New Darktrace CCF integration

.script/tests/KqlvalidationsTests/CustomTables/DarktraceASM_CL.json

@@ -0,0 +1,89 @@
+{
+  "Name": "DarktraceASM_CL",
+  "Properties": [
+    {
+      "name": "action",
+      "type": "string"
+    },
+    {
+      "name": "alertTime",
+      "type": "datetime"
+    },
+    {
+      "name": "alertTimestamp",
+      "type": "int"
+    },
+    {
+      "name": "alertTitle",
+      "type": "string"
+    },
+    {
+      "name": "alertType",
+      "type": "string"
+    },
+    {
+      "name": "assetId",
+      "type": "int"
+    },
+    {
+      "name": "assetName",
+      "type": "string"
+    },
+    {
+      "name": "assetUri",
+      "type": "string"
+    },
+    {
+      "name": "customLabel",
+      "type": "string"
+    },
+    {
+      "name": "darktraceProduct",
+      "type": "string"
+    },
+    {
+      "name": "description",
+      "type": "string"
+    },
+    {
+      "name": "endTime",
+      "type": "string"
+    },
+    {
+      "name": "endTimestamp",
+      "type": "int"
+    },
+    {
+      "name": "previousRating",
+      "type": "string"
+    },
+    {
+      "name": "rating",
+      "type": "string"
+    },
+    {
+      "name": "riskId",
+      "type": "int"
+    },
+    {
+      "name": "riskUri",
+      "type": "string"
+    },
+    {
+      "name": "startTime",
+      "type": "datetime"
+    },
+    {
+      "name": "startTimestamp",
+      "type": "int"
+    },
+    {
+      "name": "state",
+      "type": "string"
+    },
+    {
+      "name": "workbenchUri",
+      "type": "string"
+    }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/DarktraceEMAIL_CL.json

@@ -0,0 +1,81 @@
+{
+  "Name": "DarktraceEMAIL_CL",
+  "properties": [
+    {
+      "name": "actions",
+      "type": "dynamic"
+    },
+    {
+      "name": "alertTime",
+      "type": "datetime"
+    },
+    {
+      "name": "anomalyScore",
+      "type": "int"
+    },
+    {
+      "name": "attachmentNames",
+      "type": "dynamic"
+    },
+    {
+      "name": "attachmentSha1s",
+      "type": "dynamic"
+    },
+    {
+      "name": "attachmentSha256s",
+      "type": "dynamic"
+    },
+    {
+      "name": "customLabel",
+      "type": "string"
+    },
+    {
+      "name": "darktraceProduct",
+      "type": "string"
+    },
+    {
+      "name": "direction",
+      "type": "string"
+    },
+    {
+      "name": "from",
+      "type": "string"
+    },
+    {
+      "name": "linkHosts",
+      "type": "dynamic"
+    },
+    {
+      "name": "messageId",
+      "type": "string"
+    },
+    {
+      "name": "recipientActions",
+      "type": "dynamic"
+    },
+    {
+      "name": "recipients",
+      "type": "dynamic"
+    },
+    {
+      "name": "subject",
+      "type": "string"
+    },
+    {
+      "name": "tags",
+      "type": "dynamic"
+    },
+    {
+      "name": "timestamp",
+      "type": "datetime"
+    },
+    {
+      "name": "url",
+      "type": "string"
+    },
+    {
+      "name": "uuid",
+      "type": "string"
+    }
+  ]
+}

.script/