourceManager/Automation/Commands.Automation/packages.config b/src/ResourceManager/Automation/Commands.Automation/packages.config
index 7bb2c84dda79..f30921fc01ab 100644
--- a/src/ResourceManager/Automation/Commands.Automation/packages.config
+++ b/src/ResourceManager/Automation/Commands.Automation/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
diff --git a/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/Commands.AzureBackup.Test.csproj b/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/Commands.AzureBackup.Test.csproj
index 2202ab7d435f..cc18e04ddcbb 100644
--- a/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/Commands.AzureBackup.Test.csproj
+++ b/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/Commands.AzureBackup.Test.csproj
@@ -45,10 +45,10 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -91,7 +91,7 @@
..\..\..\packages\Microsoft.WindowsAzure.Management.4.1.1\lib\net40\Microsoft.WindowsAzure.Management.dll
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/packages.config b/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/packages.config
index fe08182b4932..8b6b24901b11 100644
--- a/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/packages.config
+++ b/src/ResourceManager/AzureBackup/Commands.AzureBackup.Test/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
@@ -16,7 +16,7 @@
-
+
diff --git a/src/ResourceManager/AzureBackup/Commands.AzureBackup/Commands.AzureBackup.csproj b/src/ResourceManager/AzureBackup/Commands.AzureBackup/Commands.AzureBackup.csproj
index b30acadc8b12..29cb5d9b9a3b 100644
--- a/src/ResourceManager/AzureBackup/Commands.AzureBackup/Commands.AzureBackup.csproj
+++ b/src/ResourceManager/AzureBackup/Commands.AzureBackup/Commands.AzureBackup.csproj
@@ -44,7 +44,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -62,7 +62,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
diff --git a/src/ResourceManager/AzureBackup/Commands.AzureBackup/packages.config b/src/ResourceManager/AzureBackup/Commands.AzureBackup/packages.config
index a9cdde4e58fd..b3890ae8f89f 100644
--- a/src/ResourceManager/AzureBackup/Commands.AzureBackup/packages.config
+++ b/src/ResourceManager/AzureBackup/Commands.AzureBackup/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
@@ -16,5 +16,5 @@
-
+
\ No newline at end of file
diff --git a/src/ResourceManager/AzureBatch/Commands.Batch.Test/Commands.Batch.Test.csproj b/src/ResourceManager/AzureBatch/Commands.Batch.Test/Commands.Batch.Test.csproj
index 60c739422baa..6bafb412845f 100644
--- a/src/ResourceManager/AzureBatch/Commands.Batch.Test/Commands.Batch.Test.csproj
+++ b/src/ResourceManager/AzureBatch/Commands.Batch.Test/Commands.Batch.Test.csproj
@@ -41,7 +41,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Azure.Batch.3.0.0\lib\net45\Microsoft.Azure.Batch.dll
@@ -67,7 +67,7 @@
..\..\..\packages\Microsoft.Azure.Management.Batch.1.5.0\lib\net40\Microsoft.Azure.Management.Batch.dll
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -77,17 +77,17 @@
False
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.2\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.2\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.2\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
False
@@ -106,14 +106,18 @@
True
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
..\..\..\packages\Microsoft.WindowsAzure.Management.4.1.1\lib\net40\Microsoft.WindowsAzure.Management.dll
-
+
False
- ..\..\..\packages\WindowsAzure.Storage.4.3.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
+ True
False
@@ -130,9 +134,9 @@
..\..\..\packages\Moq.4.2.1402.2112\lib\net40\Moq.dll
-
+
False
- ..\..\..\packages\System.Spatial.5.6.2\lib\net40\System.Spatial.dll
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
@@ -157,7 +161,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
..\..\..\packages\xunit.1.9.2\lib\net20\xunit.dll
diff --git a/src/ResourceManager/AzureBatch/Commands.Batch.Test/packages.config b/src/ResourceManager/AzureBatch/Commands.Batch.Test/packages.config
index 630b3384dfc9..b156e425434e 100644
--- a/src/ResourceManager/AzureBatch/Commands.Batch.Test/packages.config
+++ b/src/ResourceManager/AzureBatch/Commands.Batch.Test/packages.config
@@ -1,32 +1,33 @@
-
+
-
+
-
-
-
+
+
+
-
+
-
-
-
+
+
+
+
diff --git a/src/ResourceManager/AzureBatch/Commands.Batch/Commands.Batch.csproj b/src/ResourceManager/AzureBatch/Commands.Batch/Commands.Batch.csproj
index 1f0e16f9d639..842a684a59eb 100644
--- a/src/ResourceManager/AzureBatch/Commands.Batch/Commands.Batch.csproj
+++ b/src/ResourceManager/AzureBatch/Commands.Batch/Commands.Batch.csproj
@@ -42,7 +42,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Azure.Batch.3.0.0\lib\net45\Microsoft.Azure.Batch.dll
@@ -62,7 +62,7 @@
..\..\..\packages\Microsoft.Azure.Management.Batch.1.5.0\lib\net40\Microsoft.Azure.Management.Batch.dll
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -72,17 +72,17 @@
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll
True
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.0\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.0\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.0\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
False
@@ -101,15 +101,19 @@
..\..\..\packages\Microsoft.WindowsAzure.Management.4.1.1\lib\net40\Microsoft.WindowsAzure.Management.dll
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
-
- ..\..\..\packages\WindowsAzure.Storage.4.3.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ True
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
True
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
..\..\..\packages\Microsoft.Rest.ClientRuntime.1.8.2\lib\net45\Microsoft.Rest.ClientRuntime.dll
@@ -138,8 +142,8 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
- ..\..\..\packages\System.Spatial.5.6.2\lib\net40\System.Spatial.dll
+
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
True
diff --git a/src/ResourceManager/AzureBatch/Commands.Batch/packages.config b/src/ResourceManager/AzureBatch/Commands.Batch/packages.config
index d81f22004968..1af0bd643b22 100644
--- a/src/ResourceManager/AzureBatch/Commands.Batch/packages.config
+++ b/src/ResourceManager/AzureBatch/Commands.Batch/packages.config
@@ -1,25 +1,26 @@
-
+
-
+
-
-
-
+
+
+
-
+
-
-
-
+
+
+
+
\ No newline at end of file
diff --git a/src/ResourceManager/Common/Commands.ResourceManager.Common/AzureRMCmdlet.cs b/src/ResourceManager/Common/Commands.ResourceManager.Common/AzureRMCmdlet.cs
index c78977756d69..238c054030c1 100644
--- a/src/ResourceManager/Common/Commands.ResourceManager.Common/AzureRMCmdlet.cs
+++ b/src/ResourceManager/Common/Commands.ResourceManager.Common/AzureRMCmdlet.cs
@@ -14,6 +14,7 @@
using System;
using System.IO;
+using System.Linq;
using System.Management.Automation;
using System.Management.Automation.Host;
using System.Threading;
@@ -24,6 +25,7 @@
using Microsoft.WindowsAzure.Commands.Common;
using Microsoft.WindowsAzure.Commands.Utilities.Common;
using Newtonsoft.Json;
+using System.Globalization;
namespace Microsoft.Azure.Commands.ResourceManager.Common
{
@@ -142,21 +144,41 @@ protected override void PromptForDataCollectionProfileIfNotExists()
protected override void InitializeQosEvent()
{
- //QosEvent = new AzurePSQoSEvent()
- //{
- // CmdletType = this.GetType().Name,
- // IsSuccess = true,
- //};
-
- //if (this.Context != null && this.Context.Subscription != null)
- //{
- // QosEvent.Uid = MetricHelper.GenerateSha256HashString(
- // this.Context.Subscription.Id.ToString());
- //}
- //else
- //{
- // QosEvent.Uid = "defaultid";
- //}
+ var commandAlias = this.GetType().Name;
+ if(this.MyInvocation != null && this.MyInvocation.MyCommand != null)
+ {
+ commandAlias = this.MyInvocation.MyCommand.Name;
+ }
+
+ QosEvent = new AzurePSQoSEvent()
+ {
+ CommandName = commandAlias,
+ ModuleName = this.GetType().Assembly.GetName().Name,
+ ModuleVersion = this.GetType().Assembly.GetName().Version.ToString(),
+ ClientRequestId = this._clientRequestId,
+ SessionId = _sessionId,
+ IsSuccess = true,
+ };
+
+ if (this.MyInvocation != null && this.MyInvocation.BoundParameters != null)
+ {
+ QosEvent.Parameters = string.Join(" ",
+ this.MyInvocation.BoundParameters.Keys.Select(
+ s => string.Format(CultureInfo.InvariantCulture, "-{0} ***", s)));
+ }
+
+ if (this.DefaultProfile != null &&
+ this.DefaultProfile.Context != null &&
+ this.DefaultProfile.Context.Account != null &&
+ this.DefaultProfile.Context.Account.Id != null)
+ {
+ QosEvent.Uid = MetricHelper.GenerateSha256HashString(
+ this.DefaultProfile.Context.Account.Id.ToString());
+ }
+ else
+ {
+ QosEvent.Uid = "defaultid";
+ }
}
}
}
diff --git a/src/ResourceManager/Common/Commands.ResourceManager.Common/Commands.ResourceManager.Common.csproj b/src/ResourceManager/Common/Commands.ResourceManager.Common/Commands.ResourceManager.Common.csproj
index df2c4e8e5903..7cceb2060c91 100644
--- a/src/ResourceManager/Common/Commands.ResourceManager.Common/Commands.ResourceManager.Common.csproj
+++ b/src/ResourceManager/Common/Commands.ResourceManager.Common/Commands.ResourceManager.Common.csproj
@@ -51,7 +51,7 @@
False
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.ApplicationInsights.1.1.1-beta\lib\net45\Microsoft.ApplicationInsights.dll
@@ -101,7 +101,7 @@
True
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
True
diff --git a/src/ResourceManager/Common/Commands.ResourceManager.Common/packages.config b/src/ResourceManager/Common/Commands.ResourceManager.Common/packages.config
index b341d0164f1c..c6175366c45b 100644
--- a/src/ResourceManager/Common/Commands.ResourceManager.Common/packages.config
+++ b/src/ResourceManager/Common/Commands.ResourceManager.Common/packages.config
@@ -1,6 +1,6 @@
-
+
@@ -14,5 +14,5 @@
-
+
\ No newline at end of file
diff --git a/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/Commands.ScenarioTests.ResourceManager.Common.csproj b/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/Commands.ScenarioTests.ResourceManager.Common.csproj
index cda8c8b41388..b4dc54f96689 100644
--- a/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/Commands.ScenarioTests.ResourceManager.Common.csproj
+++ b/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/Commands.ScenarioTests.ResourceManager.Common.csproj
@@ -40,7 +40,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
diff --git a/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/packages.config b/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/packages.config
index 8665a13e15b0..628912e1af92 100644
--- a/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/packages.config
+++ b/src/ResourceManager/Common/Commands.ScenarioTests.ResourceManager.Common/packages.config
@@ -1,6 +1,6 @@
-
+
diff --git a/src/ResourceManager/Compute/Commands.Compute.Test/Commands.Compute.Test.csproj b/src/ResourceManager/Compute/Commands.Compute.Test/Commands.Compute.Test.csproj
index ad1b8f00e7ac..b5447ff0f18d 100644
--- a/src/ResourceManager/Compute/Commands.Compute.Test/Commands.Compute.Test.csproj
+++ b/src/ResourceManager/Compute/Commands.Compute.Test/Commands.Compute.Test.csproj
@@ -44,7 +44,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -80,7 +80,7 @@
..\..\..\packages\Microsoft.Azure.Management.Storage.3.0.0\lib\net40\Microsoft.Azure.Management.Storage.dll
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Test.Framework.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.Framework.dll
diff --git a/src/ResourceManager/Compute/Commands.Compute.Test/packages.config b/src/ResourceManager/Compute/Commands.Compute.Test/packages.config
index 07b133379b6f..5cee1d999daf 100644
--- a/src/ResourceManager/Compute/Commands.Compute.Test/packages.config
+++ b/src/ResourceManager/Compute/Commands.Compute.Test/packages.config
@@ -1,6 +1,6 @@
-
+
diff --git a/src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj b/src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj
index e5bcb7d56120..e070c9438c07 100644
--- a/src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj
+++ b/src/ResourceManager/Compute/Commands.Compute/Commands.Compute.csproj
@@ -53,7 +53,7 @@
..\..\..\packages\AutoMapper.3.1.1\lib\net40\AutoMapper.dll
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -92,15 +92,15 @@
..\..\..\packages\Microsoft.Azure.Management.Storage.3.0.0\lib\net40\Microsoft.Azure.Management.Storage.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -162,7 +162,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs b/src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs
index 0572458f6fd9..902b2907527b 100644
--- a/src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs
+++ b/src/ResourceManager/Compute/Commands.Compute/Extension/AzureDiskEncryption/SetAzureDiskEncryptionExtension.cs
@@ -309,7 +309,7 @@ private AzureOperationResponse UpdateVmEncryptionSettings()
parameters).GetAwaiter().GetResult();
}
- private string GetExtensionPublicSettings()
+ private Hashtable GetExtensionPublicSettings()
{
Hashtable publicSettings = new Hashtable();
publicSettings.Add(aadClientIDKey, AadClientID ?? String.Empty);
@@ -321,10 +321,10 @@ private string GetExtensionPublicSettings()
publicSettings.Add(encryptionOperationKey, enableEncryptionOperation);
publicSettings.Add(sequenceVersionKey, SequenceVersion ?? String.Empty);
- return JsonConvert.SerializeObject(publicSettings);
+ return publicSettings;
}
- private string GetExtensionProtectedSettings()
+ private Hashtable GetExtensionProtectedSettings()
{
Hashtable protectedSettings = new Hashtable();
protectedSettings.Add(aadClientSecretKey, AadClientSecret ?? String.Empty);
@@ -332,13 +332,13 @@ private string GetExtensionProtectedSettings()
{
protectedSettings.Add(passphraseKey, Passphrase ?? null);
}
- return JsonConvert.SerializeObject(protectedSettings);
+ return protectedSettings;
}
private VirtualMachineExtension GetVmExtensionParameters(VirtualMachine vmParameters)
{
- string SettingString = GetExtensionPublicSettings();
- string ProtectedSettingString = GetExtensionProtectedSettings();
+ Hashtable SettingString = GetExtensionPublicSettings();
+ Hashtable ProtectedSettingString = GetExtensionProtectedSettings();
if (vmParameters == null)
{
diff --git a/src/ResourceManager/Compute/Commands.Compute/packages.config b/src/ResourceManager/Compute/Commands.Compute/packages.config
index 2d91743f349f..2eb51e8913e7 100644
--- a/src/ResourceManager/Compute/Commands.Compute/packages.config
+++ b/src/ResourceManager/Compute/Commands.Compute/packages.config
@@ -1,7 +1,7 @@
-
+
diff --git a/src/ResourceManager/DataFactories/Commands.DataFactories.Test/Commands.DataFactories.Test.csproj b/src/ResourceManager/DataFactories/Commands.DataFactories.Test/Commands.DataFactories.Test.csproj
index 9bd6f17f72e1..48d584209e55 100644
--- a/src/ResourceManager/DataFactories/Commands.DataFactories.Test/Commands.DataFactories.Test.csproj
+++ b/src/ResourceManager/DataFactories/Commands.DataFactories.Test/Commands.DataFactories.Test.csproj
@@ -43,7 +43,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -67,13 +67,12 @@
False
..\..\..\packages\Microsoft.Azure.Management.Authorization.2.0.0\lib\net40\Microsoft.Azure.Management.Authorization.dll
-
- False
- ..\..\..\packages\Microsoft.Azure.Management.DataFactories.4.1.0\lib\net45\Microsoft.Azure.Management.DataFactories.dll
+
+ ..\..\..\packages\Microsoft.Azure.Management.DataFactories.4.3.0\lib\net45\Microsoft.Azure.Management.DataFactories.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -83,15 +82,15 @@
False
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -154,7 +153,7 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/DataFactories/Commands.DataFactories.Test/packages.config b/src/ResourceManager/DataFactories/Commands.DataFactories.Test/packages.config
index 964994e720e0..9af15537b80d 100644
--- a/src/ResourceManager/DataFactories/Commands.DataFactories.Test/packages.config
+++ b/src/ResourceManager/DataFactories/Commands.DataFactories.Test/packages.config
@@ -1,14 +1,14 @@
-
+
-
-
+
+
diff --git a/src/ResourceManager/DataFactories/Commands.DataFactories/Commands.DataFactories.csproj b/src/ResourceManager/DataFactories/Commands.DataFactories/Commands.DataFactories.csproj
index 8282a860731a..e7f9f66567d1 100644
--- a/src/ResourceManager/DataFactories/Commands.DataFactories/Commands.DataFactories.csproj
+++ b/src/ResourceManager/DataFactories/Commands.DataFactories/Commands.DataFactories.csproj
@@ -49,7 +49,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -67,21 +67,21 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.DataFactories.4.1.0\lib\net45\Microsoft.Azure.Management.DataFactories.dll
+ ..\..\..\packages\Microsoft.Azure.Management.DataFactories.4.3.0\lib\net45\Microsoft.Azure.Management.DataFactories.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -142,7 +142,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/DataFactories/Commands.DataFactories/packages.config b/src/ResourceManager/DataFactories/Commands.DataFactories/packages.config
index 347cb89ff452..07e31155d884 100644
--- a/src/ResourceManager/DataFactories/Commands.DataFactories/packages.config
+++ b/src/ResourceManager/DataFactories/Commands.DataFactories/packages.config
@@ -1,12 +1,12 @@
-
+
-
-
+
+
diff --git a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/Commands.DataLakeAnalytics.Test.csproj b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/Commands.DataLakeAnalytics.Test.csproj
index 5c646c241309..440b2b187279 100644
--- a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/Commands.DataLakeAnalytics.Test.csproj
+++ b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/Commands.DataLakeAnalytics.Test.csproj
@@ -79,7 +79,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.0-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -125,7 +125,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/packages.config b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/packages.config
index d6ee8a05871e..19baf40625b6 100644
--- a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/packages.config
+++ b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics.Test/packages.config
@@ -8,7 +8,7 @@
-
+
@@ -21,7 +21,7 @@
-
+
diff --git a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/Commands.DataLakeAnalytics.csproj b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/Commands.DataLakeAnalytics.csproj
index bfb869bdf504..6153621c7a32 100644
--- a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/Commands.DataLakeAnalytics.csproj
+++ b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/Commands.DataLakeAnalytics.csproj
@@ -63,7 +63,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.0-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -98,7 +98,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/packages.config b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/packages.config
index 1bd719431a61..0e8b9747585b 100644
--- a/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/packages.config
+++ b/src/ResourceManager/DataLakeAnalytics/Commands.DataLakeAnalytics/packages.config
@@ -7,7 +7,7 @@
-
+
@@ -16,5 +16,5 @@
-
+
\ No newline at end of file
diff --git a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/Commands.DataLakeStore.Test.csproj b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/Commands.DataLakeStore.Test.csproj
index aa50a3f3a627..2ec8d26f725a 100644
--- a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/Commands.DataLakeStore.Test.csproj
+++ b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/Commands.DataLakeStore.Test.csproj
@@ -72,7 +72,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.0-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -119,7 +119,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/packages.config b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/packages.config
index af227ce6bebe..674ac8bb70a3 100644
--- a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/packages.config
+++ b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore.Test/packages.config
@@ -7,7 +7,7 @@
-
+
@@ -19,7 +19,7 @@
-
+
diff --git a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/Commands.DataLakeStore.csproj b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/Commands.DataLakeStore.csproj
index 94259e71f270..dfd217534205 100644
--- a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/Commands.DataLakeStore.csproj
+++ b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/Commands.DataLakeStore.csproj
@@ -63,7 +63,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.0-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -98,7 +98,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
diff --git a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/packages.config b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/packages.config
index 88f6b408f871..9a08c4351c86 100644
--- a/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/packages.config
+++ b/src/ResourceManager/DataLakeStore/Commands.DataLakeStore/packages.config
@@ -7,7 +7,7 @@
-
+
@@ -16,5 +16,5 @@
-
+
\ No newline at end of file
diff --git a/src/ResourceManager/Dns/Commands.Dns.Test/Commands.Dns.Test.csproj b/src/ResourceManager/Dns/Commands.Dns.Test/Commands.Dns.Test.csproj
index eb2d70735699..77384d4858b5 100644
--- a/src/ResourceManager/Dns/Commands.Dns.Test/Commands.Dns.Test.csproj
+++ b/src/ResourceManager/Dns/Commands.Dns.Test/Commands.Dns.Test.csproj
@@ -45,7 +45,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
False
@@ -68,7 +68,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
diff --git a/src/ResourceManager/Dns/Commands.Dns.Test/packages.config b/src/ResourceManager/Dns/Commands.Dns.Test/packages.config
index 16faed6f448b..f9767c5707f3 100644
--- a/src/ResourceManager/Dns/Commands.Dns.Test/packages.config
+++ b/src/ResourceManager/Dns/Commands.Dns.Test/packages.config
@@ -1,11 +1,11 @@
-
+
-
+
diff --git a/src/ResourceManager/Dns/Commands.Dns/Commands.Dns.csproj b/src/ResourceManager/Dns/Commands.Dns/Commands.Dns.csproj
index 13d68e41867b..7829a9aaa72c 100644
--- a/src/ResourceManager/Dns/Commands.Dns/Commands.Dns.csproj
+++ b/src/ResourceManager/Dns/Commands.Dns/Commands.Dns.csproj
@@ -89,7 +89,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
False
@@ -108,19 +108,19 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.NetFramework.dll
-
- ..\..\..\packages\Microsoft.Data.Edm.5.6.0\lib\net40\Microsoft.Data.Edm.dll
+
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
- ..\..\..\packages\Microsoft.Data.OData.5.6.0\lib\net40\Microsoft.Data.OData.dll
+
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.0\lib\net40\Microsoft.Data.Services.Client.dll
+
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -144,7 +144,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.6\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
@@ -164,8 +164,8 @@
..\..\..\packages\Microsoft.Net.Http.2.2.28\lib\net45\System.Net.Http.Primitives.dll
-
- ..\..\..\packages\System.Spatial.5.6.0\lib\net40\System.Spatial.dll
+
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/Dns/Commands.Dns/packages.config b/src/ResourceManager/Dns/Commands.Dns/packages.config
index ee921124b7f0..ea168b1c2bd9 100644
--- a/src/ResourceManager/Dns/Commands.Dns/packages.config
+++ b/src/ResourceManager/Dns/Commands.Dns/packages.config
@@ -1,22 +1,22 @@
-
+
-
+
-
-
-
+
+
+
-
-
+
+
\ No newline at end of file
diff --git a/src/ResourceManager/HDInsight/Commands.HDInsight.Test/Commands.HDInsight.Test.csproj b/src/ResourceManager/HDInsight/Commands.HDInsight.Test/Commands.HDInsight.Test.csproj
index efacfb1940bf..2aea4b0df79c 100644
--- a/src/ResourceManager/HDInsight/Commands.HDInsight.Test/Commands.HDInsight.Test.csproj
+++ b/src/ResourceManager/HDInsight/Commands.HDInsight.Test/Commands.HDInsight.Test.csproj
@@ -33,7 +33,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -55,15 +55,15 @@
False
..\..\..\packages\Microsoft.Azure.Management.HDInsight.1.0.9-preview\lib\net40\Microsoft.Azure.Management.HDInsight.dll
-
+
False
- ..\..\..\packages\Microsoft.Azure.Management.HDInsight.Job.1.0.7-preview\lib\net40\Microsoft.Azure.Management.HDInsight.Job.dll
+ ..\..\..\packages\Microsoft.Azure.Management.HDInsight.Job.1.1.0-preview\lib\net40\Microsoft.Azure.Management.HDInsight.Job.dll
..\..\..\packages\Microsoft.Azure.Management.Storage.2.4.0-preview\lib\net40\Microsoft.Azure.Management.Storage.dll
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.0-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Test.Framework.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.Framework.dll
@@ -73,17 +73,17 @@
..\..\..\packages\Microsoft.Azure.Test.HttpRecorder.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.HttpRecorder.dll
True
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.2\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.2\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.2\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -110,16 +110,20 @@
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
+
False
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
-
+
False
- ..\..\..\packages\WindowsAzure.Storage.4.3.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
+ True
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
False
@@ -132,9 +136,9 @@
-
+
False
- ..\..\..\packages\System.Spatial.5.6.2\lib\net40\System.Spatial.dll
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/HDInsight/Commands.HDInsight.Test/packages.config b/src/ResourceManager/HDInsight/Commands.HDInsight.Test/packages.config
index 58d7365ef651..9d00c325d0f1 100644
--- a/src/ResourceManager/HDInsight/Commands.HDInsight.Test/packages.config
+++ b/src/ResourceManager/HDInsight/Commands.HDInsight.Test/packages.config
@@ -1,32 +1,33 @@
-
+
-
-
+
+
-
-
-
+
+
+
-
+
-
-
-
+
+
+
+
diff --git a/src/ResourceManager/HDInsight/Commands.HDInsight/Commands.HDInsight.csproj b/src/ResourceManager/HDInsight/Commands.HDInsight/Commands.HDInsight.csproj
index be58be3deaf0..c6a50f67dc11 100644
--- a/src/ResourceManager/HDInsight/Commands.HDInsight/Commands.HDInsight.csproj
+++ b/src/ResourceManager/HDInsight/Commands.HDInsight/Commands.HDInsight.csproj
@@ -121,25 +121,25 @@
False
..\..\..\packages\Microsoft.Azure.Management.HDInsight.1.0.9-preview\lib\net40\Microsoft.Azure.Management.HDInsight.dll
-
+
False
- ..\..\..\packages\Microsoft.Azure.Management.HDInsight.Job.1.0.7-preview\lib\net40\Microsoft.Azure.Management.HDInsight.Job.dll
+ ..\..\..\packages\Microsoft.Azure.Management.HDInsight.Job.1.1.0-preview\lib\net40\Microsoft.Azure.Management.HDInsight.Job.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.2\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.2\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.2\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -156,17 +156,21 @@
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
-
+
False
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
-
+
False
- ..\..\..\packages\WindowsAzure.Storage.4.3.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
+ True
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
..\..\..\packages\Microsoft.Rest.ClientRuntime.1.8.2\lib\net45\Microsoft.Rest.ClientRuntime.dll
@@ -182,9 +186,9 @@
-
+
False
- ..\..\..\packages\System.Spatial.5.6.2\lib\net40\System.Spatial.dll
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/HDInsight/Commands.HDInsight/packages.config b/src/ResourceManager/HDInsight/Commands.HDInsight/packages.config
index e607ba8612e8..ee2ccd8a118b 100644
--- a/src/ResourceManager/HDInsight/Commands.HDInsight/packages.config
+++ b/src/ResourceManager/HDInsight/Commands.HDInsight/packages.config
@@ -6,21 +6,22 @@
-
-
+
+
-
-
-
+
+
+
-
-
-
-
+
+
+
+
+
\ No newline at end of file
diff --git a/src/ResourceManager/Insights/Commands.Insights.Test/Commands.Insights.Test.csproj b/src/ResourceManager/Insights/Commands.Insights.Test/Commands.Insights.Test.csproj
index 441347ee7cc8..364d3a793d65 100644
--- a/src/ResourceManager/Insights/Commands.Insights.Test/Commands.Insights.Test.csproj
+++ b/src/ResourceManager/Insights/Commands.Insights.Test/Commands.Insights.Test.csproj
@@ -45,7 +45,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -58,11 +58,11 @@
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.NetFramework.dll
- ..\..\..\packages\Microsoft.Azure.Insights.0.9.1-preview\lib\net45\Microsoft.Azure.Insights.dll
+ ..\..\..\packages\Microsoft.Azure.Insights.0.10.0-preview\lib\net45\Microsoft.Azure.Insights.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -80,17 +80,17 @@
..\..\..\packages\Microsoft.Rest.ClientRuntime.Azure.Authentication.0.11.0\lib\net45\Microsoft.Rest.ClientRuntime.Azure.Authentication.dll
True
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.0\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.0\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.0\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
False
@@ -105,10 +105,15 @@
..\..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.Extensions.Desktop.dll
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
- ..\..\..\packages\WindowsAzure.Storage.4.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ False
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
+ True
False
@@ -127,8 +132,8 @@
-
- ..\..\..\packages\System.Spatial.5.6.0\lib\net40\System.Spatial.dll
+
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
..\..\..\packages\xunit.1.9.2\lib\net20\xunit.dll
diff --git a/src/ResourceManager/Insights/Commands.Insights.Test/packages.config b/src/ResourceManager/Insights/Commands.Insights.Test/packages.config
index 90abf4c8263b..e0d6d878784c 100644
--- a/src/ResourceManager/Insights/Commands.Insights.Test/packages.config
+++ b/src/ResourceManager/Insights/Commands.Insights.Test/packages.config
@@ -1,28 +1,29 @@
-
+
-
-
+
+
-
-
-
+
+
+
-
+
-
-
+
+
+
diff --git a/src/ResourceManager/Insights/Commands.Insights/Commands.Insights.csproj b/src/ResourceManager/Insights/Commands.Insights/Commands.Insights.csproj
index f595dd364878..f9a4db2749b1 100644
--- a/src/ResourceManager/Insights/Commands.Insights/Commands.Insights.csproj
+++ b/src/ResourceManager/Insights/Commands.Insights/Commands.Insights.csproj
@@ -44,7 +44,7 @@
False
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -57,23 +57,23 @@
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.NetFramework.dll
- ..\..\..\packages\Microsoft.Azure.Insights.0.9.1-preview\lib\net45\Microsoft.Azure.Insights.dll
+ ..\..\..\packages\Microsoft.Azure.Insights.0.10.0-preview\lib\net45\Microsoft.Azure.Insights.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Edm.5.6.0\lib\net40\Microsoft.Data.Edm.dll
+ ..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.OData.5.6.0\lib\net40\Microsoft.Data.OData.dll
+ ..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
- ..\..\..\packages\Microsoft.Data.Services.Client.5.6.0\lib\net40\Microsoft.Data.Services.Client.dll
+ ..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -91,12 +91,16 @@
..\..\..\packages\Microsoft.Rest.ClientRuntime.Azure.Authentication.0.11.0\lib\net45\Microsoft.Rest.ClientRuntime.Azure.Authentication.dll
True
-
- ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.1.8.0.0\lib\net35-full\Microsoft.WindowsAzure.Configuration.dll
+
+ ..\..\..\packages\Microsoft.WindowsAzure.ConfigurationManager.3.2.0\lib\net40\Microsoft.WindowsAzure.Configuration.dll
-
+
False
- ..\..\..\packages\WindowsAzure.Storage.4.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+ ..\..\..\packages\WindowsAzure.Storage.6.0.0\lib\net40\Microsoft.WindowsAzure.Storage.dll
+
+
+ ..\..\..\packages\Microsoft.Azure.KeyVault.Core.1.0.0\lib\net40\Microsoft.Azure.KeyVault.Core.dll
+ True
False
@@ -108,9 +112,9 @@
-
+
False
- ..\..\..\packages\System.Spatial.5.6.0\lib\net40\System.Spatial.dll
+ ..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/Insights/Commands.Insights/InsightsCmdletBase.cs b/src/ResourceManager/Insights/Commands.Insights/InsightsCmdletBase.cs
index 57228ae87d04..666fb9857517 100644
--- a/src/ResourceManager/Insights/Commands.Insights/InsightsCmdletBase.cs
+++ b/src/ResourceManager/Insights/Commands.Insights/InsightsCmdletBase.cs
@@ -24,7 +24,7 @@ namespace Microsoft.Azure.Commands.Insights
public abstract class InsightsCmdletBase : AzureRMCmdlet
{
///
- /// Executes the Cmdlet. This is a callback function to simplify the execption handling
+ /// Executes the Cmdlet. This is a callback function to simplify the exception handling
///
protected abstract void ProcessRecordInternal();
diff --git a/src/ResourceManager/Insights/Commands.Insights/packages.config b/src/ResourceManager/Insights/Commands.Insights/packages.config
index 77430f934748..e0796c5fd5ab 100644
--- a/src/ResourceManager/Insights/Commands.Insights/packages.config
+++ b/src/ResourceManager/Insights/Commands.Insights/packages.config
@@ -1,23 +1,24 @@
-
+
-
-
+
+
-
-
-
+
+
+
-
+
-
-
+
+
+
diff --git a/src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj b/src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj
index 7b26d8db740b..266b8e937aa1 100644
--- a/src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj
+++ b/src/ResourceManager/KeyVault/Commands.KeyVault.Test/Commands.KeyVault.Test.csproj
@@ -51,7 +51,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -83,7 +83,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
diff --git a/src/ResourceManager/KeyVault/Commands.KeyVault.Test/packages.config b/src/ResourceManager/KeyVault/Commands.KeyVault.Test/packages.config
index 6f582e139417..8764a140bed1 100644
--- a/src/ResourceManager/KeyVault/Commands.KeyVault.Test/packages.config
+++ b/src/ResourceManager/KeyVault/Commands.KeyVault.Test/packages.config
@@ -1,6 +1,6 @@
-
+
@@ -8,7 +8,7 @@
-
+
diff --git a/src/ResourceManager/KeyVault/Commands.KeyVault/Commands.KeyVault.csproj b/src/ResourceManager/KeyVault/Commands.KeyVault/Commands.KeyVault.csproj
index 2cb80cd792fd..92f630ce507e 100644
--- a/src/ResourceManager/KeyVault/Commands.KeyVault/Commands.KeyVault.csproj
+++ b/src/ResourceManager/KeyVault/Commands.KeyVault/Commands.KeyVault.csproj
@@ -111,7 +111,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.ActiveDirectory.GraphClient.2.1.0\lib\portable-net4+sl5+win+wpa+wp8\Microsoft.Azure.ActiveDirectory.GraphClient.dll
@@ -143,7 +143,7 @@
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
diff --git a/src/ResourceManager/KeyVault/Commands.KeyVault/Commands/RemoveAzureKeyVaultAccessPolicy.cs b/src/ResourceManager/KeyVault/Commands.KeyVault/Commands/RemoveAzureKeyVaultAccessPolicy.cs
index 8f9519db7dad..707f6d54cfb1 100644
--- a/src/ResourceManager/KeyVault/Commands.KeyVault/Commands/RemoveAzureKeyVaultAccessPolicy.cs
+++ b/src/ResourceManager/KeyVault/Commands.KeyVault/Commands/RemoveAzureKeyVaultAccessPolicy.cs
@@ -153,9 +153,11 @@ public override void ExecuteCmdlet()
var updatedPolicies = existingVault.AccessPolicies;
if (!string.IsNullOrEmpty(UserPrincipalName) || !string.IsNullOrEmpty(ServicePrincipalName) || (ObjectId != Guid.Empty))
{
- Guid objId = GetObjectId(this.ObjectId, this.UserPrincipalName, this.ServicePrincipalName);
-
- updatedPolicies = existingVault.AccessPolicies.Where(ap => !ShallBeRemoved(ap, objId, this.ApplicationId)).ToArray();
+ if (ObjectId == Guid.Empty)
+ {
+ ObjectId = GetObjectId(this.ObjectId, this.UserPrincipalName, this.ServicePrincipalName);
+ }
+ updatedPolicies = existingVault.AccessPolicies.Where(ap => !ShallBeRemoved(ap, ObjectId, this.ApplicationId)).ToArray();
}
// Update the vault
diff --git a/src/ResourceManager/KeyVault/Commands.KeyVault/packages.config b/src/ResourceManager/KeyVault/Commands.KeyVault/packages.config
index fa960db55c1c..a5e279a4eb1e 100644
--- a/src/ResourceManager/KeyVault/Commands.KeyVault/packages.config
+++ b/src/ResourceManager/KeyVault/Commands.KeyVault/packages.config
@@ -1,6 +1,6 @@
-
+
@@ -9,7 +9,7 @@
-
+
diff --git a/src/ResourceManager/Network/Commands.Network.Test/Commands.Network.Test.csproj b/src/ResourceManager/Network/Commands.Network.Test/Commands.Network.Test.csproj
index 10024bfc98bd..67f471c2b92c 100644
--- a/src/ResourceManager/Network/Commands.Network.Test/Commands.Network.Test.csproj
+++ b/src/ResourceManager/Network/Commands.Network.Test/Commands.Network.Test.csproj
@@ -44,7 +44,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -71,7 +71,7 @@
True
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.Azure.Test.Framework.1.0.5799.28345-prerelease\lib\net45\Microsoft.Azure.Test.Framework.dll
diff --git a/src/ResourceManager/Network/Commands.Network.Test/packages.config b/src/ResourceManager/Network/Commands.Network.Test/packages.config
index a0604bca683d..4f3bebf7cad6 100644
--- a/src/ResourceManager/Network/Commands.Network.Test/packages.config
+++ b/src/ResourceManager/Network/Commands.Network.Test/packages.config
@@ -1,6 +1,6 @@
-
+
@@ -8,7 +8,7 @@
-
+
diff --git a/src/ResourceManager/Network/Commands.Network/Commands.Network.csproj b/src/ResourceManager/Network/Commands.Network/Commands.Network.csproj
index 108ae22a48a6..1de91969bdf7 100644
--- a/src/ResourceManager/Network/Commands.Network/Commands.Network.csproj
+++ b/src/ResourceManager/Network/Commands.Network/Commands.Network.csproj
@@ -49,7 +49,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -80,15 +80,15 @@
..\..\..\packages\Microsoft.Azure.Management.Network.3.1.0-preview\lib\net45\Microsoft.Azure.Management.Network.dll
True
-
+
False
..\..\..\packages\Microsoft.Data.Edm.5.6.4\lib\net40\Microsoft.Data.Edm.dll
-
+
False
..\..\..\packages\Microsoft.Data.OData.5.6.4\lib\net40\Microsoft.Data.OData.dll
-
+
False
..\..\..\packages\Microsoft.Data.Services.Client.5.6.4\lib\net40\Microsoft.Data.Services.Client.dll
@@ -146,7 +146,7 @@
-
+
False
..\..\..\packages\System.Spatial.5.6.4\lib\net40\System.Spatial.dll
diff --git a/src/ResourceManager/Network/Commands.Network/packages.config b/src/ResourceManager/Network/Commands.Network/packages.config
index 3c9c45f39779..547a3d83c8ea 100644
--- a/src/ResourceManager/Network/Commands.Network/packages.config
+++ b/src/ResourceManager/Network/Commands.Network/packages.config
@@ -1,7 +1,7 @@
-
+
@@ -10,7 +10,7 @@
-
+
diff --git a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/Commands.NotificationHubs.Test.csproj b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/Commands.NotificationHubs.Test.csproj
index 88cb62a40f8b..c29c80240751 100644
--- a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/Commands.NotificationHubs.Test.csproj
+++ b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/Commands.NotificationHubs.Test.csproj
@@ -42,7 +42,7 @@
Commands.NotificationHubs
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
True
@@ -69,7 +69,7 @@
True
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
True
diff --git a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/packages.config b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/packages.config
index fb7beec88336..54413018d737 100644
--- a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/packages.config
+++ b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs.Test/packages.config
@@ -1,12 +1,12 @@
-
+
-
+
diff --git a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/Commands.NotificationHubs.csproj b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/Commands.NotificationHubs.csproj
index efc30185910d..76c1260aa6db 100644
--- a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/Commands.NotificationHubs.csproj
+++ b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/Commands.NotificationHubs.csproj
@@ -39,7 +39,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\net45\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\net45\Hyak.Common.dll
True
@@ -87,7 +87,7 @@
True
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
True
diff --git a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/packages.config b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/packages.config
index 5d5f904b87f9..a4c6f3141330 100644
--- a/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/packages.config
+++ b/src/ResourceManager/NotificationHubs/Commands.NotificationHubs/packages.config
@@ -1,6 +1,6 @@
-
+
@@ -12,5 +12,5 @@
-
+
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/Commands.OperationalInsights.Test.csproj b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/Commands.OperationalInsights.Test.csproj
index 4b6e3f21129b..2e7da4a95a1a 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/Commands.OperationalInsights.Test.csproj
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/Commands.OperationalInsights.Test.csproj
@@ -42,7 +42,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -60,12 +60,13 @@
..\..\..\packages\Microsoft.Azure.Gallery.2.6.2-preview\lib\net40\Microsoft.Azure.Gallery.dll
-
- ..\..\..\packages\Microsoft.Azure.Management.OperationalInsights.0.10.0-preview\lib\net40\Microsoft.Azure.Management.OperationalInsights.dll
+
+ False
+ ..\..\..\packages\Microsoft.Azure.Management.OperationalInsights.0.11.0-preview\lib\net40\Microsoft.Azure.Management.OperationalInsights.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
False
@@ -110,7 +111,7 @@
..\..\..\packages\Moq.4.2.1402.2112\lib\net40\Moq.dll
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
True
@@ -155,6 +156,7 @@
+
@@ -167,12 +169,27 @@
PreserveNewest
+
+ PreserveNewest
+
PreserveNewest
PreserveNewest
+
+ PreserveNewest
+
+
+ PreserveNewest
+
+
+ PreserveNewest
+
+
+ PreserveNewest
+
PreserveNewest
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.cs
new file mode 100644
index 000000000000..4efaad9d2bc3
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.cs
@@ -0,0 +1,51 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using Microsoft.WindowsAzure.Commands.ScenarioTest;
+using Xunit;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Test
+{
+ public class SearchTests : OperationalInsightsScenarioTestBase
+ {
+ [Fact]
+ [Trait(Category.AcceptanceType, Category.CheckIn)]
+ public void TestSearchGetSchema()
+ {
+ RunPowerShellTest("Test-SearchGetSchema");
+ }
+
+ [Fact]
+ [Trait(Category.AcceptanceType, Category.CheckIn)]
+ public void TestSearchGetSearchResultsAndUpdate()
+ {
+ RunPowerShellTest("Test-SearchGetSearchResultsAndUpdate");
+ }
+
+ [Fact]
+ [Trait(Category.AcceptanceType, Category.CheckIn)]
+ public void TestSearchGetSavedSearchesAndResults()
+ {
+ RunPowerShellTest("Test-SearchGetSavedSearchesAndResults");
+ }
+
+ [Fact]
+ [Trait(Category.AcceptanceType, Category.CheckIn)]
+ public void TestSearchSetAndRemoveSavedSearches()
+ {
+ RunPowerShellTest("Test-SearchSetAndRemoveSavedSearches");
+ }
+
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.ps1 b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.ps1
new file mode 100644
index 000000000000..03c131424e63
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/ScenarioTests/SearchTests.ps1
@@ -0,0 +1,147 @@
+# ----------------------------------------------------------------------------------
+#
+# Copyright Microsoft Corporation
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ----------------------------------------------------------------------------------
+
+<#
+.SYNOPSIS
+Get and update search results
+#>
+function Test-SearchGetSearchResultsAndUpdate
+{
+ $rgname = "OI-Default-East-US"
+ $wsname = "rasha"
+
+ $top = 25
+
+ $searchResult = Get-AzureRmOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Top $top -Query "*"
+
+ Assert-NotNull $searchResult
+ Assert-NotNull $searchResult.Metadata
+ Assert-NotNull $searchResult.Value
+ Assert-AreEqual $searchResult.Value.Count $top
+
+ $idArray = $searchResult.Id.Split("/")
+ $id = $idArray[$idArray.Length-1]
+ $updatedResult = Get-AzureRmOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Id $id
+
+ Assert-NotNull $updatedResult
+ Assert-NotNull $updatedResult.Metadata
+ Assert-NotNull $searchResult.Value
+}
+
+<#
+.SYNOPSIS
+Get schemas for a given workspace
+#>
+function Test-SearchGetSchema
+{
+ $rgname = "mms-eus"
+ $wsname = "workspace-861bd466-5400-44be-9552-5ba40823c3aa"
+
+ $schema = Get-AzureRmOperationalInsightsSchema -ResourceGroupName $rgname -WorkspaceName $wsname
+ Assert-NotNull $schema
+ Assert-NotNull $schema.Metadata
+ Assert-AreEqual $schema.Metadata.ResultType "schema"
+ Assert-NotNull $schema.Value
+}
+
+<#
+.SYNOPSIS
+Get saved searches and search results from a saved search
+#>
+function Test-SearchGetSavedSearchesAndResults
+{
+ $rgname = "mms-eus"
+ $wsname = "workspace-861bd466-5400-44be-9552-5ba40823c3aa"
+
+ $savedSearches = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname
+
+ Assert-NotNull $savedSearches
+ Assert-NotNull $savedSearches.Value
+
+ $idArray = $savedSearches.Value[0].Id.Split("/")
+ $id = $idArray[$idArray.Length-1]
+
+ $savedSearch = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id
+
+ Assert-NotNull $savedSearch
+ Assert-NotNull $savedSearch.ETag
+ Assert-NotNull $savedSearch.Id
+ Assert-NotNull $savedSearch.Properties
+ Assert-NotNull $savedSearch.Properties.Query
+
+ $savedSearchResult = Get-AzureRmOperationalInsightsSavedSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id
+
+ Assert-NotNull $savedSearchResult
+ Assert-NotNull $savedSearchResult.Metadata
+ Assert-NotNull $savedSearchResult.Value
+}
+
+<#
+.SYNOPSIS
+Create a new saved search, update, and then remove it
+#>
+function Test-SearchSetAndRemoveSavedSearches
+{
+ $rgname = "mms-eus"
+ $wsname = "workspace-861bd466-5400-44be-9552-5ba40823c3aa"
+
+ $id = "test-new-saved-search-id-2015"
+ $displayName = "TestingSavedSearch"
+ $category = "Saved Search Test Category"
+ $version = 1
+ $query = "* | measure Count() by Type"
+
+ # Get the count of saved searches
+ $savedSearches = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname
+ $count = $savedSearches.Value.Count
+ $newCount = $count + 1
+
+ New-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Version $version -Force
+
+ # Check that the search was saved
+ $savedSearches = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname
+ Assert-AreEqual $savedSearches.Value.Count $newCount
+
+ $etag = ""
+ ForEach ($s in $savedSearches.Value)
+ {
+ If ($s.Properties.DisplayName.Equals($displayName)) {
+ $etag = $s.ETag
+ }
+ }
+
+ # Test updating the search
+ $query = "*"
+ Set-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Version $version -ETag $etag
+
+ # Check that the search was updated
+ $savedSearches = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname
+ Assert-AreEqual $savedSearches.Value.Count $newCount
+
+ $found = 0
+ ForEach ($s in $savedSearches.Value)
+ {
+ If ($s.Properties.DisplayName.Equals($displayName) -And $s.Properties.Query.Equals($query)) {
+ $found = 1
+ }
+ }
+ Assert-AreEqual $found 1
+
+
+ Remove-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -Force
+
+ # Check that the search was deleted
+ $savedSearches = Get-AzureRmOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname
+ Assert-AreEqual $savedSearches.Value.Count $count
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSavedSearchesAndResults.json b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSavedSearchesAndResults.json
new file mode 100644
index 000000000000..27f5f1d5f018
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSavedSearchesAndResults.json
@@ -0,0 +1,188 @@
+{
+ "Entries": [
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "711454fe-68bf-46d6-8a9b-7fc7faa03c0f"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {},\r\n \"value\": [\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A04%3A25.7940321Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test66666666666666666\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A05%3A27.9119521Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|testben\",\r\n \"etag\": \"W/\\\"datetime'2015-05-12T20%3A45%3A50.1632243Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/2b3a414c-e1b3-4c60-8bb3-b3828bef0174\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A55%3A12.5783991Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"* | Measure count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/51797902-3d96-46ba-95e3-26e74c91118d\",\r\n \"etag\": \"W/\\\"datetime'2015-10-23T04%3A58%3A47.9226934Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"norem\",\r\n \"DisplayName\": \"gasga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/5c7af1f8-bb71-4648-b7d9-910a6b9c9d74\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T19%3A03%3A42.498994Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"a\",\r\n \"DisplayName\": \"a\",\r\n \"Query\": \"Type=ADAssessmentRecommendation RecommendationPeriod=YYYY-MM IsRollup=false FocusArea=Prerequisites\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/60df279b-d288-4777-be03-b2ee65585488\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A46%3A14.747973Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert3\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/6d95bebd-f016-4a2a-8f8d-81c7c1c5a971\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A38%3A41.3404003Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/7c474737-9279-433a-af17-a1c5ad7f339a\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A11.8794146Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert4\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/857fb644-5543-4b8c-9028-05b0980240f9\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T22%3A14%3A03.421978Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"aetaeta\",\r\n \"DisplayName\": \"atett\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/9fddfbb4-ce42-4c4c-bd84-2263b10dffa1\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A30.3141368Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert6\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/a0efeb96-79cf-474b-a98c-23a3a76ee332\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A22.4599753Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert5\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/all|all\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A03%3A03.9192424Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"All\",\r\n \"DisplayName\": \"All\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T20%3A09%3A41.9906542Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"allcomputers\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers2\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T22%3A32%3A26.327691Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"AllComputers2\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/dd35eca5-3dc7-4e30-bf26-83e0cb5f0a2a\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T20%3A03%3A07.6701721Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"agasg\",\r\n \"DisplayName\": \"agsga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/intervals|count of all interval 1hour\",\r\n \"etag\": \"W/\\\"datetime'2015-11-07T00%3A16%3A14.7972332Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Intervals\",\r\n \"DisplayName\": \"Count of all interval 1hour\",\r\n \"Query\": \"* | measure count() by TimeGenerated interval 1HOUR\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/perf|avg disk writes by computer\",\r\n \"etag\": \"W/\\\"datetime'2015-11-05T19%3A48%3A24.8353096Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Perf\",\r\n \"DisplayName\": \"Avg Disk Writes by Computer\",\r\n \"Query\": \"* Type=Perf CounterName=\\\"Disk Write Bytes/sec\\\" | measure avg(CounterValue) by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|all events\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A02%3A49.4024833Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"All Events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|events\",\r\n \"etag\": \"W/\\\"datetime'2014-10-17T16%3A15%3A27.8903997Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/sql assessment|sql assmt by focus area\",\r\n \"etag\": \"W/\\\"datetime'2015-07-15T21%3A38%3A00.898438Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"SQL Assessment\",\r\n \"DisplayName\": \"SQL Assmt by Focus Area\",\r\n \"Query\": \"Type=SQLAssessmentRecommendation AssessmentName=SQLV2 RecommendationPeriod=YYYY-MM IsRollup=true | measure count() by FocusArea\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test|test\",\r\n \"etag\": \"W/\\\"datetime'2015-09-30T05%3A06%3A25.4487456Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"test\",\r\n \"DisplayName\": \"test\",\r\n \"Query\": \"Type=W3CIISLog\",\r\n \"Version\": 1\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "9664"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14886"
+ ],
+ "x-ms-request-id": [
+ "7cd4d643-7f76-4b7f-a70e-fef2f6a99d19"
+ ],
+ "x-ms-correlation-request-id": [
+ "7cd4d643-7f76-4b7f-a70e-fef2f6a99d19"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T230033Z:7cd4d643-7f76-4b7f-a70e-fef2f6a99d19"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 23:00:32 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzLzAwMjJhYTJkLWU0YzItNDc5Mi04NjcyLWM0NmU3N2VkMTE2ZT9hcGktdmVyc2lvbj0yMDE1LTAzLTIw",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "c710f2dd-616e-4a05-ac4c-f1257e65a5d7"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "364"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14885"
+ ],
+ "x-ms-request-id": [
+ "308b89e0-7766-49fa-b82d-3fc3fba10ef6"
+ ],
+ "x-ms-correlation-request-id": [
+ "308b89e0-7766-49fa-b82d-3fc3fba10ef6"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T230036Z:308b89e0-7766-49fa-b82d-3fc3fba10ef6"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 23:00:36 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e/results?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzLzAwMjJhYTJkLWU0YzItNDc5Mi04NjcyLWM0NmU3N2VkMTE2ZS9yZXN1bHRzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "2ff47f51-335c-4479-95ae-641ebc966eae"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/search/f53ee73f-8bfc-4114-8e73-23d3f3a28918\",\r\n \"__metadata\": {\r\n \"resultType\": \"raw\",\r\n \"total\": 4044611,\r\n \"CoreResponses\": [],\r\n \"CoreSummaries\": [],\r\n \"Status\": \"Successful\",\r\n \"StartTime\": \"2015-12-03T23:00:52.1648647Z\",\r\n \"LastUpdated\": \"2015-12-03T23:00:52.4641215Z\",\r\n \"ETag\": \"635847804524641215\",\r\n \"sort\": [\r\n {\r\n \"name\": \"TimeGenerated\",\r\n \"order\": \"desc\"\r\n }\r\n ]\r\n },\r\n \"value\": [\r\n {\r\n \"Computer\": \"odstest\",\r\n \"ObjectName\": \"LogicalDisk\",\r\n \"CounterName\": \"Disk Write Bytes/sec\",\r\n \"InstanceName\": \"_Total\",\r\n \"TimeGenerated\": \"2015-12-03T22:57:05.747Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"CounterPath\": \"\\\\\\\\odstest\\\\LogicalDisk(_Total)\\\\Disk Write Bytes/sec\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000002\",\r\n \"id\": \"dc443d30-29ac-0404-7872-5cc6b5eaf8bd\",\r\n \"Type\": \"Perf\",\r\n \"CounterValue\": 2.1,\r\n \"__metadata\": {\r\n \"Type\": \"Perf\",\r\n \"TimeGenerated\": \"2015-12-03T22:57:05.747Z\"\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T22:55:24.147Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Account\": \"SMX\\\\OMPERFSRV72D$\",\r\n \"AccountType\": \"Machine\",\r\n \"Computer\": \"OMPERFSIM30D-0001\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 12544,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n OMPERFSRV72D$\\r\\n SMX\\r\\n 0x3e7\\r\\n 0x0\\r\\n 0x1440\\r\\n D:\\\\Windows\\\\System32\\\\conhost.exe\\r\\n\",\r\n \"EventID\": 4689,\r\n \"Activity\": \"4689 - A process has exited.\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"TimeCollected\": \"2015-12-03T22:56:40.197Z\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"Process\": \"conhost.exe\",\r\n \"ProcessName\": \"D:\\\\Windows\\\\System32\\\\conhost.exe\",\r\n \"Status\": \"0x0\",\r\n \"SubjectAccount\": \"SMX\\\\OMPERFSRV72D$\",\r\n \"SubjectDomainName\": \"SMX\",\r\n \"SubjectUserName\": \"OMPERFSRV72D$\",\r\n \"id\": \"1d91ce5f-aeba-51b6-5f16-71f879988359\",\r\n \"Type\": \"SecurityEvent\",\r\n \"ProcessId\": \"0x1440\",\r\n \"EventSourceName\": \"Microsoft Windows security auditing.\",\r\n \"SubjectLogonId\": \"0x3e7\",\r\n \"SubjectUserSid\": \"S-1-5-18\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T22:55:24.147Z\"\r\n }\r\n },\r\n {\r\n \"SourceSystem\": \"OpsManager\",\r\n \"TimeGenerated\": \"2015-12-03T22:55:02.37Z\",\r\n \"Source\": \"Microsoft Windows security auditing.\",\r\n \"EventLog\": \"Security\",\r\n \"Computer\": \"OMPERFSIM30D-0001\",\r\n \"EventCategory\": 12544,\r\n \"EventLevel\": 8,\r\n \"EventLevelName\": \"Audit Success\",\r\n \"UserName\": \"N/A\",\r\n \"Message\": \"LCID;0\\tLocale;ENU\\tMessage;\\t\",\r\n \"ParameterXml\": \"NT AUTHORITY\\\\SYSTEMOMPERFSRV72D$SMX0x3e70x00x1440D:\\\\Windows\\\\System32\\\\conhost.exe\",\r\n \"EventData\": \"S-1-5-18OMPERFSRV72D$SMX0x3e70x00x1440D:\\\\Windows\\\\System32\\\\conhost.exe\",\r\n \"EventID\": 4689,\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"TimeCollected\": \"2015-12-03T22:56:18.383Z\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"id\": \"bb42ac66-d37c-27a2-f9a0-31c77f976f13\",\r\n \"Type\": \"Event\",\r\n \"__metadata\": {\r\n \"Type\": \"Event\",\r\n \"TimeGenerated\": \"2015-12-03T22:55:02.37Z\"\r\n }\r\n },\r\n {\r\n \"Computer\": \"atml-001.contoso.com\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"TimeGenerated\": \"2015-12-03T22:54:16.943Z\",\r\n \"SessionStartTime\": \"2015-12-03T00:00:00Z\",\r\n \"SessionEndTime\": \"2015-12-03T00:00:00Z\",\r\n \"LocalIP\": \"10.123.172.169\",\r\n \"LocalSubnet\": \"10.2.0.0/16\",\r\n \"LocalMAC\": \"00:0a:95:9d:68:16\",\r\n \"LocalPortNumber\": 443,\r\n \"RemoteIP\": \"10.123.172.185\",\r\n \"RemoteMAC\": \"00:0a:95:9d:72:18\",\r\n \"RemotePortNumber\": 80,\r\n \"SessionID\": \"10.123.172.169_443_10.123.172.185_80_12_2015-12-03T00:00:00.000Z\",\r\n \"SentBytes\": 2000,\r\n \"ReceivedBytes\": 20,\r\n \"TotalBytes\": 2020,\r\n \"ProtocolName\": \"UDP\",\r\n \"SentPackets\": 100,\r\n \"ReceivedPackets\": 10,\r\n \"ProcessID\": 3,\r\n \"ProcessName\": \"SQL\",\r\n \"LatencyMilliseconds\": 3,\r\n \"LatencySamplingTimeStamp\": \"2014-11-03T17:56:51Z\",\r\n \"LatencySamplingFailureRate\": \"30%\",\r\n \"id\": \"6d2e0466-9514-a809-4f59-6455ed007729\",\r\n \"Type\": \"WireData\",\r\n \"Direction\": \"Inbound\",\r\n \"SequenceNumber\": 3,\r\n \"SessionState\": \"Closed\",\r\n \"IPVersion\": \"IPv4\",\r\n \"ApplicationProtocol\": \"SMTP\",\r\n \"ApplicationServiceName\": \"https\",\r\n \"__metadata\": {\r\n \"Type\": \"WireData\",\r\n \"TimeGenerated\": \"2015-12-03T22:54:16.943Z\"\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T22:54:09.147Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Account\": \"SMX\\\\momActionAct\",\r\n \"AccountType\": \"User\",\r\n \"Computer\": \"OMPERFSIM30D-0001\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 12544,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-21-1935655697-562591055-1417001333-65138\\r\\n momActionAct\\r\\n SMX\\r\\n 0x1638ffd4\\r\\n 0x1704\\r\\n D:\\\\Windows\\\\System32\\\\conhost.exe\\r\\n %%1936\\r\\n 0x1a6c\\r\\n \\r\\n\",\r\n \"EventID\": 4688,\r\n \"Activity\": \"4688 - A new process has been created.\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"TimeCollected\": \"2015-12-03T22:56:40.197Z\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"NewProcessName\": \"D:\\\\Windows\\\\System32\\\\conhost.exe\",\r\n \"Process\": \"conhost.exe\",\r\n \"SubjectAccount\": \"SMX\\\\momActionAct\",\r\n \"SubjectDomainName\": \"SMX\",\r\n \"SubjectUserName\": \"momActionAct\",\r\n \"id\": \"a87b4966-c997-98cb-504c-df5f70595153\",\r\n \"Type\": \"SecurityEvent\",\r\n \"ProcessId\": \"0x1a6c\",\r\n \"EventSourceName\": \"Microsoft Windows security auditing.\",\r\n \"NewProcessId\": \"0x1704\",\r\n \"SubjectLogonId\": \"0x1638ffd4\",\r\n \"SubjectUserSid\": \"S-1-5-21-1935655697-562591055-1417001333-65138\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T22:54:09.147Z\"\r\n }\r\n },\r\n {\r\n \"SourceSystem\": \"OpsManager\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:47.37Z\",\r\n \"Source\": \"Microsoft Windows security auditing.\",\r\n \"EventLog\": \"Security\",\r\n \"Computer\": \"OMPERFSIM30D-0001\",\r\n \"EventCategory\": 12544,\r\n \"EventLevel\": 8,\r\n \"EventLevelName\": \"Audit Success\",\r\n \"UserName\": \"N/A\",\r\n \"Message\": \"LCID;0\\tLocale;ENU\\tMessage;\\t\",\r\n \"ParameterXml\": \"SMX\\\\momActionActmomActionActSMX0x1638ffd40x1844D:\\\\Windows\\\\System32\\\\cscript.exe%%19360x1e5c\",\r\n \"EventData\": \"S-1-5-21-1935655697-562591055-1417001333-65138momActionActSMX0x1638ffd40x1704D:\\\\Windows\\\\System32\\\\conhost.exe%%19360x1a6c\",\r\n \"EventID\": 4688,\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"TimeCollected\": \"2015-12-03T22:56:18.383Z\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"id\": \"dcbeda89-837d-30f2-b99a-86e94eae1c73\",\r\n \"Type\": \"Event\",\r\n \"__metadata\": {\r\n \"Type\": \"Event\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:47.37Z\"\r\n }\r\n },\r\n {\r\n \"SourceSystem\": \"Nagios\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:33.27Z\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"PriorityNumber\": 2,\r\n \"HostName\": \"nagios-5\",\r\n \"AlertName\": \"SERVICE ALERT: Total processes\",\r\n \"AlertDescription\": \"Return code of 255 for check of service 'Total Processes' was out of bounds\",\r\n \"AlertState\": \"CRITICAL\",\r\n \"StateType\": \"SOFT\",\r\n \"id\": \"3afaea03-98d8-ccf9-a654-3c63d05af1fa\",\r\n \"Type\": \"Alert\",\r\n \"__metadata\": {\r\n \"Type\": \"Alert\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:33.27Z\"\r\n }\r\n },\r\n {\r\n \"Computer\": \"odstest\",\r\n \"ObjectName\": \"LogicalDisk\",\r\n \"CounterName\": \"Disk Write Bytes/sec\",\r\n \"InstanceName\": \"_Total\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:06.476Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"CounterPath\": \"\\\\\\\\odstest\\\\LogicalDisk(_Total)\\\\Disk Write Bytes/sec\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000002\",\r\n \"id\": \"6e91806e-b3b7-ee75-c83c-9e76a0e3aa25\",\r\n \"Type\": \"Perf\",\r\n \"CounterValue\": 2.1,\r\n \"__metadata\": {\r\n \"Type\": \"Perf\",\r\n \"TimeGenerated\": \"2015-12-03T22:53:06.476Z\"\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T22:52:54.147Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Account\": \"SMX\\\\asttest\",\r\n \"AccountType\": \"User\",\r\n \"Computer\": \"OMPERFSIM30D-0001\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 12544,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n OMPERFSRV72D$\\r\\n SMX\\r\\n 0x3e7\\r\\n S-1-0-0\\r\\n asttest\\r\\n SMX\\r\\n 0xc000006d\\r\\n %%2313\\r\\n 0xc000006a\\r\\n 7\\r\\n User32 \\r\\n Negotiate\\r\\n OMPERFSRV72D\\r\\n -\\r\\n -\\r\\n 0\\r\\n 0x2b4\\r\\n D:\\\\Windows\\\\System32\\\\winlogon.exe\\r\\n 157.59.150.240\\r\\n 0\\r\\n\",\r\n \"EventID\": 4625,\r\n \"Activity\": \"4625 - An account failed to log on.\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"TimeCollected\": \"2015-12-03T22:56:40.197Z\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"AuthenticationPackageName\": \"Negotiate\",\r\n \"FailureReason\": \"%%2313\",\r\n \"IpAddress\": \"157.59.150.240\",\r\n \"IpPort\": \"0\",\r\n \"KeyLength\": \"0\",\r\n \"LmPackageName\": \"-\",\r\n \"LogonProcessName\": \"User32 \",\r\n \"LogonType\": \"7\",\r\n \"LogonTypeName\": \"7 - Unlock\",\r\n \"Process\": \"winlogon.exe\",\r\n \"ProcessName\": \"D:\\\\Windows\\\\System32\\\\winlogon.exe\",\r\n \"Status\": \"0xc000006d\",\r\n \"SubjectAccount\": \"SMX\\\\OMPERFSRV72D$\",\r\n \"SubjectDomainName\": \"SMX\",\r\n \"SubjectUserName\": \"OMPERFSRV72D$\",\r\n \"SubStatus\": \"0xc000006a\",\r\n \"TargetAccount\": \"SMX\\\\asttest\",\r\n \"TargetDomainName\": \"SMX\",\r\n \"TargetUserName\": \"asttest\",\r\n \"TransmittedServices\": \"-\",\r\n \"WorkstationName\": \"OMPERFSRV72D\",\r\n \"id\": \"3f7b2565-286f-0540-1c6c-66f866a7f9c0\",\r\n \"Type\": \"SecurityEvent\",\r\n \"ProcessId\": \"0x2b4\",\r\n \"EventSourceName\": \"Microsoft Windows security auditing.\",\r\n \"SubjectLogonId\": \"0x3e7\",\r\n \"SubjectUserSid\": \"S-1-5-18\",\r\n \"TargetUserSid\": \"S-1-0-0\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T22:52:54.147Z\"\r\n }\r\n },\r\n {\r\n \"Computer\": \"atml-001.contoso.com\",\r\n \"MG\": \"511e40ec-5a7c-4bdc-b2aa-2359e04ecea0\",\r\n \"ManagementGroupName\": \"MockSCOMGW_11_4_2015_2_50_02_PM\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"TimeGenerated\": \"2015-12-03T22:52:36.943Z\",\r\n \"SessionStartTime\": \"2015-12-03T00:00:00Z\",\r\n \"SessionEndTime\": \"2015-12-03T00:00:00Z\",\r\n \"LocalIP\": \"10.123.172.169\",\r\n \"LocalSubnet\": \"IPv6-N/A\",\r\n \"LocalMAC\": \"00:0a:95:9d:68:16\",\r\n \"LocalPortNumber\": 443,\r\n \"RemoteIP\": \"10.123.172.185\",\r\n \"RemoteMAC\": \"00:0a:95:9d:72:18\",\r\n \"RemotePortNumber\": 80,\r\n \"SessionID\": \"10.123.172.169_443_10.123.172.185_80_12_2015-12-03T00:00:00.000Z\",\r\n \"SentBytes\": 4000,\r\n \"ReceivedBytes\": 40,\r\n \"TotalBytes\": 4040,\r\n \"ProtocolName\": \"TCP\",\r\n \"SentPackets\": 200,\r\n \"ReceivedPackets\": 20,\r\n \"ProcessID\": 2,\r\n \"ProcessName\": \"Outlook\",\r\n \"LatencyMilliseconds\": 1,\r\n \"LatencySamplingTimeStamp\": \"2014-11-02T17:56:51Z\",\r\n \"LatencySamplingFailureRate\": \"10%\",\r\n \"id\": \"dab6be0b-59d7-74bb-d05b-7028bdc24605\",\r\n \"Type\": \"WireData\",\r\n \"Direction\": \"Outbound\",\r\n \"SequenceNumber\": 2,\r\n \"SessionState\": \"LastAck\",\r\n \"IPVersion\": \"IPv6\",\r\n \"ApplicationProtocol\": \"HTTPS\",\r\n \"ApplicationServiceName\": \"http\",\r\n \"__metadata\": {\r\n \"Type\": \"WireData\",\r\n \"TimeGenerated\": \"2015-12-03T22:52:36.943Z\"\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "12288"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14884"
+ ],
+ "x-ms-request-id": [
+ "006a417f-077d-40bc-8907-8a3329e016a7"
+ ],
+ "x-ms-correlation-request-id": [
+ "006a417f-077d-40bc-8907-8a3329e016a7"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T230052Z:006a417f-077d-40bc-8907-8a3329e016a7"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 23:00:51 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ }
+ ],
+ "Names": {},
+ "Variables": {
+ "SubscriptionId": "df1ec963-d784-4d11-a779-1b3eeb9ecb78"
+ }
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSchema.json b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSchema.json
new file mode 100644
index 000000000000..743288dc3d35
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSchema.json
@@ -0,0 +1,68 @@
+{
+ "Entries": [
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/schema?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zY2hlbWE/YXBpLXZlcnNpb249MjAxNS0wMy0yMA==",
+ "RequestMethod": "POST",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "4a6a52d2-8b90-4d3a-ba29-869fe025f01c"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {\r\n \"schema\": {\r\n \"name\": \"CloudOps\",\r\n \"version\": 2\r\n },\r\n \"resultType\": \"schema\",\r\n \"requestTime\": 172\r\n },\r\n \"value\": [\r\n {\r\n \"name\": \"TenantId\",\r\n \"displayName\": \"TenantId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\",\r\n \"ADAssessmentRecommendation\",\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"ASMFeature\",\r\n \"ASMProduct\",\r\n \"AzureNetworkFlow\",\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"ContainerInventory\",\r\n \"Event\",\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopSMTPMessage\",\r\n \"ExtraHopSYNScanDetect\",\r\n \"ExtraHopTCPOpen\",\r\n \"FileProfile\",\r\n \"MetadataTest_Alert\",\r\n \"NewCustomFieldsFact\",\r\n \"OfficeActivity\",\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"SMIncidentFactArtifact\",\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\",\r\n \"SurfaceHubDns\",\r\n \"SurfaceHubDnsFact\",\r\n \"SurfaceHubUserSessionFact\",\r\n \"Syslog\",\r\n \"TestCommonAlertfact\",\r\n \"TestFact\",\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\",\r\n \"TestUpdatAlertfact\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"ValidationTestFact\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MG\",\r\n \"displayName\": \"MG\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\",\r\n \"ADAssessmentRecommendation\",\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"Event\",\r\n \"MetadataTest_Alert\",\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\",\r\n \"Syslog\",\r\n \"TestCommonAlertfact\",\r\n \"TestUpdatAlertfact\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceSystem\",\r\n \"displayName\": \"SourceSystem\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\",\r\n \"ADAssessmentRecommendation\",\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"ASMFeature\",\r\n \"ASMProduct\",\r\n \"AzureNetworkFlow\",\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"ContainerInventory\",\r\n \"Event\",\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopSMTPMessage\",\r\n \"ExtraHopSYNScanDetect\",\r\n \"ExtraHopTCPOpen\",\r\n \"FileProfile\",\r\n \"MetadataTest_Alert\",\r\n \"NewCustomFieldsFact\",\r\n \"OfficeActivity\",\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"SMIncidentFactArtifact\",\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\",\r\n \"SurfaceHubDns\",\r\n \"SurfaceHubDnsFact\",\r\n \"SurfaceHubUserSessionFact\",\r\n \"Syslog\",\r\n \"TestCommonAlertfact\",\r\n \"TestFact\",\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\",\r\n \"TestUpdatAlertfact\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"ValidationTestFact\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeGenerated\",\r\n \"displayName\": \"TimeGenerated\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\",\r\n \"ADAssessmentRecommendation\",\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"ASMFeature\",\r\n \"ASMProduct\",\r\n \"AzureNetworkFlow\",\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"ContainerInventory\",\r\n \"Event\",\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopSMTPMessage\",\r\n \"ExtraHopSYNScanDetect\",\r\n \"ExtraHopTCPOpen\",\r\n \"FileProfile\",\r\n \"MetadataTest_Alert\",\r\n \"NewCustomFieldsFact\",\r\n \"OfficeActivity\",\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"SMIncidentFactArtifact\",\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\",\r\n \"SurfaceHubDns\",\r\n \"SurfaceHubDnsFact\",\r\n \"SurfaceHubUserSessionFact\",\r\n \"Syslog\",\r\n \"TestCommonAlertfact\",\r\n \"TestFact\",\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\",\r\n \"TestUpdatAlertfact\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"ValidationTestFact\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RunStepResultId\",\r\n \"displayName\": \"RunStepResultId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RunProfileResultId\",\r\n \"displayName\": \"RunProfileResultId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Partition\",\r\n \"displayName\": \"Partition\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OperationType\",\r\n \"displayName\": \"OperationType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\",\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SequenceNumber1\",\r\n \"displayName\": \"SequenceNumber1\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StartTime\",\r\n \"displayName\": \"StartTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EndTime\",\r\n \"displayName\": \"EndTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Result\",\r\n \"displayName\": \"Result\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ConnectorDiscoveryCountersFilteredDeletions\",\r\n \"displayName\": \"ConnectorDiscoveryCountersFilteredDeletions\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ConnectorDiscoveryCountersFilteredObjects\",\r\n \"displayName\": \"ConnectorDiscoveryCountersFilteredObjects\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OutboundFlowCountersJson\",\r\n \"displayName\": \"OutboundFlowCountersJson\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersNoChange\",\r\n \"displayName\": \"ImportCountersNoChange\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersAdd\",\r\n \"displayName\": \"ImportCountersAdd\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersUpdate\",\r\n \"displayName\": \"ImportCountersUpdate\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersRename\",\r\n \"displayName\": \"ImportCountersRename\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersDelete\",\r\n \"displayName\": \"ImportCountersDelete\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersDeleteAdd\",\r\n \"displayName\": \"ImportCountersDeleteAdd\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImportCountersFailure\",\r\n \"displayName\": \"ImportCountersFailure\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorFiltered\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorFiltered\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorJoinedNoFlow\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorJoinedNoFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorJoinedFlow\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorJoinedFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorJoinedRemoveMv\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorJoinedRemoveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorProjectedNoFlow\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorProjectedNoFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorProjectedFlow\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorProjectedFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorProjectedRemoveMv\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorProjectedRemoveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersDisconnectorRemains\",\r\n \"displayName\": \"InboundFlowCountersDisconnectorRemains\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorFilteredRemoveMv\",\r\n \"displayName\": \"InboundFlowCountersConnectorFilteredRemoveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorFilteredLeaveMv\",\r\n \"displayName\": \"InboundFlowCountersConnectorFilteredLeaveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorFlow\",\r\n \"displayName\": \"InboundFlowCountersConnectorFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorFlowRemoveMv\",\r\n \"displayName\": \"InboundFlowCountersConnectorFlowRemoveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorNoFlow\",\r\n \"displayName\": \"InboundFlowCountersConnectorNoFlow\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorDeleteRemoveMv\",\r\n \"displayName\": \"InboundFlowCountersConnectorDeleteRemoveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorDeleteLeaveMv\",\r\n \"displayName\": \"InboundFlowCountersConnectorDeleteLeaveMv\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersConnectorDeleteAddProcessed\",\r\n \"displayName\": \"InboundFlowCountersConnectorDeleteAddProcessed\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InboundFlowCountersFlowFailure\",\r\n \"displayName\": \"InboundFlowCountersFlowFailure\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersAdd\",\r\n \"displayName\": \"ExportCountersAdd\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersUpdate\",\r\n \"displayName\": \"ExportCountersUpdate\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersRename\",\r\n \"displayName\": \"ExportCountersRename\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersDelete\",\r\n \"displayName\": \"ExportCountersDelete\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersDeleteAdd\",\r\n \"displayName\": \"ExportCountersDeleteAdd\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExportCountersFailure\",\r\n \"displayName\": \"ExportCountersFailure\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"AadSyncRunStepResult\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AssessmentId\",\r\n \"displayName\": \"AssessmentId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AssessmentName\",\r\n \"displayName\": \"AssessmentName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationId\",\r\n \"displayName\": \"RecommendationId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Recommendation\",\r\n \"displayName\": \"Recommendation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Description\",\r\n \"displayName\": \"Description\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"ConfigurationAlert\",\r\n \"SQLAssessmentRecommendation\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationResult\",\r\n \"displayName\": \"RecommendationResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FocusAreaId\",\r\n \"displayName\": \"FocusAreaId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FocusArea\",\r\n \"displayName\": \"FocusArea\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActionAreaId\",\r\n \"displayName\": \"ActionAreaId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActionArea\",\r\n \"displayName\": \"ActionArea\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationScore\",\r\n \"displayName\": \"RecommendationScore\",\r\n \"type\": \"Float\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationWeight\",\r\n \"displayName\": \"RecommendationWeight\",\r\n \"type\": \"Float\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetCount\",\r\n \"displayName\": \"TargetCount\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Computer\",\r\n \"displayName\": \"Computer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"ASMFeature\",\r\n \"ASMProduct\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"ContainerInventory\",\r\n \"Event\",\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\",\r\n \"SurfaceHubDnsFact\",\r\n \"Syslog\",\r\n \"TestFact\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"ValidationTestFact\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AffectedObjectType\",\r\n \"displayName\": \"AffectedObjectType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AffectedObjectName\",\r\n \"displayName\": \"AffectedObjectName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AffectedObjectUniqueName\",\r\n \"displayName\": \"AffectedObjectUniqueName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Forest\",\r\n \"displayName\": \"Forest\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Domain\",\r\n \"displayName\": \"Domain\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DomainController\",\r\n \"displayName\": \"DomainController\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsRollup\",\r\n \"displayName\": \"IsRollup\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsCopied\",\r\n \"displayName\": \"IsCopied\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationPeriod\",\r\n \"displayName\": \"RecommendationPeriod\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ADAssessmentRecommendation\",\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertName\",\r\n \"displayName\": \"AlertName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertDescription\",\r\n \"displayName\": \"AlertDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertState\",\r\n \"displayName\": \"AlertState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PriorityNumber\",\r\n \"displayName\": \"PriorityNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HostName\",\r\n \"displayName\": \"HostName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StateType\",\r\n \"displayName\": \"StateType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertSeverity\",\r\n \"displayName\": \"AlertSeverity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryExecutionStartTime\",\r\n \"displayName\": \"QueryExecutionStartTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryExecutionEndTime\",\r\n \"displayName\": \"QueryExecutionEndTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Query\",\r\n \"displayName\": \"Query\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemediationJobId\",\r\n \"displayName\": \"RemediationJobId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemediationRunbookName\",\r\n \"displayName\": \"RemediationRunbookName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertPriority\",\r\n \"displayName\": \"AlertPriority\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceDisplayName\",\r\n \"displayName\": \"SourceDisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceFullName\",\r\n \"displayName\": \"SourceFullName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertId\",\r\n \"displayName\": \"AlertId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RepeatCount\",\r\n \"displayName\": \"RepeatCount\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ResolvedBy\",\r\n \"displayName\": \"ResolvedBy\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastModifiedBy\",\r\n \"displayName\": \"LastModifiedBy\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeRaised\",\r\n \"displayName\": \"TimeRaised\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeResolved\",\r\n \"displayName\": \"TimeResolved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeLastModified\",\r\n \"displayName\": \"TimeLastModified\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertContext\",\r\n \"displayName\": \"AlertContext\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TicketId\",\r\n \"displayName\": \"TicketId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom1\",\r\n \"displayName\": \"Custom1\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom2\",\r\n \"displayName\": \"Custom2\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom3\",\r\n \"displayName\": \"Custom3\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom4\",\r\n \"displayName\": \"Custom4\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom5\",\r\n \"displayName\": \"Custom5\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom6\",\r\n \"displayName\": \"Custom6\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom7\",\r\n \"displayName\": \"Custom7\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom8\",\r\n \"displayName\": \"Custom8\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom9\",\r\n \"displayName\": \"Custom9\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Custom10\",\r\n \"displayName\": \"Custom10\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ManagementGroupName\",\r\n \"displayName\": \"ManagementGroupName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\",\r\n \"AlertHistory\",\r\n \"ConfigurationAlert\",\r\n \"ConfigurationChange\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"Event\",\r\n \"PerfHourly\",\r\n \"ProtectionStatus\",\r\n \"Recommendation\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"Update\",\r\n \"UpdateAgent\",\r\n \"UpdateSummary\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertUniqueId\",\r\n \"displayName\": \"AlertUniqueId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertTypeDescription\",\r\n \"displayName\": \"AlertTypeDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertTypeNumber\",\r\n \"displayName\": \"AlertTypeNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertError\",\r\n \"displayName\": \"AlertError\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StatusDescription\",\r\n \"displayName\": \"StatusDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertStatus\",\r\n \"displayName\": \"AlertStatus\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TriggerId\",\r\n \"displayName\": \"TriggerId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Url\",\r\n \"displayName\": \"Url\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ValueDescription\",\r\n \"displayName\": \"ValueDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertValue\",\r\n \"displayName\": \"AlertValue\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Comments\",\r\n \"displayName\": \"Comments\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateId\",\r\n \"displayName\": \"TemplateId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FlagsDescription\",\r\n \"displayName\": \"FlagsDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Flags\",\r\n \"displayName\": \"Flags\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ValueFlagsDescription\",\r\n \"displayName\": \"ValueFlagsDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ValueFlags\",\r\n \"displayName\": \"ValueFlags\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Expression\",\r\n \"displayName\": \"Expression\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_Service\",\r\n \"displayName\": \"ASM_Service\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMFeature\",\r\n \"ASMProduct\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_FeatureDisplayName\",\r\n \"displayName\": \"ASM_FeatureDisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMFeature\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_FeatureName\",\r\n \"displayName\": \"ASM_FeatureName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMFeature\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_ProductName\",\r\n \"displayName\": \"ASM_ProductName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMProduct\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_ProuctPublisher\",\r\n \"displayName\": \"ASM_ProuctPublisher\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMProduct\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_ProuctVersion\",\r\n \"displayName\": \"ASM_ProuctVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMProduct\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ASM_ProuctInstalledDateTime\",\r\n \"displayName\": \"ASM_ProuctInstalledDateTime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ASMProduct\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Direction\",\r\n \"displayName\": \"Direction\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Priority\",\r\n \"displayName\": \"Priority\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceIP\",\r\n \"displayName\": \"SourceIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\",\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DestinationIP\",\r\n \"displayName\": \"DestinationIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AgentID\",\r\n \"displayName\": \"AgentID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Protocol\",\r\n \"displayName\": \"Protocol\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\",\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourcePort\",\r\n \"displayName\": \"SourcePort\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\",\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DestinationPort\",\r\n \"displayName\": \"DestinationPort\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\",\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TcpFlags\",\r\n \"displayName\": \"TcpFlags\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Packets\",\r\n \"displayName\": \"Packets\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Bytes\",\r\n \"displayName\": \"Bytes\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"BytesOut\",\r\n \"displayName\": \"BytesOut\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DurationInMs\",\r\n \"displayName\": \"DurationInMs\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RstCount\",\r\n \"displayName\": \"RstCount\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MaxSampleRtt\",\r\n \"displayName\": \"MaxSampleRtt\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"AzureNetworkFlow\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RawData\",\r\n \"displayName\": \"RawData\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventId\",\r\n \"displayName\": \"EventId\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HealthServiceId\",\r\n \"displayName\": \"HealthServiceId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventName\",\r\n \"displayName\": \"EventName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SurfaceHubDnsFact\",\r\n \"SurfaceHubUserSessionFact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_PreciseTimeStamp\",\r\n \"displayName\": \"ESTest_PreciseTimeStamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_TenantInstanceName\",\r\n \"displayName\": \"ESTest_TenantInstanceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_RoleInstanceName\",\r\n \"displayName\": \"ESTest_RoleInstanceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_ContextInCsv_RequestUrl\",\r\n \"displayName\": \"ESTest_ContextInCsv_RequestUrl\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_ContextInCsv_EsWebVersion\",\r\n \"displayName\": \"ESTest_ContextInCsv_EsWebVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_OperationName\",\r\n \"displayName\": \"ESTest_OperationName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_ResultSignature\",\r\n \"displayName\": \"ESTest_ResultSignature\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ESTest_ResultDetails\",\r\n \"displayName\": \"ESTest_ResultDetails\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"CerebroTelemetryIfxOperationV2v1EtwTableVer1v0\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Severity\",\r\n \"displayName\": \"Severity\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectId\",\r\n \"displayName\": \"ObjectId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"PerfHourly\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsMonitorAlert\",\r\n \"displayName\": \"IsMonitorAlert\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AlertParameters\",\r\n \"displayName\": \"AlertParameters\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Context\",\r\n \"displayName\": \"Context\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WorkflowName\",\r\n \"displayName\": \"WorkflowName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"PerfHourly\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RootObjectId\",\r\n \"displayName\": \"RootObjectId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RootObjectName\",\r\n \"displayName\": \"RootObjectName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"PerfHourly\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectDisplayName\",\r\n \"displayName\": \"ObjectDisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"PerfHourly\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ParentObjectId\",\r\n \"displayName\": \"ParentObjectId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ParentObjectName\",\r\n \"displayName\": \"ParentObjectName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\",\r\n \"ConfigurationObject\",\r\n \"ConfigurationObjectProperty\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Workload\",\r\n \"displayName\": \"Workload\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationAlert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ConfigChangeType\",\r\n \"displayName\": \"ConfigChangeType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ChangeCategory\",\r\n \"displayName\": \"ChangeCategory\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SoftwareType\",\r\n \"displayName\": \"SoftwareType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SoftwareName\",\r\n \"displayName\": \"SoftwareName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Previous\",\r\n \"displayName\": \"Previous\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Current\",\r\n \"displayName\": \"Current\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Publisher\",\r\n \"displayName\": \"Publisher\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Location\",\r\n \"displayName\": \"Location\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcChangeType\",\r\n \"displayName\": \"SvcChangeType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcDisplayName\",\r\n \"displayName\": \"SvcDisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcName\",\r\n \"displayName\": \"SvcName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcState\",\r\n \"displayName\": \"SvcState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcPreviousState\",\r\n \"displayName\": \"SvcPreviousState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcStartupType\",\r\n \"displayName\": \"SvcStartupType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcPreviousStartupType\",\r\n \"displayName\": \"SvcPreviousStartupType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcAccount\",\r\n \"displayName\": \"SvcAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcPreviousAccount\",\r\n \"displayName\": \"SvcPreviousAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcPath\",\r\n \"displayName\": \"SvcPath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcPreviousPath\",\r\n \"displayName\": \"SvcPreviousPath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SvcDescription\",\r\n \"displayName\": \"SvcDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationChange\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Path\",\r\n \"displayName\": \"Path\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationObject\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectType\",\r\n \"displayName\": \"ObjectType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ConfigurationObject\",\r\n \"PerfHourly\",\r\n \"Recommendation\",\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Name\",\r\n \"displayName\": \"Name\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationObjectProperty\",\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Value\",\r\n \"displayName\": \"Value\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ConfigurationObjectProperty\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Repository\",\r\n \"displayName\": \"Repository\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Image\",\r\n \"displayName\": \"Image\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImageTag\",\r\n \"displayName\": \"ImageTag\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Running\",\r\n \"displayName\": \"Running\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Stopped\",\r\n \"displayName\": \"Stopped\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Failed\",\r\n \"displayName\": \"Failed\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Paused\",\r\n \"displayName\": \"Paused\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ContainerInventory\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProcessId\",\r\n \"displayName\": \"ProcessId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"tags\",\r\n \"displayName\": \"tags\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SurfaceHubUserSessionFact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Source\",\r\n \"displayName\": \"Source\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventLog\",\r\n \"displayName\": \"EventLog\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventCategory\",\r\n \"displayName\": \"EventCategory\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventLevel\",\r\n \"displayName\": \"EventLevel\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventLevelName\",\r\n \"displayName\": \"EventLevelName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserName\",\r\n \"displayName\": \"UserName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Message\",\r\n \"displayName\": \"Message\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ParameterXml\",\r\n \"displayName\": \"ParameterXml\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"NewCustomFieldsFact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventData\",\r\n \"displayName\": \"EventData\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventID\",\r\n \"displayName\": \"EventID\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RenderedDescription\",\r\n \"displayName\": \"RenderedDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"NewCustomFieldsFact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeCollected\",\r\n \"displayName\": \"TimeCollected\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"ProtectionStatus\",\r\n \"RequiredUpdate\",\r\n \"SecurityEvent\",\r\n \"UpdateAgent\",\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AzureDeploymentID\",\r\n \"displayName\": \"AzureDeploymentID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Role\",\r\n \"displayName\": \"Role\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Event\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\",\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceLocation\",\r\n \"displayName\": \"SourceLocation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopSMTPMessage\",\r\n \"ExtraHopSYNScanDetect\",\r\n \"ExtraHopTCPOpen\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DestinationAddress\",\r\n \"displayName\": \"DestinationAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopSMTPMessage\",\r\n \"ExtraHopTCPOpen\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"User\",\r\n \"displayName\": \"User\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBLogin\",\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopFTPResponse\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Method\",\r\n \"displayName\": \"Method\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopFTPResponse\",\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DestinationPortNumber\",\r\n \"displayName\": \"DestinationPortNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopTCPOpen\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourcePortNumber\",\r\n \"displayName\": \"SourcePortNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\",\r\n \"ExtraHopTCPOpen\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Duration_ms\",\r\n \"displayName\": \"Duration_ms\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ResponseTTLB_ms\",\r\n \"displayName\": \"ResponseTTLB_ms\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HOPName\",\r\n \"displayName\": \"HOPName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryString\",\r\n \"displayName\": \"QueryString\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopDNSResponse\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DBErrorCode\",\r\n \"displayName\": \"DBErrorCode\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DataCenter\",\r\n \"displayName\": \"DataCenter\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDBTransaction\",\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryType\",\r\n \"displayName\": \"QueryType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDNSResponse\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryResult\",\r\n \"displayName\": \"QueryResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopDNSResponse\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StatusCode\",\r\n \"displayName\": \"StatusCode\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopFTPResponse\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FilePath\",\r\n \"displayName\": \"FilePath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopFTPResponse\",\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"URIString\",\r\n \"displayName\": \"URIString\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ResponseCode\",\r\n \"displayName\": \"ResponseCode\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopHTTPTransaction\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Recipient\",\r\n \"displayName\": \"Recipient\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopSMTPMessage\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SenderName\",\r\n \"displayName\": \"SenderName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopSMTPMessage\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AttachmentFileSize\",\r\n \"displayName\": \"AttachmentFileSize\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopSMTPMessage\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SYNSENT_NEWCONNESTAB\",\r\n \"displayName\": \"SYNSENT_NEWCONNESTAB\",\r\n \"type\": \"Float\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopSYNScanDetect\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PeerListSize\",\r\n \"displayName\": \"PeerListSize\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ExtraHopSYNScanDetect\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Sha1\",\r\n \"displayName\": \"Sha1\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Sha256\",\r\n \"displayName\": \"Sha256\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ETag\",\r\n \"displayName\": \"ETag\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HasSample\",\r\n \"displayName\": \"HasSample\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DeterminationType\",\r\n \"displayName\": \"DeterminationType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DeterminationValue\",\r\n \"displayName\": \"DeterminationValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DeterminedBy\",\r\n \"displayName\": \"DeterminedBy\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubmissionFileId\",\r\n \"displayName\": \"SubmissionFileId\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsDetections\",\r\n \"displayName\": \"MsDetections\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ThirdPartyDetections\",\r\n \"displayName\": \"ThirdPartyDetections\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AllDetections\",\r\n \"displayName\": \"AllDetections\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CreationDateTime\",\r\n \"displayName\": \"CreationDateTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DeterminationDateTime\",\r\n \"displayName\": \"DeterminationDateTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastChangeDateTime\",\r\n \"displayName\": \"LastChangeDateTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HasTelemetry\",\r\n \"displayName\": \"HasTelemetry\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InvFirstObserved\",\r\n \"displayName\": \"InvFirstObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InvLastObserved\",\r\n \"displayName\": \"InvLastObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TelFirstObserved\",\r\n \"displayName\": \"TelFirstObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TelLastObserved\",\r\n \"displayName\": \"TelLastObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TelemetryPrevalence\",\r\n \"displayName\": \"TelemetryPrevalence\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InventoryPrevalence\",\r\n \"displayName\": \"InventoryPrevalence\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FirstObserved\",\r\n \"displayName\": \"FirstObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastObserved\",\r\n \"displayName\": \"LastObserved\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Md5\",\r\n \"displayName\": \"Md5\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AggregateBasedOpinion\",\r\n \"displayName\": \"AggregateBasedOpinion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AggregateBasedOpinionFidelity\",\r\n \"displayName\": \"AggregateBasedOpinionFidelity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrevalentThreatName\",\r\n \"displayName\": \"PrevalentThreatName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrevalentThreatMachineCount\",\r\n \"displayName\": \"PrevalentThreatMachineCount\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrevalentThreatFirstDetectionInLast30Days\",\r\n \"displayName\": \"PrevalentThreatFirstDetectionInLast30Days\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrevalentThreatLastDetection\",\r\n \"displayName\": \"PrevalentThreatLastDetection\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Size\",\r\n \"displayName\": \"Size\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PartialCrc1\",\r\n \"displayName\": \"PartialCrc1\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PartialCrc2\",\r\n \"displayName\": \"PartialCrc2\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PartialCrc3\",\r\n \"displayName\": \"PartialCrc3\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LsHash\",\r\n \"displayName\": \"LsHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileType\",\r\n \"displayName\": \"FileType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Ctph\",\r\n \"displayName\": \"Ctph\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Kcrc1\",\r\n \"displayName\": \"Kcrc1\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Kcrc2\",\r\n \"displayName\": \"Kcrc2\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Kcrc3\",\r\n \"displayName\": \"Kcrc3\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Kcrc3n\",\r\n \"displayName\": \"Kcrc3n\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticodeHash256\",\r\n \"displayName\": \"AuthenticodeHash256\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileOriginalName\",\r\n \"displayName\": \"FileOriginalName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FilePublisher\",\r\n \"displayName\": \"FilePublisher\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileProductName\",\r\n \"displayName\": \"FileProductName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileDescription\",\r\n \"displayName\": \"FileDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileVersion\",\r\n \"displayName\": \"FileVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PeHeaderChecksum\",\r\n \"displayName\": \"PeHeaderChecksum\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PeTimestamp\",\r\n \"displayName\": \"PeTimestamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsRuntimePacked\",\r\n \"displayName\": \"IsRuntimePacked\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Signer\",\r\n \"displayName\": \"Signer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Issuer\",\r\n \"displayName\": \"Issuer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SignerHash\",\r\n \"displayName\": \"SignerHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsValidCertificate\",\r\n \"displayName\": \"IsValidCertificate\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CertInvalidDetails\",\r\n \"displayName\": \"CertInvalidDetails\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorDetermination\",\r\n \"displayName\": \"AcDeterminatorDetermination\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorFidelity\",\r\n \"displayName\": \"AcDeterminatorFidelity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorSignFamily\",\r\n \"displayName\": \"AcDeterminatorSignFamily\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorTimeStamp\",\r\n \"displayName\": \"AcDeterminatorTimeStamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningClassification\",\r\n \"displayName\": \"AcDeterminatorMachineLearningClassification\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningFamilyName\",\r\n \"displayName\": \"AcDeterminatorMachineLearningFamilyName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningConfidence\",\r\n \"displayName\": \"AcDeterminatorMachineLearningConfidence\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningPrecision\",\r\n \"displayName\": \"AcDeterminatorMachineLearningPrecision\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningVersion\",\r\n \"displayName\": \"AcDeterminatorMachineLearningVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMachineLearningTimeStamp\",\r\n \"displayName\": \"AcDeterminatorMachineLearningTimeStamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcDeterminatorMetaFeatures\",\r\n \"displayName\": \"AcDeterminatorMetaFeatures\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2Family\",\r\n \"displayName\": \"AcBaseLabelV2Family\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2DetectionName\",\r\n \"displayName\": \"AcBaseLabelV2DetectionName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2LabelType\",\r\n \"displayName\": \"AcBaseLabelV2LabelType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2Category\",\r\n \"displayName\": \"AcBaseLabelV2Category\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2LabelScore\",\r\n \"displayName\": \"AcBaseLabelV2LabelScore\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AcBaseLabelV2PrevalenceReportCount\",\r\n \"displayName\": \"AcBaseLabelV2PrevalenceReportCount\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsPrimaryScanResultIsSuspicious\",\r\n \"displayName\": \"MsPrimaryScanResultIsSuspicious\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsPrimaryScanResult\",\r\n \"displayName\": \"MsPrimaryScanResult\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAmPhase1RelScanResult\",\r\n \"displayName\": \"MsAmPhase1RelScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAmPhase1DailyParanoidScanResult\",\r\n \"displayName\": \"MsAmPhase1DailyParanoidScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"McAfeeScanResult\",\r\n \"displayName\": \"McAfeeScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"McAfeeBetaScanResult\",\r\n \"displayName\": \"McAfeeBetaScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TrendScanResult\",\r\n \"displayName\": \"TrendScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"BitDefenderScanResult\",\r\n \"displayName\": \"BitDefenderScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DrWebScanResult\",\r\n \"displayName\": \"DrWebScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAsPreRelRelScanResult\",\r\n \"displayName\": \"MsAsPreRelRelScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EsetScanResult\",\r\n \"displayName\": \"EsetScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AntigenKasperskyScanResult\",\r\n \"displayName\": \"AntigenKasperskyScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AntigenNormanScanResult\",\r\n \"displayName\": \"AntigenNormanScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SophosScanResult\",\r\n \"displayName\": \"SophosScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AhnlabScanResult\",\r\n \"displayName\": \"AhnlabScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AntigenCommandScanResult\",\r\n \"displayName\": \"AntigenCommandScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AntigenMicrosoftScanResult\",\r\n \"displayName\": \"AntigenMicrosoftScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SymantecScanResult\",\r\n \"displayName\": \"SymantecScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAmPhase1RelGenericScanResult\",\r\n \"displayName\": \"MsAmPhase1RelGenericScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"KasperskyScanResult\",\r\n \"displayName\": \"KasperskyScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AvgScanResult\",\r\n \"displayName\": \"AvgScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IkarusScanResult\",\r\n \"displayName\": \"IkarusScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AviraAntivirScanResult\",\r\n \"displayName\": \"AviraAntivirScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RisingScanResult\",\r\n \"displayName\": \"RisingScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAmRelDssRelScanResult\",\r\n \"displayName\": \"MsAmRelDssRelScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsMsrtRelScanResult\",\r\n \"displayName\": \"MsMsrtRelScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsDtClassifierScanResult\",\r\n \"displayName\": \"MsDtClassifierScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MsAmPhase1RelLowFiScanResult\",\r\n \"displayName\": \"MsAmPhase1RelLowFiScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PliScanResult\",\r\n \"displayName\": \"PliScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FortinetScanResult\",\r\n \"displayName\": \"FortinetScanResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FullMsScanResults\",\r\n \"displayName\": \"FullMsScanResults\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FullThirdPartyScanResults\",\r\n \"displayName\": \"FullThirdPartyScanResults\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"FileProfile\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Priority\",\r\n \"displayName\": \"MetadataTest_Priority\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Severity\",\r\n \"displayName\": \"MetadataTest_Severity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Source\",\r\n \"displayName\": \"MetadataTest_Source\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Id\",\r\n \"displayName\": \"MetadataTest_Id\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Name\",\r\n \"displayName\": \"MetadataTest_Name\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_IsMonitor\",\r\n \"displayName\": \"MetadataTest_IsMonitor\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_RepeatCount\",\r\n \"displayName\": \"MetadataTest_Frequency\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_ResolutionState\",\r\n \"displayName\": \"MetadataTest_ResolutionState\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_State\",\r\n \"displayName\": \"MetadataTest_State\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_TimeRaised\",\r\n \"displayName\": \"MetadataTest_RaisedAt\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_TimeLastModified\",\r\n \"displayName\": \"MetadataTest_ModifiedAt\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Key1\",\r\n \"displayName\": \"MetadataTest_Key1\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MetadataTest_Alert_Key2\",\r\n \"displayName\": \"MetadataTest_Key2\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"MetadataTest_Alert\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OfficeId\",\r\n \"displayName\": \"OfficeId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Operation\",\r\n \"displayName\": \"Operation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OrganizationId\",\r\n \"displayName\": \"OrganizationId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ResultStatus\",\r\n \"displayName\": \"ResultStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OfficeWorkload\",\r\n \"displayName\": \"OfficeWorkload\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ClientIP\",\r\n \"displayName\": \"ClientIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OfficeObjectId\",\r\n \"displayName\": \"OfficeObjectId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserId\",\r\n \"displayName\": \"UserId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventSource\",\r\n \"displayName\": \"EventSource\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ItemType\",\r\n \"displayName\": \"ItemType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceFileExtension\",\r\n \"displayName\": \"SourceFileExtension\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SiteUrl\",\r\n \"displayName\": \"SiteUrl\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceFileName\",\r\n \"displayName\": \"SourceFileName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceRelativeUrl\",\r\n \"displayName\": \"SourceRelativeUrl\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Application\",\r\n \"displayName\": \"Application\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Client\",\r\n \"displayName\": \"Client\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LoginStatus\",\r\n \"displayName\": \"LoginStatus\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserDomain\",\r\n \"displayName\": \"UserDomain\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"OfficeActivity\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectName\",\r\n \"displayName\": \"ObjectName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\",\r\n \"SecurityEvent\",\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CounterName\",\r\n \"displayName\": \"CounterName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InstanceName\",\r\n \"displayName\": \"InstanceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Average\",\r\n \"displayName\": \"CounterValue\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CounterPath\",\r\n \"displayName\": \"CounterPath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Min\",\r\n \"displayName\": \"Min\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Max\",\r\n \"displayName\": \"Max\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SampleCount\",\r\n \"displayName\": \"SampleCount\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Perf\",\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"BucketStartTime\",\r\n \"displayName\": \"BucketStartTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Perf\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"BucketEndTime\",\r\n \"displayName\": \"BucketEndTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Perf\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StandardDeviation\",\r\n \"displayName\": \"StandardDeviation\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Perf\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectFullName\",\r\n \"displayName\": \"ObjectFullName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WorkflowDisplayName\",\r\n \"displayName\": \"WorkflowDisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RuleId\",\r\n \"displayName\": \"RuleId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SampleValue\",\r\n \"displayName\": \"SampleValue\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Percentile95\",\r\n \"displayName\": \"Percentile95\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"PerfHourly\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceHealthServiceId\",\r\n \"displayName\": \"SourceHealthServiceId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ProtectionStatus\",\r\n \"RequiredUpdate\",\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DeviceName\",\r\n \"displayName\": \"DeviceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DetectionId\",\r\n \"displayName\": \"DetectionId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Threat\",\r\n \"displayName\": \"Threat\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ThreatStatusRank\",\r\n \"displayName\": \"ThreatStatusRank\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ThreatStatus\",\r\n \"displayName\": \"ThreatStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ThreatStatusDetails\",\r\n \"displayName\": \"ThreatStatusDetails\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProtectionStatusRank\",\r\n \"displayName\": \"ProtectionStatusRank\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProtectionStatus\",\r\n \"displayName\": \"ProtectionStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProtectionStatusDetails\",\r\n \"displayName\": \"ProtectionStatusDetails\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SignatureVersion\",\r\n \"displayName\": \"SignatureVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TypeofProtection\",\r\n \"displayName\": \"TypeofProtection\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ScanDate\",\r\n \"displayName\": \"ScanDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DateCollected\",\r\n \"displayName\": \"DateCollected\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ProtectionStatus\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastOccurred\",\r\n \"displayName\": \"LastOccurred\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastModified\",\r\n \"displayName\": \"LastModified\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"KBLink\",\r\n \"displayName\": \"KBLink\",\r\n \"type\": \"Uri\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DataSource\",\r\n \"displayName\": \"DataSource\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationProperties\",\r\n \"displayName\": \"RecommendationProperties\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecommendationStatus\",\r\n \"displayName\": \"RecommendationStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AdvisorWorkload\",\r\n \"displayName\": \"AdvisorWorkload\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Score\",\r\n \"displayName\": \"Score\",\r\n \"type\": \"Float\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReleaseDate\",\r\n \"displayName\": \"ReleaseDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Recommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DateStampUTC\",\r\n \"displayName\": \"DateStampUTC\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"RequiredUpdate\",\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpdateTitle\",\r\n \"displayName\": \"UpdateTitle\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpdateSeverity\",\r\n \"displayName\": \"UpdateSeverity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PublishDate\",\r\n \"displayName\": \"PublishDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Server\",\r\n \"displayName\": \"Server\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\",\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Product\",\r\n \"displayName\": \"Product\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\",\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpdateClassification\",\r\n \"displayName\": \"UpdateClassification\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"KBID\",\r\n \"displayName\": \"KBID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"RequiredUpdate\",\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Account\",\r\n \"displayName\": \"Account\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccountType\",\r\n \"displayName\": \"AccountType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventSourceName\",\r\n \"displayName\": \"EventSourceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Channel\",\r\n \"displayName\": \"Channel\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Task\",\r\n \"displayName\": \"Task\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Level\",\r\n \"displayName\": \"Level\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Activity\",\r\n \"displayName\": \"Activity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventOriginId\",\r\n \"displayName\": \"EventOriginId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccessList\",\r\n \"displayName\": \"AccessList\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccessMask\",\r\n \"displayName\": \"AccessMask\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccessReason\",\r\n \"displayName\": \"AccessReason\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccountDomain\",\r\n \"displayName\": \"AccountDomain\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccountExpires\",\r\n \"displayName\": \"AccountExpires\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccountName\",\r\n \"displayName\": \"AccountName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AccountSessionIdentifier\",\r\n \"displayName\": \"AccountSessionIdentifier\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AllowedToDelegateTo\",\r\n \"displayName\": \"AllowedToDelegateTo\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Attributes\",\r\n \"displayName\": \"Attributes\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuditPolicyChanges\",\r\n \"displayName\": \"AuditPolicyChanges\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuditsDiscarded\",\r\n \"displayName\": \"AuditsDiscarded\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationLevel\",\r\n \"displayName\": \"AuthenticationLevel\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationPackageName\",\r\n \"displayName\": \"AuthenticationPackageName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationProvider\",\r\n \"displayName\": \"AuthenticationProvider\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationServer\",\r\n \"displayName\": \"AuthenticationServer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationService\",\r\n \"displayName\": \"AuthenticationService\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AuthenticationType\",\r\n \"displayName\": \"AuthenticationType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CACertificateHash\",\r\n \"displayName\": \"CACertificateHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CalledStationID\",\r\n \"displayName\": \"CalledStationID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CallingStationID\",\r\n \"displayName\": \"CallingStationID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CAPublicKeyHash\",\r\n \"displayName\": \"CAPublicKeyHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CategoryId\",\r\n \"displayName\": \"CategoryId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CertificateDatabaseHash\",\r\n \"displayName\": \"CertificateDatabaseHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ClientAddress\",\r\n \"displayName\": \"ClientAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ClientIPAddress\",\r\n \"displayName\": \"ClientIPAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ClientName\",\r\n \"displayName\": \"ClientName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CommandLine\",\r\n \"displayName\": \"CommandLine\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DCDNSName\",\r\n \"displayName\": \"DCDNSName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DisplayName\",\r\n \"displayName\": \"DisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Disposition\",\r\n \"displayName\": \"Disposition\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DomainBehaviorVersion\",\r\n \"displayName\": \"DomainBehaviorVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DomainName\",\r\n \"displayName\": \"DomainName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DomainPolicyChanged\",\r\n \"displayName\": \"DomainPolicyChanged\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DomainSid\",\r\n \"displayName\": \"DomainSid\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EAPType\",\r\n \"displayName\": \"EAPType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ErrorCode\",\r\n \"displayName\": \"ErrorCode\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExtendedQuarantineState\",\r\n \"displayName\": \"ExtendedQuarantineState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FailureReason\",\r\n \"displayName\": \"FailureReason\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileHash\",\r\n \"displayName\": \"FileHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FilePathNoUser\",\r\n \"displayName\": \"FilePathNoUser\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Filter\",\r\n \"displayName\": \"Filter\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ForceLogoff\",\r\n \"displayName\": \"ForceLogoff\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Fqbn\",\r\n \"displayName\": \"Fqbn\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FullyQualifiedSubjectMachineName\",\r\n \"displayName\": \"FullyQualifiedSubjectMachineName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FullyQualifiedSubjectUserName\",\r\n \"displayName\": \"FullyQualifiedSubjectUserName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HandleId\",\r\n \"displayName\": \"HandleId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HomeDirectory\",\r\n \"displayName\": \"HomeDirectory\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HomePath\",\r\n \"displayName\": \"HomePath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ImpersonationLevel\",\r\n \"displayName\": \"ImpersonationLevel\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InterfaceUuid\",\r\n \"displayName\": \"InterfaceUuid\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IpAddress\",\r\n \"displayName\": \"IpAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IpPort\",\r\n \"displayName\": \"IpPort\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"KeyLength\",\r\n \"displayName\": \"KeyLength\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LmPackageName\",\r\n \"displayName\": \"LmPackageName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LockoutDuration\",\r\n \"displayName\": \"LockoutDuration\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LockoutObservationWindow\",\r\n \"displayName\": \"LockoutObservationWindow\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LockoutThreshold\",\r\n \"displayName\": \"LockoutThreshold\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LoggingResult\",\r\n \"displayName\": \"LoggingResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonGuid\",\r\n \"displayName\": \"LogonGuid\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonHours\",\r\n \"displayName\": \"LogonHours\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonID\",\r\n \"displayName\": \"LogonID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonProcessName\",\r\n \"displayName\": \"LogonProcessName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonType\",\r\n \"displayName\": \"LogonType\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LogonTypeName\",\r\n \"displayName\": \"LogonTypeName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MachineAccountQuota\",\r\n \"displayName\": \"MachineAccountQuota\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MachineInventory\",\r\n \"displayName\": \"MachineInventory\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MaxPasswordAge\",\r\n \"displayName\": \"MaxPasswordAge\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MemberName\",\r\n \"displayName\": \"MemberName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MemberSid\",\r\n \"displayName\": \"MemberSid\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MinPasswordAge\",\r\n \"displayName\": \"MinPasswordAge\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MinPasswordLength\",\r\n \"displayName\": \"MinPasswordLength\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MixedDomainMode\",\r\n \"displayName\": \"MixedDomainMode\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NASIdentifier\",\r\n \"displayName\": \"NASIdentifier\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NASIPv4Address\",\r\n \"displayName\": \"NASIPv4Address\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NASIPv6Address\",\r\n \"displayName\": \"NASIPv6Address\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NASPort\",\r\n \"displayName\": \"NASPort\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NASPortType\",\r\n \"displayName\": \"NASPortType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NetworkPolicyName\",\r\n \"displayName\": \"NetworkPolicyName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewDate\",\r\n \"displayName\": \"NewDate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewMaxUsers\",\r\n \"displayName\": \"NewMaxUsers\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewProcessId\",\r\n \"displayName\": \"NewProcessId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewProcessName\",\r\n \"displayName\": \"NewProcessName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewRemark\",\r\n \"displayName\": \"NewRemark\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewShareFlags\",\r\n \"displayName\": \"NewShareFlags\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewTime\",\r\n \"displayName\": \"NewTime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewUacValue\",\r\n \"displayName\": \"NewUacValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewValue\",\r\n \"displayName\": \"NewValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NewValueType\",\r\n \"displayName\": \"NewValueType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ObjectValueName\",\r\n \"displayName\": \"ObjectValueName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OemInformation\",\r\n \"displayName\": \"OemInformation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldMaxUsers\",\r\n \"displayName\": \"OldMaxUsers\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldRemark\",\r\n \"displayName\": \"OldRemark\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldShareFlags\",\r\n \"displayName\": \"OldShareFlags\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldUacValue\",\r\n \"displayName\": \"OldUacValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldValue\",\r\n \"displayName\": \"OldValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldValueType\",\r\n \"displayName\": \"OldValueType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PackageName\",\r\n \"displayName\": \"PackageName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ParentProcessName\",\r\n \"displayName\": \"ParentProcessName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PasswordHistoryLength\",\r\n \"displayName\": \"PasswordHistoryLength\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PasswordLastSet\",\r\n \"displayName\": \"PasswordLastSet\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PasswordProperties\",\r\n \"displayName\": \"PasswordProperties\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PreviousDate\",\r\n \"displayName\": \"PreviousDate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PreviousTime\",\r\n \"displayName\": \"PreviousTime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrimaryGroupId\",\r\n \"displayName\": \"PrimaryGroupId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrivateKeyUsageCount\",\r\n \"displayName\": \"PrivateKeyUsageCount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PrivilegeList\",\r\n \"displayName\": \"PrivilegeList\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Process\",\r\n \"displayName\": \"Process\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProcessName\",\r\n \"displayName\": \"ProcessName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"Syslog\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProfilePath\",\r\n \"displayName\": \"ProfilePath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProtocolSequence\",\r\n \"displayName\": \"ProtocolSequence\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProxyPolicyName\",\r\n \"displayName\": \"ProxyPolicyName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QuarantineHelpURL\",\r\n \"displayName\": \"QuarantineHelpURL\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QuarantineSessionID\",\r\n \"displayName\": \"QuarantineSessionID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QuarantineSessionIdentifier\",\r\n \"displayName\": \"QuarantineSessionIdentifier\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QuarantineState\",\r\n \"displayName\": \"QuarantineState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QuarantineSystemHealthResult\",\r\n \"displayName\": \"QuarantineSystemHealthResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RelativeTargetName\",\r\n \"displayName\": \"RelativeTargetName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemoteIpAddress\",\r\n \"displayName\": \"RemoteIpAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemotePort\",\r\n \"displayName\": \"RemotePort\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Requester\",\r\n \"displayName\": \"Requester\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RequestId\",\r\n \"displayName\": \"RequestId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RowsDeleted\",\r\n \"displayName\": \"RowsDeleted\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SamAccountName\",\r\n \"displayName\": \"SamAccountName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ScriptPath\",\r\n \"displayName\": \"ScriptPath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SecurityDescriptor\",\r\n \"displayName\": \"SecurityDescriptor\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceAccount\",\r\n \"displayName\": \"ServiceAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceFileName\",\r\n \"displayName\": \"ServiceFileName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceName\",\r\n \"displayName\": \"ServiceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceStartType\",\r\n \"displayName\": \"ServiceStartType\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceType\",\r\n \"displayName\": \"ServiceType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SessionName\",\r\n \"displayName\": \"SessionName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ShareLocalPath\",\r\n \"displayName\": \"ShareLocalPath\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ShareName\",\r\n \"displayName\": \"ShareName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SidHistory\",\r\n \"displayName\": \"SidHistory\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Status\",\r\n \"displayName\": \"Status\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectAccount\",\r\n \"displayName\": \"SubjectAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubcategoryGuid\",\r\n \"displayName\": \"SubcategoryGuid\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubcategoryId\",\r\n \"displayName\": \"SubcategoryId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Subject\",\r\n \"displayName\": \"Subject\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectDomainName\",\r\n \"displayName\": \"SubjectDomainName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectKeyIdentifier\",\r\n \"displayName\": \"SubjectKeyIdentifier\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectLogonId\",\r\n \"displayName\": \"SubjectLogonId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectMachineName\",\r\n \"displayName\": \"SubjectMachineName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectMachineSID\",\r\n \"displayName\": \"SubjectMachineSID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectUserName\",\r\n \"displayName\": \"SubjectUserName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubjectUserSid\",\r\n \"displayName\": \"SubjectUserSid\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SubStatus\",\r\n \"displayName\": \"SubStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TableId\",\r\n \"displayName\": \"TableId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetAccount\",\r\n \"displayName\": \"TargetAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetDomainName\",\r\n \"displayName\": \"TargetDomainName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetInfo\",\r\n \"displayName\": \"TargetInfo\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetLogonGuid\",\r\n \"displayName\": \"TargetLogonGuid\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetLogonId\",\r\n \"displayName\": \"TargetLogonId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetServerName\",\r\n \"displayName\": \"TargetServerName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetSid\",\r\n \"displayName\": \"TargetSid\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetUser\",\r\n \"displayName\": \"TargetUser\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetUserName\",\r\n \"displayName\": \"TargetUserName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TargetUserSid\",\r\n \"displayName\": \"TargetUserSid\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateContent\",\r\n \"displayName\": \"TemplateContent\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateDSObjectFQDN\",\r\n \"displayName\": \"TemplateDSObjectFQDN\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateInternalName\",\r\n \"displayName\": \"TemplateInternalName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateOID\",\r\n \"displayName\": \"TemplateOID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateSchemaVersion\",\r\n \"displayName\": \"TemplateSchemaVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TemplateVersion\",\r\n \"displayName\": \"TemplateVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TokenElevationType\",\r\n \"displayName\": \"TokenElevationType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TransmittedServices\",\r\n \"displayName\": \"TransmittedServices\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserAccountControl\",\r\n \"displayName\": \"UserAccountControl\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserParameters\",\r\n \"displayName\": \"UserParameters\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserPrincipalName\",\r\n \"displayName\": \"UserPrincipalName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UserWorkstations\",\r\n \"displayName\": \"UserWorkstations\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Workstation\",\r\n \"displayName\": \"Workstation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WorkstationName\",\r\n \"displayName\": \"WorkstationName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PartitionKey\",\r\n \"displayName\": \"PartitionKey\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RowKey\",\r\n \"displayName\": \"RowKey\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"StorageAccount\",\r\n \"displayName\": \"StorageAccount\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\",\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AzureTableName\",\r\n \"displayName\": \"AzureTableName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SecurityEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProviderGuid\",\r\n \"displayName\": \"ProviderGuid\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Pid\",\r\n \"displayName\": \"Pid\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Tid\",\r\n \"displayName\": \"Tid\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OpcodeName\",\r\n \"displayName\": \"OpcodeName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"KeywordName\",\r\n \"displayName\": \"KeywordName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TaskName\",\r\n \"displayName\": \"TaskName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ChannelName\",\r\n \"displayName\": \"ChannelName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventMessage\",\r\n \"displayName\": \"EventMessage\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApplicationName\",\r\n \"displayName\": \"ApplicationName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApplicationTypeName\",\r\n \"displayName\": \"ApplicationTypeName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApplicationTypeVersion\",\r\n \"displayName\": \"ApplicationTypeVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpgradeDomains\",\r\n \"displayName\": \"UpgradeDomains\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ServiceTypeName\",\r\n \"displayName\": \"ServiceTypeName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PartitionId\",\r\n \"displayName\": \"PartitionId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricOperationalEvent\",\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActorType\",\r\n \"displayName\": \"ActorType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActorId\",\r\n \"displayName\": \"ActorId\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActorIdKind\",\r\n \"displayName\": \"ActorIdKind\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsStateful\",\r\n \"displayName\": \"IsStateful\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReplicaOrInstanceId\",\r\n \"displayName\": \"ReplicaOrInstanceId\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NodeName\",\r\n \"displayName\": \"NodeName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NodeId\",\r\n \"displayName\": \"NodeId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CountOfWaitingMethodCalls\",\r\n \"displayName\": \"CountOfWaitingMethodCalls\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MethodName\",\r\n \"displayName\": \"MethodName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MethodSignature\",\r\n \"displayName\": \"MethodSignature\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MethodExecutionTimeTicks\",\r\n \"displayName\": \"MethodExecutionTimeTicks\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Exception\",\r\n \"displayName\": \"Exception\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SaveStateExecutionTimeTicks\",\r\n \"displayName\": \"SaveStateExecutionTimeTicks\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReplicaId\",\r\n \"displayName\": \"ReplicaId\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableActorEvent\",\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SlowCancellationTimeMillis\",\r\n \"displayName\": \"SlowCancellationTimeMillis\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WasCanceled\",\r\n \"displayName\": \"WasCanceled\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ActualCancellationTimeMillis\",\r\n \"displayName\": \"ActualCancellationTimeMillis\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InstanceId\",\r\n \"displayName\": \"InstanceId\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"ServiceFabricReliableServiceEvent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_SourceHealthServiceId\",\r\n \"displayName\": \"SCSM_SourceHealthServiceId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualCost\",\r\n \"displayName\": \"SCSM_ActualCost\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualDowntimeEndDate\",\r\n \"displayName\": \"SCSM_ActualDowntimeEndDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualDowntimeStartDate\",\r\n \"displayName\": \"SCSM_ActualDowntimeStartDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualEndDate\",\r\n \"displayName\": \"SCSM_ActualEndDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualStartDate\",\r\n \"displayName\": \"SCSM_ActualStartDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ActualWork\",\r\n \"displayName\": \"SCSM_ActualWork\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Classification\",\r\n \"displayName\": \"SCSM_Classification\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ClosedDate\",\r\n \"displayName\": \"SCSM_ClosedDate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ContactMethod\",\r\n \"displayName\": \"SCSM_ContactMethod\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_CreatedDate\",\r\n \"displayName\": \"SCSM_CreatedDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Description\",\r\n \"displayName\": \"SCSM_Description\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_DisplayName\",\r\n \"displayName\": \"SCSM_DisplayName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Escalated\",\r\n \"displayName\": \"SCSM_Escalated\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_FirstAssignedDate\",\r\n \"displayName\": \"SCSM_FirstAssignedDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_FirstResponseDate\",\r\n \"displayName\": \"SCSM_FirstResponseDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_HasCreatedKnowledgeArticle\",\r\n \"displayName\": \"SCSM_HasCreatedKnowledgeArticle\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ID\",\r\n \"displayName\": \"SCSM_ID\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Impact\",\r\n \"displayName\": \"SCSM_Impact\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_IsDowntime\",\r\n \"displayName\": \"SCSM_IsDowntime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_IsParent\",\r\n \"displayName\": \"SCSM_IsParent\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_LastModifiedSource\",\r\n \"displayName\": \"SCSM_LastModifiedSource\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_NeedsKnowledgeArticle\",\r\n \"displayName\": \"SCSM_NeedsKnowledgeArticle\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_PlannedCost\",\r\n \"displayName\": \"SCSM_PlannedCost\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_PlannedWork\",\r\n \"displayName\": \"SCSM_PlannedWork\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Priority\",\r\n \"displayName\": \"SCSM_Priority\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_RequiredBy\",\r\n \"displayName\": \"SCSM_RequiredBy\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ResolutionCategory\",\r\n \"displayName\": \"SCSM_ResolutionCategory\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ResolutionDescription\",\r\n \"displayName\": \"SCSM_ResolutionDescription\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ResolvedDate\",\r\n \"displayName\": \"SCSM_ResolvedDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ScheduledDowntimeEndDate\",\r\n \"displayName\": \"SCSM_ScheduledDowntimeEndDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ScheduledDowntimeStartDate\",\r\n \"displayName\": \"SCSM_ScheduledDowntimeStartDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ScheduledEndDate\",\r\n \"displayName\": \"SCSM_ScheduledEndDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ScheduledStartDate\",\r\n \"displayName\": \"SCSM_ScheduledStartDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Source\",\r\n \"displayName\": \"SCSM_Source\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Status\",\r\n \"displayName\": \"SCSM_Status\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_TargetResolutionTime\",\r\n \"displayName\": \"SCSM_TargetResolutionTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_TierQueue\",\r\n \"displayName\": \"SCSM_TierQueue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Title\",\r\n \"displayName\": \"SCSM_Title\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Urgency\",\r\n \"displayName\": \"SCSM_Urgency\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_UserInput\",\r\n \"displayName\": \"SCSM_UserInput\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Name\",\r\n \"displayName\": \"SCSM_Name\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_Path\",\r\n \"displayName\": \"SCSM_Path\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_FullName\",\r\n \"displayName\": \"SCSM_FullName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_LastModified\",\r\n \"displayName\": \"SCSM_LastModified\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_TimeAdded\",\r\n \"displayName\": \"SCSM_TimeAdded\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_LastModifiedBy\",\r\n \"displayName\": \"SCSM_LastModifiedBy\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_AffectedUser\",\r\n \"displayName\": \"SCSM_AffectedUser\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_AssignedToUser\",\r\n \"displayName\": \"SCSM_AssignedToUser\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_PrimaryOwner\",\r\n \"displayName\": \"SCSM_PrimaryOwner\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_AffectsService\",\r\n \"displayName\": \"SCSM_AffectsService\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_AboutConfigurationItem\",\r\n \"displayName\": \"SCSM_AboutConfigurationItem\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_SLO\",\r\n \"displayName\": \"SCSM_SLO\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ManagementGroupId\",\r\n \"displayName\": \"SCSM_ManagementGroupId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ODSDeliveryTime\",\r\n \"displayName\": \"SCSM_ODSDeliveryTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SCSM_ManagementGroupName\",\r\n \"displayName\": \"SCSM_ManagementGroupName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SMIncidentFactArtifact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SqlInstanceName\",\r\n \"displayName\": \"SqlInstanceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DatabaseName\",\r\n \"displayName\": \"DatabaseName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SQLAssessmentRecommendation\",\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AffectedObjectResult\",\r\n \"displayName\": \"AffectedObjectResult\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SQLAssessmentRecommendation\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryHash\",\r\n \"displayName\": \"QueryHash\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TotalWorkerTime\",\r\n \"displayName\": \"TotalWorkerTime\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AverageCPUTime\",\r\n \"displayName\": \"AverageCPUTime\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ExecutionCount\",\r\n \"displayName\": \"ExecutionCount\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CreationTime\",\r\n \"displayName\": \"CreationTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastExecutionTime\",\r\n \"displayName\": \"LastExecutionTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SQLQueryPerformanceTest\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"QueryName\",\r\n \"displayName\": \"QueryName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"SurfaceHubDns\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ComputerName\",\r\n \"displayName\": \"ComputerName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"SurfaceHubDns\",\r\n \"SurfaceHubUserSessionFact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"EventTime\",\r\n \"displayName\": \"EventTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Facility\",\r\n \"displayName\": \"Facility\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SeverityLevel\",\r\n \"displayName\": \"SeverityLevel\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProcessID\",\r\n \"displayName\": \"ProcessID\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Syslog\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"HostIP\",\r\n \"displayName\": \"HostIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PreciseTimeStamp\",\r\n \"displayName\": \"PreciseTimeStamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Priority_CommonForUpdate\",\r\n \"displayName\": \"Test_Priority_CommonForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Severity_CommonForUpdate\",\r\n \"displayName\": \"Test_Severity_CommonForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Source_CommonForUpdate\",\r\n \"displayName\": \"Test_Source_CommonForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Id_CommonForUpdate\",\r\n \"displayName\": \"Test_Id_CommonForUpdate\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Name_CommonForUpdate\",\r\n \"displayName\": \"Test_Name_CommonForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_IsMonitor_CommonForUpdate\",\r\n \"displayName\": \"Test_IsMonitor_CommonForUpdate\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_RepeatCount_ForUpdate\",\r\n \"displayName\": \"Test_RepeatCount_ForUpdate\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\",\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_ResolutionState_ForUpdate\",\r\n \"displayName\": \"Test_ResolutionState_ForUpdate\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\",\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_State_CommonForUpdate\",\r\n \"displayName\": \"Test_State_CommonForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_TimeRaised_CommonForUpdate\",\r\n \"displayName\": \"Test_TimeRaised_CommonForUpdate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_TimeLastModified_CommonForUpdate\",\r\n \"displayName\": \"Test_ModifiedAt_CommonForUpdate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Key1_CommonForUpdate\",\r\n \"displayName\": \"Test_Key1_CommonForUpdate\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestCommonAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RecordStruct\",\r\n \"displayName\": \"RecordStruct\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Record\",\r\n \"displayName\": \"Record\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ParamExecutableName\",\r\n \"displayName\": \"ParamExecutableName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TheProcessName\",\r\n \"displayName\": \"TheProcessName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestFlashMEvent\",\r\n \"TestFlashWERBackdated\",\r\n \"TestFlashWERBackdated1\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Priority_ForUpdate\",\r\n \"displayName\": \"Test_Priority_ForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Severity_ForUpdate\",\r\n \"displayName\": \"Test_Severity_ForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Source_ForUpdate\",\r\n \"displayName\": \"Test_Source_ForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Id_ForUpdate\",\r\n \"displayName\": \"Test_Id_ForUpdate\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Name_ForUpdate\",\r\n \"displayName\": \"Test_Name_ForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_IsMonitor_ForUpdate\",\r\n \"displayName\": \"Test_IsMonitor_ForUpdate\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_State_ForUpdate\",\r\n \"displayName\": \"Test_State_ForUpdate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_TimeRaised_ForUpdate\",\r\n \"displayName\": \"Test_TimeRaised_ForUpdate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_TimeLastModified_ForUpdate\",\r\n \"displayName\": \"Test_ModifiedAt_ForUpdate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Test_Alert_Key1_ForUpdate\",\r\n \"displayName\": \"Test_Key1_ForUpdate\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"TestUpdatAlertfact\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SourceComputerId\",\r\n \"displayName\": \"SourceComputerId\",\r\n \"type\": \"Guid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\",\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Title\",\r\n \"displayName\": \"Title\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MSRCSeverity\",\r\n \"displayName\": \"MSRCSeverity\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Classification\",\r\n \"displayName\": \"Classification\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"PublishedDate\",\r\n \"displayName\": \"PublishedDate\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpdateState\",\r\n \"displayName\": \"UpdateState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"UpdateID\",\r\n \"displayName\": \"UpdateID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RevisionNumber\",\r\n \"displayName\": \"RevisionNumber\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Optional\",\r\n \"displayName\": \"Optional\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RebootBehavior\",\r\n \"displayName\": \"RebootBehavior\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MSRCBulletinID\",\r\n \"displayName\": \"MSRCBulletinID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Approved\",\r\n \"displayName\": \"Approved\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApprovalSource\",\r\n \"displayName\": \"ApprovalSource\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InstallTimePredictionSeconds\",\r\n \"displayName\": \"InstallTimePredictionSeconds\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InstallTimeDeviationRangeSeconds\",\r\n \"displayName\": \"InstallTimeDeviationRangeSeconds\",\r\n \"type\": \"Double\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"InstallTimeAvailable\",\r\n \"displayName\": \"InstallTimeAvailable\",\r\n \"type\": \"Bool\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"Update\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastUpdateUTC\",\r\n \"displayName\": \"LastUpdateUTC\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DaysSinceLastUpdate\",\r\n \"displayName\": \"DaysSinceLastUpdate\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"DaysSinceLastUpdateBucket\",\r\n \"displayName\": \"DaysSinceLastUpdateBucket\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AutomaticUpdateEnabled\",\r\n \"displayName\": \"AutomaticUpdateEnabled\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AutomaticUpdateValue\",\r\n \"displayName\": \"AutomaticUpdateValue\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WindowsUpdateAgentVersion\",\r\n \"displayName\": \"WindowsUpdateAgentVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\",\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WSUSServer\",\r\n \"displayName\": \"WSUSServer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\",\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OSVersion\",\r\n \"displayName\": \"OSVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateAgent\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastUpdateApplied\",\r\n \"displayName\": \"LastUpdateApplied\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldestMissingSecurityUpdateInDays\",\r\n \"displayName\": \"OldestMissingSecurityUpdateInDays\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OldestMissingSecurityUpdateBucket\",\r\n \"displayName\": \"OldestMissingSecurityUpdateBucket\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"WindowsUpdateSetting\",\r\n \"displayName\": \"WindowsUpdateSetting\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OsVersion\",\r\n \"displayName\": \"OsVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"NETRuntimeVersion\",\r\n \"displayName\": \"NETRuntimeVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CriticalUpdatesCategoryMissingCount\",\r\n \"displayName\": \"CriticalUpdatesMissing\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SecurityUpdatesCategoryMissingCount\",\r\n \"displayName\": \"SecurityUpdatesMissing\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"OtherCategoryMissingCount\",\r\n \"displayName\": \"OtherUpdatesMissing\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TotalMissingCount\",\r\n \"displayName\": \"TotalUpdatesMissing\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"UpdateSummary\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileUri\",\r\n \"displayName\": \"FileUri\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FileOffset\",\r\n \"displayName\": \"FileOffset\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Date\",\r\n \"displayName\": \"Date\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Time\",\r\n \"displayName\": \"Time\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"sSiteName\",\r\n \"displayName\": \"sSiteName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"sComputerName\",\r\n \"displayName\": \"sComputerName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"sIP\",\r\n \"displayName\": \"sIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csMethod\",\r\n \"displayName\": \"csMethod\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csUriStem\",\r\n \"displayName\": \"csUriStem\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csUriQuery\",\r\n \"displayName\": \"csUriQuery\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"sPort\",\r\n \"displayName\": \"sPort\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csUserName\",\r\n \"displayName\": \"csUserName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"cIP\",\r\n \"displayName\": \"cIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csVersion\",\r\n \"displayName\": \"csVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csUserAgent\",\r\n \"displayName\": \"csUserAgent\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csCookie\",\r\n \"displayName\": \"csCookie\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csReferer\",\r\n \"displayName\": \"csReferer\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csHost\",\r\n \"displayName\": \"csHost\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"scStatus\",\r\n \"displayName\": \"scStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"scSubStatus\",\r\n \"displayName\": \"scSubStatus\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"scWin32Status\",\r\n \"displayName\": \"scWin32Status\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"scBytes\",\r\n \"displayName\": \"scBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"csBytes\",\r\n \"displayName\": \"csBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TimeTaken\",\r\n \"displayName\": \"TimeTaken\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MaliciousIP\",\r\n \"displayName\": \"MaliciousIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IndicatorThreatType\",\r\n \"displayName\": \"IndicatorThreatType\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TLPLevel\",\r\n \"displayName\": \"TLPLevel\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Confidence\",\r\n \"displayName\": \"Confidence\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FirstReportedDateTime\",\r\n \"displayName\": \"FirstReportedDateTime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LastReportedDateTime\",\r\n \"displayName\": \"LastReportedDateTime\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IsActive\",\r\n \"displayName\": \"IsActive\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReportReferenceLink\",\r\n \"displayName\": \"ReportReferenceLink\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"AdditionalInformation\",\r\n \"displayName\": \"AdditionalInformation\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"W3CIISLog\",\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RoleInstance\",\r\n \"displayName\": \"RoleInstance\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"W3CIISLog\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"CommunicationDirection\",\r\n \"displayName\": \"CommunicationDirection\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FirewallAction\",\r\n \"displayName\": \"FirewallAction\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemoteIP\",\r\n \"displayName\": \"RemoteIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WindowsFirewall\",\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"FullDestinationAddress\",\r\n \"displayName\": \"FullDestinationAddress\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RequestSizeInBytes\",\r\n \"displayName\": \"RequestSizeInBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Info\",\r\n \"displayName\": \"Info\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WindowsFirewall\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SessionStartTime\",\r\n \"displayName\": \"SessionStartTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SessionEndTime\",\r\n \"displayName\": \"SessionEndTime\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LocalIP\",\r\n \"displayName\": \"LocalIP\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LocalSubnet\",\r\n \"displayName\": \"LocalSubnet\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LocalMAC\",\r\n \"displayName\": \"LocalMAC\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LocalPortNumber\",\r\n \"displayName\": \"LocalPortNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemoteMAC\",\r\n \"displayName\": \"RemoteMAC\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"RemotePortNumber\",\r\n \"displayName\": \"RemotePortNumber\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SessionID\",\r\n \"displayName\": \"SessionID\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SequenceNumber\",\r\n \"displayName\": \"SequenceNumber\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SessionState\",\r\n \"displayName\": \"SessionState\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SentBytes\",\r\n \"displayName\": \"SentBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReceivedBytes\",\r\n \"displayName\": \"ReceivedBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"TotalBytes\",\r\n \"displayName\": \"TotalBytes\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ProtocolName\",\r\n \"displayName\": \"ProtocolName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"IPVersion\",\r\n \"displayName\": \"IPVersion\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"SentPackets\",\r\n \"displayName\": \"SentPackets\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ReceivedPackets\",\r\n \"displayName\": \"ReceivedPackets\",\r\n \"type\": \"BigInt\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApplicationProtocol\",\r\n \"displayName\": \"ApplicationProtocol\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"ApplicationServiceName\",\r\n \"displayName\": \"ApplicationServiceName\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LatencyMilliseconds\",\r\n \"displayName\": \"LatencyMilliseconds\",\r\n \"type\": \"Int\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LatencySamplingTimeStamp\",\r\n \"displayName\": \"LatencySamplingTimeStamp\",\r\n \"type\": \"DateTime\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"LatencySamplingFailureRate\",\r\n \"displayName\": \"LatencySamplingFailureRate\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": false,\r\n \"ownerType\": [\r\n \"WireData\"\r\n ],\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"Type\",\r\n \"displayName\": \"Type\",\r\n \"type\": \"string\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": true,\r\n \"display\": true,\r\n \"ownerType\": null,\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"id\",\r\n \"displayName\": null,\r\n \"type\": \"uuid\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": false,\r\n \"hidden\": true,\r\n \"display\": false,\r\n \"ownerType\": null,\r\n \"extraction\": null\r\n },\r\n {\r\n \"name\": \"MaliciousIP_CF_724003043\",\r\n \"displayName\": \"MaliciousIP_CF\",\r\n \"type\": \"String\",\r\n \"indexed\": true,\r\n \"stored\": true,\r\n \"facet\": true,\r\n \"hidden\": false,\r\n \"display\": true,\r\n \"ownerType\": [\r\n \"Syslog\"\r\n ],\r\n \"extraction\": {\r\n \"type\": \"Flash\",\r\n \"xmlProgram\": \"\\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n\",\r\n \"readableProgram\": \"let v = StartSubstring(v, AbsPosSubstr(v, 1)) in RefStartPositionPair(v, AbsPosSubstr(v, -1))\",\r\n \"sourceType\": \"Syslog\",\r\n \"sourceField\": \"HostIP\"\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "175683"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-writes": [
+ "1198"
+ ],
+ "x-ms-request-id": [
+ "06d2ffa6-f5bd-401f-82b9-f643fc33a7dd"
+ ],
+ "x-ms-correlation-request-id": [
+ "06d2ffa6-f5bd-401f-82b9-f643fc33a7dd"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T192400Z:06d2ffa6-f5bd-401f-82b9-f643fc33a7dd"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 19:24:00 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ }
+ ],
+ "Names": {},
+ "Variables": {
+ "SubscriptionId": "df1ec963-d784-4d11-a779-1b3eeb9ecb78"
+ }
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSearchResultsAndUpdate.json b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSearchResultsAndUpdate.json
new file mode 100644
index 000000000000..648afd9822d3
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchGetSearchResultsAndUpdate.json
@@ -0,0 +1,140 @@
+{
+ "Entries": [
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL09JLURlZmF1bHQtRWFzdC1VUy9wcm92aWRlcnMvTWljcm9zb2Z0Lk9wZXJhdGlvbmFsSW5zaWdodHMvd29ya3NwYWNlcy9yYXNoYS9zZWFyY2g/YXBpLXZlcnNpb249MjAxNS0wMy0yMA==",
+ "RequestMethod": "POST",
+ "RequestBody": "{\r\n \"top\": 25,\r\n \"skip\": 0,\r\n \"highlight\": {},\r\n \"includeArchive\": false,\r\n \"query\": \"*\",\r\n \"facet\": {\r\n \"limit\": 0,\r\n \"mincount\": 0,\r\n \"range\": {}\r\n }\r\n}",
+ "RequestHeaders": {
+ "Content-Type": [
+ "application/json"
+ ],
+ "Content-Length": [
+ "170"
+ ],
+ "x-ms-client-request-id": [
+ "6b278cbc-b82a-4648-bd80-dc02d1220963"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296\",\r\n \"__metadata\": {\r\n \"resultType\": \"raw\",\r\n \"total\": 46785694,\r\n \"top\": 25,\r\n \"CoreResponses\": [],\r\n \"CoreSummaries\": [\r\n {\r\n \"Status\": \"Pending\",\r\n \"NumberOfDocuments\": 193532127\r\n }\r\n ],\r\n \"Status\": \"Pending\",\r\n \"NumberOfDocuments\": 193532127,\r\n \"StartTime\": \"2015-12-03T21:29:43.7823329Z\",\r\n \"LastUpdated\": \"2015-12-03T21:29:44.7511016Z\",\r\n \"ETag\": \"635847749847511016\",\r\n \"sort\": [\r\n {\r\n \"name\": \"TimeGenerated\",\r\n \"order\": \"desc\"\r\n }\r\n ],\r\n \"requestTime\": 1346\r\n },\r\n \"value\": [\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.603Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a9c4c74e-5ffb-0573-c5c7-cc7a71298e3d\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.603Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"1a3fbcf9-eaff-61b0-4bc2-bc95854b8e0b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"f5ddaadb-4ed4-ae5f-5a80-5e13eec4051f\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.447Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"7e182dae-3d6a-3660-1f23-ea52eb4ee735\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.447Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.44Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"413aeedc-57bc-bdf5-8ecf-473ac7997e6e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.44Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.433Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"31355c51-682f-eb37-8540-4d54f685cf32\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.433Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"2ca46919-ec69-4913-bbf6-36199d1d0d9b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a36212f1-335a-8f70-66e3-138943cb4ae9\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.427Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"63438676-bf6b-fe2b-2fe4-726abf903700\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.427Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.423Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"051cec82-700a-1040-68ee-84166b28b392\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.423Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.42Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"1bd0bb1f-9523-6272-af17-ef021dd7a45a\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.42Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.413Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"5b93d193-af71-d484-8564-bd2ea7ec7fbf\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.413Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.403Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"ef17605d-fca8-96a3-141e-dda4d5ff2f72\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.403Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"00a3242e-6e86-f77e-6859-9821db59de58\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"769af606-0701-413c-9854-3c9b8bb9d768\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.397Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"2c00e61a-4fe2-237e-32ce-ad0d42b95d24\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.397Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.393Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a3803e07-0c19-08e5-11e8-6836f7c5f85b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.393Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.38Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a0181394-c5f6-7a8d-d3a6-9d9b1b824c58\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.38Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"50d86e76-09e1-b122-8d5f-c8f63f752311\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"b0cd33c5-4bfb-951e-649e-8af81414d83e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"5b1bf25f-3b25-c368-8440-62f829bee9ca\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"525218d0-bf6a-a352-be24-c2c1c559c24e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.36Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"50d096f1-5077-7707-3bf8-b03544e21add\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.36Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"d853c002-574b-4349-7892-16e6e9eeb342\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"89ba7a1a-09ca-d9c7-3d9c-93c0ddde957d\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"highlighting\": {}\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "42057"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14974"
+ ],
+ "x-ms-request-id": [
+ "6567b9c1-6c1d-4a3a-ab71-0fd0bbbf0d5d"
+ ],
+ "x-ms-correlation-request-id": [
+ "6567b9c1-6c1d-4a3a-ab71-0fd0bbbf0d5d"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T212944Z:6567b9c1-6c1d-4a3a-ab71-0fd0bbbf0d5d"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 21:29:44 GMT"
+ ],
+ "Location": [
+ "https://https//api-dogfood.resources.windows-int.net/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search?api-version=2015-03-20/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296&api-version=2015-03-20"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL09JLURlZmF1bHQtRWFzdC1VUy9wcm92aWRlcnMvTWljcm9zb2Z0Lk9wZXJhdGlvbmFsSW5zaWdodHMvd29ya3NwYWNlcy9yYXNoYS9zZWFyY2gvZTA2Zjk2MDctNmZlZS00NjE2LWEzZjAtMDY1NjBhYjQ2Mjk2P2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "POST",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "f5beae7a-3eb1-43a4-aa24-6aab93403401"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296\",\r\n \"__metadata\": {\r\n \"resultType\": \"raw\",\r\n \"total\": 56963409,\r\n \"top\": 25,\r\n \"CoreResponses\": [],\r\n \"CoreSummaries\": [\r\n {\r\n \"Status\": \"Pending\",\r\n \"NumberOfDocuments\": 183354412\r\n },\r\n {\r\n \"Status\": \"Successful\",\r\n \"NumberOfDocuments\": 10177715\r\n }\r\n ],\r\n \"Status\": \"Pending\",\r\n \"NumberOfDocuments\": 193532127,\r\n \"StartTime\": \"2015-12-03T21:29:43.7823329Z\",\r\n \"LastUpdated\": \"2015-12-03T21:29:45.2823987Z\",\r\n \"ETag\": \"635847749852823987\",\r\n \"sort\": [\r\n {\r\n \"name\": \"TimeGenerated\",\r\n \"order\": \"desc\"\r\n }\r\n ],\r\n \"requestTime\": 288\r\n },\r\n \"value\": [\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.603Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a9c4c74e-5ffb-0573-c5c7-cc7a71298e3d\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.603Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"1a3fbcf9-eaff-61b0-4bc2-bc95854b8e0b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"f5ddaadb-4ed4-ae5f-5a80-5e13eec4051f\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.45Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.447Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"7e182dae-3d6a-3660-1f23-ea52eb4ee735\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.447Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.44Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"413aeedc-57bc-bdf5-8ecf-473ac7997e6e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.44Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.433Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"31355c51-682f-eb37-8540-4d54f685cf32\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.433Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"2ca46919-ec69-4913-bbf6-36199d1d0d9b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a36212f1-335a-8f70-66e3-138943cb4ae9\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.43Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.427Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"63438676-bf6b-fe2b-2fe4-726abf903700\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.427Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.423Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"051cec82-700a-1040-68ee-84166b28b392\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.423Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.42Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"1bd0bb1f-9523-6272-af17-ef021dd7a45a\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.42Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.413Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"5b93d193-af71-d484-8564-bd2ea7ec7fbf\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.413Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.403Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"ef17605d-fca8-96a3-141e-dda4d5ff2f72\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.403Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"00a3242e-6e86-f77e-6859-9821db59de58\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"769af606-0701-413c-9854-3c9b8bb9d768\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.4Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.397Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"2c00e61a-4fe2-237e-32ce-ad0d42b95d24\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.397Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.393Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a3803e07-0c19-08e5-11e8-6836f7c5f85b\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.393Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.38Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"a0181394-c5f6-7a8d-d3a6-9d9b1b824c58\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.38Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"50d86e76-09e1-b122-8d5f-c8f63f752311\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"b0cd33c5-4bfb-951e-649e-8af81414d83e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.37Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"5b1bf25f-3b25-c368-8440-62f829bee9ca\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"525218d0-bf6a-a352-be24-c2c1c559c24e\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.363Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.36Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"50d096f1-5077-7707-3bf8-b03544e21add\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.36Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"d853c002-574b-4349-7892-16e6e9eeb342\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"highlighting\": {}\r\n }\r\n },\r\n {\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"SourceSystem\": \"OpsManager\",\r\n \"Computer\": \"CLICH-PC01.northamerica.corp.microsoft.com\",\r\n \"Channel\": \"Security\",\r\n \"Task\": 13570,\r\n \"Level\": 8,\r\n \"EventData\": \"\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n S-1-5-18\\r\\n CLICH-PC01$\\r\\n NORTHAMERICA\\r\\n 0x3e7\\r\\n C:\\\\Windows\\\\System32\\\\svchost.exe\\r\\n 0x528\\r\\n SeAssignPrimaryTokenPrivilege \\t\\t\\tSeIncreaseQuotaPrivilege \\t\\t\\tSeSecurityPrivilege \\t\\t\\tSeTakeOwnershipPrivilege \\t\\t\\tSeLoadDriverPrivilege \\t\\t\\tSeSystemtimePrivilege \\t\\t\\tSeBackupPrivilege \\t\\t\\tSeRestorePrivilege \\t\\t\\tSeShutdownPrivilege \\t\\t\\tSeSystemEnvironmentPrivilege \\t\\t\\tSeUndockPrivilege \\t\\t\\tSeManageVolumePrivilege\\r\\n -\\r\\n\",\r\n \"EventID\": 4703,\r\n \"Activity\": \"4703\",\r\n \"MG\": \"00000000-0000-0000-0000-000000000001\",\r\n \"TimeCollected\": \"2015-12-03T21:28:35.687Z\",\r\n \"ManagementGroupName\": \"AOI-54bd7c21-cc2a-40fb-898f-ffd15604043e\",\r\n \"id\": \"89ba7a1a-09ca-d9c7-3d9c-93c0ddde957d\",\r\n \"Type\": \"SecurityEvent\",\r\n \"EventSourceName\": \"Microsoft-Windows-Security-Auditing\",\r\n \"__metadata\": {\r\n \"Type\": \"SecurityEvent\",\r\n \"TimeGenerated\": \"2015-12-03T21:28:35.357Z\",\r\n \"highlighting\": {}\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "42109"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14973"
+ ],
+ "x-ms-request-id": [
+ "54e551ad-e888-4984-8b4f-081b934a80ea"
+ ],
+ "x-ms-correlation-request-id": [
+ "54e551ad-e888-4984-8b4f-081b934a80ea"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20151203T212945Z:54e551ad-e888-4984-8b4f-081b934a80ea"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Thu, 03 Dec 2015 21:29:44 GMT"
+ ],
+ "Location": [
+ "https://https//api-dogfood.resources.windows-int.net/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296?api-version=2015-03-20/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/OI-Default-East-US/providers/Microsoft.OperationalInsights/workspaces/rasha/search/e06f9607-6fee-4616-a3f0-06560ab46296&api-version=2015-03-20"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ }
+ ],
+ "Names": {},
+ "Variables": {
+ "SubscriptionId": "df1ec963-d784-4d11-a779-1b3eeb9ecb78"
+ }
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchSetAndRemoveSavedSearches.json b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchSetAndRemoveSavedSearches.json
new file mode 100644
index 000000000000..d7bb5bd276f8
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/SessionRecords/Microsoft.Azure.Commands.OperationalInsights.Test.SearchTests/TestSearchSetAndRemoveSavedSearches.json
@@ -0,0 +1,437 @@
+{
+ "Entries": [
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "6e36b57d-9d47-40f9-abf0-d07a564485af"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {},\r\n \"value\": [\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A04%3A25.7940321Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test66666666666666666\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A05%3A27.9119521Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|testben\",\r\n \"etag\": \"W/\\\"datetime'2015-05-12T20%3A45%3A50.1632243Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/2b3a414c-e1b3-4c60-8bb3-b3828bef0174\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A55%3A12.5783991Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"* | Measure count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/51797902-3d96-46ba-95e3-26e74c91118d\",\r\n \"etag\": \"W/\\\"datetime'2015-10-23T04%3A58%3A47.9226934Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"norem\",\r\n \"DisplayName\": \"gasga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/5c7af1f8-bb71-4648-b7d9-910a6b9c9d74\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T19%3A03%3A42.498994Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"a\",\r\n \"DisplayName\": \"a\",\r\n \"Query\": \"Type=ADAssessmentRecommendation RecommendationPeriod=YYYY-MM IsRollup=false FocusArea=Prerequisites\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/60df279b-d288-4777-be03-b2ee65585488\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A46%3A14.747973Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert3\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/6d95bebd-f016-4a2a-8f8d-81c7c1c5a971\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A38%3A41.3404003Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/7c474737-9279-433a-af17-a1c5ad7f339a\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A11.8794146Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert4\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/857fb644-5543-4b8c-9028-05b0980240f9\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T22%3A14%3A03.421978Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"aetaeta\",\r\n \"DisplayName\": \"atett\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/9fddfbb4-ce42-4c4c-bd84-2263b10dffa1\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A30.3141368Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert6\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/a0efeb96-79cf-474b-a98c-23a3a76ee332\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A22.4599753Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert5\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/all|all\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A03%3A03.9192424Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"All\",\r\n \"DisplayName\": \"All\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T20%3A09%3A41.9906542Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"allcomputers\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers2\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T22%3A32%3A26.327691Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"AllComputers2\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/dd35eca5-3dc7-4e30-bf26-83e0cb5f0a2a\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T20%3A03%3A07.6701721Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"agasg\",\r\n \"DisplayName\": \"agsga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/intervals|count of all interval 1hour\",\r\n \"etag\": \"W/\\\"datetime'2015-11-07T00%3A16%3A14.7972332Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Intervals\",\r\n \"DisplayName\": \"Count of all interval 1hour\",\r\n \"Query\": \"* | measure count() by TimeGenerated interval 1HOUR\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/perf|avg disk writes by computer\",\r\n \"etag\": \"W/\\\"datetime'2015-11-05T19%3A48%3A24.8353096Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Perf\",\r\n \"DisplayName\": \"Avg Disk Writes by Computer\",\r\n \"Query\": \"* Type=Perf CounterName=\\\"Disk Write Bytes/sec\\\" | measure avg(CounterValue) by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|all events\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A02%3A49.4024833Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"All Events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|events\",\r\n \"etag\": \"W/\\\"datetime'2014-10-17T16%3A15%3A27.8903997Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/sql assessment|sql assmt by focus area\",\r\n \"etag\": \"W/\\\"datetime'2015-07-15T21%3A38%3A00.898438Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"SQL Assessment\",\r\n \"DisplayName\": \"SQL Assmt by Focus Area\",\r\n \"Query\": \"Type=SQLAssessmentRecommendation AssessmentName=SQLV2 RecommendationPeriod=YYYY-MM IsRollup=true | measure count() by FocusArea\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test|test\",\r\n \"etag\": \"W/\\\"datetime'2015-09-30T05%3A06%3A25.4487456Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"test\",\r\n \"DisplayName\": \"test\",\r\n \"Query\": \"Type=W3CIISLog\",\r\n \"Version\": 1\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "9664"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14816"
+ ],
+ "x-ms-request-id": [
+ "9dc2348d-b7c3-4548-90df-3c378a9bc4ad"
+ ],
+ "x-ms-correlation-request-id": [
+ "9dc2348d-b7c3-4548-90df-3c378a9bc4ad"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231251Z:9dc2348d-b7c3-4548-90df-3c378a9bc4ad"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:51 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "af2243f4-4158-45ce-944d-dea8b81f9228"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {},\r\n \"value\": [\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A04%3A25.7940321Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test66666666666666666\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A05%3A27.9119521Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|testben\",\r\n \"etag\": \"W/\\\"datetime'2015-05-12T20%3A45%3A50.1632243Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/2b3a414c-e1b3-4c60-8bb3-b3828bef0174\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A55%3A12.5783991Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"* | Measure count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/51797902-3d96-46ba-95e3-26e74c91118d\",\r\n \"etag\": \"W/\\\"datetime'2015-10-23T04%3A58%3A47.9226934Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"norem\",\r\n \"DisplayName\": \"gasga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/5c7af1f8-bb71-4648-b7d9-910a6b9c9d74\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T19%3A03%3A42.498994Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"a\",\r\n \"DisplayName\": \"a\",\r\n \"Query\": \"Type=ADAssessmentRecommendation RecommendationPeriod=YYYY-MM IsRollup=false FocusArea=Prerequisites\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/60df279b-d288-4777-be03-b2ee65585488\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A46%3A14.747973Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert3\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/6d95bebd-f016-4a2a-8f8d-81c7c1c5a971\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A38%3A41.3404003Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/7c474737-9279-433a-af17-a1c5ad7f339a\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A11.8794146Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert4\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/857fb644-5543-4b8c-9028-05b0980240f9\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T22%3A14%3A03.421978Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"aetaeta\",\r\n \"DisplayName\": \"atett\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/9fddfbb4-ce42-4c4c-bd84-2263b10dffa1\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A30.3141368Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert6\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/a0efeb96-79cf-474b-a98c-23a3a76ee332\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A22.4599753Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert5\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/all|all\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A03%3A03.9192424Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"All\",\r\n \"DisplayName\": \"All\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T20%3A09%3A41.9906542Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"allcomputers\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers2\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T22%3A32%3A26.327691Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"AllComputers2\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/dd35eca5-3dc7-4e30-bf26-83e0cb5f0a2a\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T20%3A03%3A07.6701721Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"agasg\",\r\n \"DisplayName\": \"agsga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/intervals|count of all interval 1hour\",\r\n \"etag\": \"W/\\\"datetime'2015-11-07T00%3A16%3A14.7972332Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Intervals\",\r\n \"DisplayName\": \"Count of all interval 1hour\",\r\n \"Query\": \"* | measure count() by TimeGenerated interval 1HOUR\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/perf|avg disk writes by computer\",\r\n \"etag\": \"W/\\\"datetime'2015-11-05T19%3A48%3A24.8353096Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Perf\",\r\n \"DisplayName\": \"Avg Disk Writes by Computer\",\r\n \"Query\": \"* Type=Perf CounterName=\\\"Disk Write Bytes/sec\\\" | measure avg(CounterValue) by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|all events\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A02%3A49.4024833Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"All Events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|events\",\r\n \"etag\": \"W/\\\"datetime'2014-10-17T16%3A15%3A27.8903997Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/sql assessment|sql assmt by focus area\",\r\n \"etag\": \"W/\\\"datetime'2015-07-15T21%3A38%3A00.898438Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"SQL Assessment\",\r\n \"DisplayName\": \"SQL Assmt by Focus Area\",\r\n \"Query\": \"Type=SQLAssessmentRecommendation AssessmentName=SQLV2 RecommendationPeriod=YYYY-MM IsRollup=true | measure count() by FocusArea\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015\",\r\n \"etag\": \"W/\\\"datetime'2016-01-15T23%3A12%3A52.463434Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"* | measure Count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test|test\",\r\n \"etag\": \"W/\\\"datetime'2015-09-30T05%3A06%3A25.4487456Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"test\",\r\n \"DisplayName\": \"test\",\r\n \"Query\": \"Type=W3CIISLog\",\r\n \"Version\": 1\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "10086"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14815"
+ ],
+ "x-ms-request-id": [
+ "58bac34c-d215-4b99-b894-5ea38bcab21e"
+ ],
+ "x-ms-correlation-request-id": [
+ "58bac34c-d215-4b99-b894-5ea38bcab21e"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231252Z:58bac34c-d215-4b99-b894-5ea38bcab21e"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:52 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "b13b6d53-74e0-4ec4-8a12-ec5bee4ba79e"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {},\r\n \"value\": [\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A04%3A25.7940321Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test66666666666666666\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A05%3A27.9119521Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|testben\",\r\n \"etag\": \"W/\\\"datetime'2015-05-12T20%3A45%3A50.1632243Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/2b3a414c-e1b3-4c60-8bb3-b3828bef0174\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A55%3A12.5783991Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"* | Measure count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/51797902-3d96-46ba-95e3-26e74c91118d\",\r\n \"etag\": \"W/\\\"datetime'2015-10-23T04%3A58%3A47.9226934Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"norem\",\r\n \"DisplayName\": \"gasga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/5c7af1f8-bb71-4648-b7d9-910a6b9c9d74\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T19%3A03%3A42.498994Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"a\",\r\n \"DisplayName\": \"a\",\r\n \"Query\": \"Type=ADAssessmentRecommendation RecommendationPeriod=YYYY-MM IsRollup=false FocusArea=Prerequisites\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/60df279b-d288-4777-be03-b2ee65585488\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A46%3A14.747973Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert3\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/6d95bebd-f016-4a2a-8f8d-81c7c1c5a971\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A38%3A41.3404003Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/7c474737-9279-433a-af17-a1c5ad7f339a\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A11.8794146Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert4\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/857fb644-5543-4b8c-9028-05b0980240f9\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T22%3A14%3A03.421978Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"aetaeta\",\r\n \"DisplayName\": \"atett\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/9fddfbb4-ce42-4c4c-bd84-2263b10dffa1\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A30.3141368Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert6\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/a0efeb96-79cf-474b-a98c-23a3a76ee332\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A22.4599753Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert5\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/all|all\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A03%3A03.9192424Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"All\",\r\n \"DisplayName\": \"All\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T20%3A09%3A41.9906542Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"allcomputers\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers2\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T22%3A32%3A26.327691Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"AllComputers2\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/dd35eca5-3dc7-4e30-bf26-83e0cb5f0a2a\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T20%3A03%3A07.6701721Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"agasg\",\r\n \"DisplayName\": \"agsga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/intervals|count of all interval 1hour\",\r\n \"etag\": \"W/\\\"datetime'2015-11-07T00%3A16%3A14.7972332Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Intervals\",\r\n \"DisplayName\": \"Count of all interval 1hour\",\r\n \"Query\": \"* | measure count() by TimeGenerated interval 1HOUR\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/perf|avg disk writes by computer\",\r\n \"etag\": \"W/\\\"datetime'2015-11-05T19%3A48%3A24.8353096Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Perf\",\r\n \"DisplayName\": \"Avg Disk Writes by Computer\",\r\n \"Query\": \"* Type=Perf CounterName=\\\"Disk Write Bytes/sec\\\" | measure avg(CounterValue) by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|all events\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A02%3A49.4024833Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"All Events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|events\",\r\n \"etag\": \"W/\\\"datetime'2014-10-17T16%3A15%3A27.8903997Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/sql assessment|sql assmt by focus area\",\r\n \"etag\": \"W/\\\"datetime'2015-07-15T21%3A38%3A00.898438Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"SQL Assessment\",\r\n \"DisplayName\": \"SQL Assmt by Focus Area\",\r\n \"Query\": \"Type=SQLAssessmentRecommendation AssessmentName=SQLV2 RecommendationPeriod=YYYY-MM IsRollup=true | measure count() by FocusArea\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015\",\r\n \"etag\": \"W/\\\"datetime'2016-01-15T23%3A12%3A53.6161946Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test|test\",\r\n \"etag\": \"W/\\\"datetime'2015-09-30T05%3A06%3A25.4487456Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"test\",\r\n \"DisplayName\": \"test\",\r\n \"Query\": \"Type=W3CIISLog\",\r\n \"Version\": 1\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "10061"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14814"
+ ],
+ "x-ms-request-id": [
+ "49f0e404-167a-462c-8eea-603e63fb919f"
+ ],
+ "x-ms-correlation-request-id": [
+ "49f0e404-167a-462c-8eea-603e63fb919f"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231253Z:49f0e404-167a-462c-8eea-603e63fb919f"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:53 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzP2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "GET",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "1cd05cd4-ed6a-49bf-b623-54154b168950"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"__metadata\": {},\r\n \"value\": [\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/0022aa2d-e4c2-4792-8672-c46e77ed116e\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A14%3A17.26477Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A04%3A25.7940321Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|test66666666666666666\",\r\n \"etag\": \"W/\\\"datetime'2015-08-27T19%3A05%3A27.9119521Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/1|testben\",\r\n \"etag\": \"W/\\\"datetime'2015-05-12T20%3A45%3A50.1632243Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"1\",\r\n \"DisplayName\": \"TestBen\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/2b3a414c-e1b3-4c60-8bb3-b3828bef0174\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A55%3A12.5783991Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"* | Measure count() by Type\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/51797902-3d96-46ba-95e3-26e74c91118d\",\r\n \"etag\": \"W/\\\"datetime'2015-10-23T04%3A58%3A47.9226934Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"norem\",\r\n \"DisplayName\": \"gasga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/5c7af1f8-bb71-4648-b7d9-910a6b9c9d74\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T19%3A03%3A42.498994Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"a\",\r\n \"DisplayName\": \"a\",\r\n \"Query\": \"Type=ADAssessmentRecommendation RecommendationPeriod=YYYY-MM IsRollup=false FocusArea=Prerequisites\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/60df279b-d288-4777-be03-b2ee65585488\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A46%3A14.747973Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert3\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/6d95bebd-f016-4a2a-8f8d-81c7c1c5a971\",\r\n \"etag\": \"W/\\\"datetime'2015-11-12T23%3A38%3A41.3404003Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"SS\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/7c474737-9279-433a-af17-a1c5ad7f339a\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A11.8794146Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert4\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/857fb644-5543-4b8c-9028-05b0980240f9\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T22%3A14%3A03.421978Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"aetaeta\",\r\n \"DisplayName\": \"atett\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/9fddfbb4-ce42-4c4c-bd84-2263b10dffa1\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A30.3141368Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert6\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/a0efeb96-79cf-474b-a98c-23a3a76ee332\",\r\n \"etag\": \"W/\\\"datetime'2015-11-23T20%3A47%3A22.4599753Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Alert\",\r\n \"DisplayName\": \"Alert5\",\r\n \"Query\": \"Type=Event EventLevelName=warning\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/all|all\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A03%3A03.9192424Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"All\",\r\n \"DisplayName\": \"All\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers\",\r\n \"etag\": \"W/\\\"datetime'2015-10-21T20%3A09%3A41.9906542Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"allcomputers\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/computergroups|allcomputers2\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T22%3A32%3A26.327691Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"ComputerGroups\",\r\n \"DisplayName\": \"AllComputers2\",\r\n \"Query\": \"* | measure count() by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/dd35eca5-3dc7-4e30-bf26-83e0cb5f0a2a\",\r\n \"etag\": \"W/\\\"datetime'2015-10-22T20%3A03%3A07.6701721Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"agasg\",\r\n \"DisplayName\": \"agsga\",\r\n \"Query\": \"* Type=Alert (AlertSeverity=error) SourceDisplayName=\\\"Microsoft.Windows.Computer:NEB-OM-724193.smx.net\\\"\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/intervals|count of all interval 1hour\",\r\n \"etag\": \"W/\\\"datetime'2015-11-07T00%3A16%3A14.7972332Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Intervals\",\r\n \"DisplayName\": \"Count of all interval 1hour\",\r\n \"Query\": \"* | measure count() by TimeGenerated interval 1HOUR\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/perf|avg disk writes by computer\",\r\n \"etag\": \"W/\\\"datetime'2015-11-05T19%3A48%3A24.8353096Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Perf\",\r\n \"DisplayName\": \"Avg Disk Writes by Computer\",\r\n \"Query\": \"* Type=Perf CounterName=\\\"Disk Write Bytes/sec\\\" | measure avg(CounterValue) by Computer\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|all events\",\r\n \"etag\": \"W/\\\"datetime'2015-04-09T17%3A02%3A49.4024833Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"All Events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/qwerty|events\",\r\n \"etag\": \"W/\\\"datetime'2014-10-17T16%3A15%3A27.8903997Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"qwerty\",\r\n \"DisplayName\": \"events\",\r\n \"Query\": \"Type=Event\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/sql assessment|sql assmt by focus area\",\r\n \"etag\": \"W/\\\"datetime'2015-07-15T21%3A38%3A00.898438Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"SQL Assessment\",\r\n \"DisplayName\": \"SQL Assmt by Focus Area\",\r\n \"Query\": \"Type=SQLAssessmentRecommendation AssessmentName=SQLV2 RecommendationPeriod=YYYY-MM IsRollup=true | measure count() by FocusArea\",\r\n \"Version\": 1\r\n }\r\n },\r\n {\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test|test\",\r\n \"etag\": \"W/\\\"datetime'2015-09-30T05%3A06%3A25.4487456Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"test\",\r\n \"DisplayName\": \"test\",\r\n \"Query\": \"Type=W3CIISLog\",\r\n \"Version\": 1\r\n }\r\n }\r\n ]\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "9664"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-reads": [
+ "14813"
+ ],
+ "x-ms-request-id": [
+ "828a0e36-7b3d-4c53-b336-4dadd4553cdd"
+ ],
+ "x-ms-correlation-request-id": [
+ "828a0e36-7b3d-4c53-b336-4dadd4553cdd"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231254Z:828a0e36-7b3d-4c53-b336-4dadd4553cdd"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:54 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzL3Rlc3QtbmV3LXNhdmVkLXNlYXJjaC1pZC0yMDE1P2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "PUT",
+ "RequestBody": "{\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"* | measure Count() by Type\",\r\n \"Version\": 1\r\n }\r\n}",
+ "RequestHeaders": {
+ "Content-Type": [
+ "application/json"
+ ],
+ "Content-Length": [
+ "180"
+ ],
+ "x-ms-client-request-id": [
+ "42280c0b-3ada-438d-982e-d82a7718e513"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015\",\r\n \"etag\": \"W/\\\"datetime'2016-01-15T23%3A12%3A52.463434Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"* | measure Count() by Type\",\r\n \"Version\": 1\r\n }\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "421"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-writes": [
+ "1192"
+ ],
+ "x-ms-request-id": [
+ "c3f9c86d-d9a7-45e3-ac32-8362842236c9"
+ ],
+ "x-ms-correlation-request-id": [
+ "c3f9c86d-d9a7-45e3-ac32-8362842236c9"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231252Z:c3f9c86d-d9a7-45e3-ac32-8362842236c9"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:52 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzL3Rlc3QtbmV3LXNhdmVkLXNlYXJjaC1pZC0yMDE1P2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "PUT",
+ "RequestBody": "{\r\n \"etag\": \"W/\\\"datetime'2016-01-15T23%3A12%3A52.463434Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n}",
+ "RequestHeaders": {
+ "Content-Type": [
+ "application/json"
+ ],
+ "Content-Length": [
+ "216"
+ ],
+ "x-ms-client-request-id": [
+ "dd72fa0e-44e2-41ce-b7e3-74ca80126aad"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "{\r\n \"id\": \"subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourceGroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015\",\r\n \"etag\": \"W/\\\"datetime'2016-01-15T23%3A12%3A53.6161946Z'\\\"\",\r\n \"properties\": {\r\n \"Category\": \"Saved Search Test Category\",\r\n \"DisplayName\": \"TestingSavedSearch\",\r\n \"Query\": \"*\",\r\n \"Version\": 1\r\n }\r\n}",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "396"
+ ],
+ "Content-Type": [
+ "application/json; charset=utf-8"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-writes": [
+ "1191"
+ ],
+ "x-ms-request-id": [
+ "562bbbd7-16ae-4a91-b570-bdf4f5840872"
+ ],
+ "x-ms-correlation-request-id": [
+ "562bbbd7-16ae-4a91-b570-bdf4f5840872"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231253Z:562bbbd7-16ae-4a91-b570-bdf4f5840872"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:53 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 200
+ },
+ {
+ "RequestUri": "/subscriptions/df1ec963-d784-4d11-a779-1b3eeb9ecb78/resourcegroups/mms-eus/providers/Microsoft.OperationalInsights/workspaces/workspace-861bd466-5400-44be-9552-5ba40823c3aa/savedSearches/test-new-saved-search-id-2015?api-version=2015-03-20",
+ "EncodedRequestUri": "L3N1YnNjcmlwdGlvbnMvZGYxZWM5NjMtZDc4NC00ZDExLWE3NzktMWIzZWViOWVjYjc4L3Jlc291cmNlZ3JvdXBzL21tcy1ldXMvcHJvdmlkZXJzL01pY3Jvc29mdC5PcGVyYXRpb25hbEluc2lnaHRzL3dvcmtzcGFjZXMvd29ya3NwYWNlLTg2MWJkNDY2LTU0MDAtNDRiZS05NTUyLTViYTQwODIzYzNhYS9zYXZlZFNlYXJjaGVzL3Rlc3QtbmV3LXNhdmVkLXNlYXJjaC1pZC0yMDE1P2FwaS12ZXJzaW9uPTIwMTUtMDMtMjA=",
+ "RequestMethod": "DELETE",
+ "RequestBody": "",
+ "RequestHeaders": {
+ "x-ms-client-request-id": [
+ "ca6f1c38-1b63-45cb-ad90-cf2f859c51d4"
+ ],
+ "User-Agent": [
+ "Microsoft.Azure.Management.OperationalInsights.OperationalInsightsManagementClient/0.9.0.0"
+ ]
+ },
+ "ResponseBody": "",
+ "ResponseHeaders": {
+ "Content-Length": [
+ "0"
+ ],
+ "Expires": [
+ "-1"
+ ],
+ "Pragma": [
+ "no-cache"
+ ],
+ "Strict-Transport-Security": [
+ "max-age=31536000; includeSubDomains"
+ ],
+ "X-Content-Type-Options": [
+ "nosniff"
+ ],
+ "x-ms-ratelimit-remaining-subscription-writes": [
+ "1190"
+ ],
+ "x-ms-request-id": [
+ "fb3b5e76-1ee1-4c33-82ac-70e9c94ffd1c"
+ ],
+ "x-ms-correlation-request-id": [
+ "fb3b5e76-1ee1-4c33-82ac-70e9c94ffd1c"
+ ],
+ "x-ms-routing-request-id": [
+ "CENTRALUS:20160115T231254Z:fb3b5e76-1ee1-4c33-82ac-70e9c94ffd1c"
+ ],
+ "Cache-Control": [
+ "no-cache"
+ ],
+ "Date": [
+ "Fri, 15 Jan 2016 23:12:53 GMT"
+ ],
+ "Server": [
+ "Microsoft-IIS/8.0"
+ ],
+ "X-Powered-By": [
+ "ASP.NET"
+ ]
+ },
+ "StatusCode": 202
+ }
+ ],
+ "Names": {},
+ "Variables": {
+ "SubscriptionId": "df1ec963-d784-4d11-a779-1b3eeb9ecb78"
+ }
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/packages.config b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/packages.config
index 981a57ff39ee..e98d874949c8 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/packages.config
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights.Test/packages.config
@@ -1,13 +1,13 @@
-
+
-
-
+
+
@@ -19,7 +19,7 @@
-
+
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Client/OperationalInsightsClient.Search.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Client/OperationalInsightsClient.Search.cs
new file mode 100644
index 000000000000..a0b92404a4b4
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Client/OperationalInsightsClient.Search.cs
@@ -0,0 +1,155 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections;
+using System.Linq;
+using System.Globalization;
+using System.Collections.Generic;
+using System.Net;
+using Hyak.Common;
+using Microsoft.Azure.Commands.OperationalInsights.Properties;
+using Microsoft.Azure.Commands.OperationalInsights.Models;
+using Microsoft.Azure.Management.OperationalInsights;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Client
+{
+ public partial class OperationalInsightsClient
+ {
+ public virtual HttpStatusCode DeleteSavedSearch(string resourceGroupName, string workspaceName, string savedSearchId)
+ {
+ AzureOperationResponse response = OperationalInsightsManagementClient.Search.DeleteSavedSearch(resourceGroupName, workspaceName, savedSearchId);
+ return response.StatusCode;
+ }
+
+ public virtual PSSearchGetSavedSearchResponse GetSavedSearch(string resourceGroupName, string workspaceName, string savedSearchId)
+ {
+ SearchGetSavedSearchResponse response = OperationalInsightsManagementClient.Search.GetSavedSearch(resourceGroupName, workspaceName, savedSearchId);
+ PSSearchGetSavedSearchResponse searchResponse = new PSSearchGetSavedSearchResponse(response);
+ return searchResponse;
+ }
+
+ public virtual PSSearchListSavedSearchResponse GetSavedSearches(string resourceGroupName, string workspaceName)
+ {
+ SearchListSavedSearchResponse responses = OperationalInsightsManagementClient.Search.ListSavedSearches(resourceGroupName, workspaceName);
+ PSSearchListSavedSearchResponse searchResponses = new PSSearchListSavedSearchResponse(responses);
+ return searchResponses;
+ }
+
+ public virtual PSSearchGetSearchResultsResponse GetSavedSearchResults(string resourceGroupName, string workspaceName, string savedSearchId)
+ {
+ SearchGetSearchResultsResponse responses = OperationalInsightsManagementClient.Search.GetSavedSearchResults(resourceGroupName, workspaceName, savedSearchId);
+ PSSearchGetSearchResultsResponse searchResponses = new PSSearchGetSearchResultsResponse(responses);
+ return searchResponses;
+ }
+
+ public virtual PSSearchGetSchemaResponse GetSchema(string resourceGroupName, string workspaceName)
+ {
+ SearchGetSchemaResponse response = OperationalInsightsManagementClient.Search.GetSchema(resourceGroupName, workspaceName);
+ PSSearchGetSchemaResponse schemaResponse = new PSSearchGetSchemaResponse(response);
+ return schemaResponse;
+ }
+
+ public virtual PSSearchGetSearchResultsResponse GetSearchResults(string resourceGroupName, string workspaceName, PSSearchGetSearchResultsParameters psParameters)
+ {
+ SearchGetSearchResultsParameters parameters = new SearchGetSearchResultsParameters();
+ parameters.Top = psParameters.Top;
+ if (psParameters.Highlight != null)
+ {
+ parameters.Highlight = new Highlight();
+ parameters.Highlight.Pre = psParameters.Highlight.Pre;
+ parameters.Highlight.Post = psParameters.Highlight.Post;
+ }
+ parameters.Query = psParameters.Query;
+ parameters.Start = psParameters.Start;
+ parameters.End = psParameters.End;
+
+ SearchGetSearchResultsResponse response = OperationalInsightsManagementClient.Search.GetSearchResults(resourceGroupName, workspaceName, parameters);
+ PSSearchGetSearchResultsResponse searchResponse = new PSSearchGetSearchResultsResponse(response);
+ return searchResponse;
+ }
+
+ public virtual PSSearchGetSearchResultsResponse GetSearchResultsUpdate(string resourceGroupName, string workspaceName, string id)
+ {
+ SearchGetSearchResultsResponse response = OperationalInsightsManagementClient.Search.UpdateSearchResults(resourceGroupName, workspaceName, id);
+ PSSearchGetSearchResultsResponse searchResponse = new PSSearchGetSearchResultsResponse(response);
+ return searchResponse;
+ }
+
+ public virtual HttpStatusCode CreateOrUpdateSavedSearch(string resourceGroupName, string workspaceName, string savedSearchId, string displayName, string category, string query, int version, bool force, Action ConfirmAction, string ETag = null)
+ {
+ HttpStatusCode status = HttpStatusCode.Ambiguous;
+ Action createSavedSearch = () =>
+ {
+ SearchCreateOrUpdateSavedSearchParameters parameters = new SearchCreateOrUpdateSavedSearchParameters();
+ if (ETag != null && ETag != "")
+ {
+ parameters.ETag = ETag;
+ }
+ parameters.Properties = new SavedSearchProperties();
+ parameters.Properties.Category = category;
+ parameters.Properties.DisplayName = displayName;
+ parameters.Properties.Query = query;
+ parameters.Properties.Version = version;
+ AzureOperationResponse response = OperationalInsightsManagementClient.Search.CreateOrUpdateSavedSearch(resourceGroupName, workspaceName, savedSearchId, parameters);
+ status = response.StatusCode;
+ };
+ if (force)
+ {
+ createSavedSearch();
+ }
+ else
+ {
+ bool savedSearchExists = CheckSavedSearchExists(resourceGroupName, workspaceName, savedSearchId);
+
+ ConfirmAction(
+ !savedSearchExists, // prompt only if the saved search exists
+ string.Format(
+ CultureInfo.InvariantCulture,
+ Resources.SavedSearchExists,
+ savedSearchId,
+ workspaceName),
+ string.Format(
+ CultureInfo.InvariantCulture,
+ Resources.SavedSearchCreating,
+ savedSearchId,
+ workspaceName),
+ savedSearchId,
+ createSavedSearch);
+ }
+ return status;
+ }
+
+ private bool CheckSavedSearchExists(string resourceGroupName, string workspaceName, string savedSearchId)
+ {
+ try
+ {
+ PSSearchGetSavedSearchResponse savedSearch = GetSavedSearch(resourceGroupName, workspaceName, savedSearchId);
+ return true;
+ }
+ catch (CloudException e)
+ {
+ // Get throws NotFound exception if the saved search does not exist
+ if (e.Response.StatusCode == HttpStatusCode.NotFound)
+ {
+ return false;
+ }
+
+ throw;
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Commands.OperationalInsights.csproj b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Commands.OperationalInsights.csproj
index 1337ac690e0d..c217d9d9bbb9 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Commands.OperationalInsights.csproj
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Commands.OperationalInsights.csproj
@@ -49,7 +49,7 @@
- ..\..\..\packages\Hyak.Common.1.0.2\lib\portable-net403+win+wpa81\Hyak.Common.dll
+ ..\..\..\packages\Hyak.Common.1.0.3\lib\portable-net403+win+wpa81\Hyak.Common.dll
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.dll
@@ -61,12 +61,13 @@
..\..\..\packages\Microsoft.Azure.Common.2.1.0\lib\net45\Microsoft.Azure.Common.NetFramework.dll
-
- ..\..\..\packages\Microsoft.Azure.Management.OperationalInsights.0.10.0-preview\lib\net40\Microsoft.Azure.Management.OperationalInsights.dll
+
+ False
+ ..\..\..\packages\Microsoft.Azure.Management.OperationalInsights.0.11.0-preview\lib\net40\Microsoft.Azure.Management.OperationalInsights.dll
False
- ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.7-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
+ ..\..\..\packages\Microsoft.Azure.Management.Resources.2.18.11-preview\lib\net40\Microsoft.Azure.ResourceManager.dll
..\..\..\packages\Microsoft.IdentityModel.Clients.ActiveDirectory.2.18.206251556\lib\net45\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
@@ -108,7 +109,7 @@
False
- ..\..\..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll
+ ..\..\..\packages\Newtonsoft.Json.6.0.8\lib\net45\Newtonsoft.Json.dll
False
@@ -124,12 +125,27 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -149,6 +165,13 @@
+
+
+
+
+
+
+
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Constants.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Constants.cs
index 9bceb652e0d3..704877455792 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Constants.cs
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Constants.cs
@@ -31,5 +31,13 @@ internal static class Constants
public const string IntelligencePack = "AzureRmOperationalInsightsIntelligencePack";
public const string IntelligencePacks = "AzureRmOperationalInsightsIntelligencePacks";
+
+ public const string SavedSearch = "AzureRmOperationalInsightsSavedSearch";
+
+ public const string SavedSearchResults = "AzureRmOperationalInsightsSavedSearchResults";
+
+ public const string Schema = "AzureRmOperationalInsightsSchema";
+
+ public const string SearchResults = "AzureRmOperationalInsightsSearchResults";
}
}
\ No newline at end of file
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.dll-Help.xml b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.dll-Help.xml
index bcf13e900db9..2f0f8da77c8c 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.dll-Help.xml
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.dll-Help.xml
@@ -2673,3 +2673,4 @@ PS C:\>Set-AzureRmOperationalInsightsStorageInsight –Workspace $Workspace
+
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.format.ps1xml b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.format.ps1xml
index 72236e328f0d..e0b5ad4c69e6 100644
--- a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.format.ps1xml
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Microsoft.Azure.Commands.OperationalInsights.format.ps1xml
@@ -81,28 +81,6 @@
-
- Microsoft.Azure.Commands.OperationalInsights.Models.PSIntelligencePack
-
- Microsoft.Azure.Commands.OperationalInsights.Models.PSIntelligencePack
-
-
-
-
-
-
-
- Name
-
-
-
- Enabled
-
-
-
-
-
-
Microsoft.Azure.Commands.OperationalInsights.Models.PSManagementGroup
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSCoreSummary.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSCoreSummary.cs
new file mode 100644
index 000000000000..7da3ca33cabc
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSCoreSummary.cs
@@ -0,0 +1,38 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSCoreSummary
+ {
+ public PSCoreSummary()
+ {
+ }
+
+ public PSCoreSummary(CoreSummary coreSummary)
+ {
+ if (coreSummary != null)
+ {
+ this.Status = coreSummary.Status;
+ this.NumberOfDocuments = coreSummary.NumberOfDocuments;
+ }
+ }
+ public string Status { get; set; }
+ public int NumberOfDocuments { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSHighlight.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSHighlight.cs
new file mode 100644
index 000000000000..351f63626060
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSHighlight.cs
@@ -0,0 +1,36 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSHighlight
+ {
+ public PSHighlight()
+ {
+ }
+
+ public PSHighlight(string pre, string post)
+ {
+ this.Pre = pre;
+ this.Post = post;
+ }
+
+ public string Pre { get; set; }
+ public string Post { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSMetadataSchema.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSMetadataSchema.cs
new file mode 100644
index 000000000000..b4bbc7ec2e6d
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSMetadataSchema.cs
@@ -0,0 +1,39 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSMetadataSchema
+ {
+ public PSMetadataSchema()
+ {
+ }
+
+ public PSMetadataSchema(MetadataSchema schema)
+ {
+ if (schema != null)
+ {
+ this.Name = schema.Name;
+ this.Version = schema.Version;
+ }
+ }
+
+ public string Name { get; set; }
+ public int Version { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchProperties.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchProperties.cs
new file mode 100644
index 000000000000..2f95ac5529f5
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchProperties.cs
@@ -0,0 +1,42 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSavedSearchProperties
+ {
+ public PSSavedSearchProperties()
+ {
+ }
+
+ public PSSavedSearchProperties(SavedSearchProperties properties)
+ {
+ if (properties != null)
+ {
+ this.Category = properties.Category;
+ this.DisplayName = properties.DisplayName;
+ this.Query = properties.Query;
+ this.Version = properties.Version;
+ }
+ }
+ public string Category { get; set; }
+ public string DisplayName { get; set; }
+ public string Query { get; set; }
+ public int? Version { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchValue.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchValue.cs
new file mode 100644
index 000000000000..6c38f4140760
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSavedSearchValue.cs
@@ -0,0 +1,40 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSavedSearchValue
+ {
+ public PSSavedSearchValue()
+ {
+ }
+
+ public PSSavedSearchValue(SavedSearchValue v)
+ {
+ if (v != null)
+ {
+ this.Id = v.Id;
+ this.ETag = v.ETag;
+ this.Properties = new PSSavedSearchProperties(v.Properties);
+ }
+ }
+ public string Id { get; set; }
+ public string ETag { get; set; }
+ public PSSavedSearchProperties Properties { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSchemaValue.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSchemaValue.cs
new file mode 100644
index 000000000000..017f83ff2be7
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSchemaValue.cs
@@ -0,0 +1,48 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSchemaValue
+ {
+ public PSSchemaValue()
+ {
+ }
+
+ public PSSchemaValue(SchemaValue value)
+ {
+ if (value != null)
+ {
+ this.Name = value.Name;
+ this.DisplayName = value.DisplayName;
+ this.Type = value.Type;
+ this.Indexed = value.Indexed;
+ this.Stored = value.Stored;
+ this.Facet = value.Facet;
+ this.OwnerType = value.OwnerType;
+ }
+ }
+ public string Name { get; set; }
+ public string DisplayName { get; set; }
+ public string Type { get; set; }
+ public bool Indexed { get; set; }
+ public bool Stored { get; set; }
+ public bool Facet { get; set; }
+ public IEnumerable OwnerType { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchError.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchError.cs
new file mode 100644
index 000000000000..b5f6c60dd0fd
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchError.cs
@@ -0,0 +1,38 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSearchError
+ {
+ public PSSearchError()
+ {
+ }
+
+ public PSSearchError(SearchError error)
+ {
+ if (error != null)
+ {
+ this.Type = error.Type;
+ this.Message = error.Message;
+ }
+ }
+ public string Type { get; set; }
+ public string Message { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSavedSearchResponse.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSavedSearchResponse.cs
new file mode 100644
index 000000000000..822aa703e478
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSavedSearchResponse.cs
@@ -0,0 +1,40 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSearchGetSavedSearchResponse
+ {
+ public PSSearchGetSavedSearchResponse()
+ {
+ }
+
+ public PSSearchGetSavedSearchResponse(SearchGetSavedSearchResponse response)
+ {
+ if (response != null)
+ {
+ this.Id = response.Id;
+ this.ETag = response.ETag;
+ this.Properties = new PSSavedSearchProperties(response.Properties);
+ }
+ }
+ public string Id { get; set; }
+ public string ETag { get; set; }
+ public PSSavedSearchProperties Properties { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSchemaResponse.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSchemaResponse.cs
new file mode 100644
index 000000000000..99b43be648f3
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSchemaResponse.cs
@@ -0,0 +1,42 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSearchGetSchemaResponse
+ {
+ public PSSearchGetSchemaResponse()
+ {
+ }
+
+ public PSSearchGetSchemaResponse(SearchGetSchemaResponse response)
+ {
+ if (response != null)
+ {
+ this.Metadata = new PSSearchMetadata(response.Metadata);
+ this.Value = new List();
+ foreach (SchemaValue v in response.Value)
+ {
+ this.Value.Add(new PSSchemaValue(v));
+ }
+ }
+ }
+ public PSSearchMetadata Metadata { get; set; }
+ public List Value { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsParameters.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsParameters.cs
new file mode 100644
index 000000000000..874784898385
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsParameters.cs
@@ -0,0 +1,31 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSearchGetSearchResultsParameters : OperationalInsightsParametersBase
+ {
+ public int Top { get; set; }
+ public int Skip { get; set; }
+ public PSHighlight Highlight { get; set; }
+ public bool IncludeArchive { get; set; }
+ public string Query { get; set; }
+ public DateTime? Start { get; set; }
+ public DateTime? End { get; set; }
+ }
+}
diff --git a/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsResponse.cs b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsResponse.cs
new file mode 100644
index 000000000000..7a571926078c
--- /dev/null
+++ b/src/ResourceManager/OperationalInsights/Commands.OperationalInsights/Models/PSSearchGetSearchResultsResponse.cs
@@ -0,0 +1,42 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Azure.Management.OperationalInsights.Models;
+
+namespace Microsoft.Azure.Commands.OperationalInsights.Models
+{
+ public class PSSearchGetSearchResultsResponse
+ {
+ public PSSearchGetSearchResultsResponse()
+ {
+ }
+
+ public PSSearchGetSearchResultsResponse(SearchGetSearchResultsResponse response)
+ {
+ if (response != null)
+ {
+ this.Id = response.Id;
+ this.Metadata = new PSSearchMetadata(response.Metadata);
+ this.Value = response.Value;
+ this.Error = new PSSearchError(response.Error);
+ }
+ }
+ public string Id { get; set; }
+ public PSSearchMetadata Metadata { get; set; }
+ public IEnumerable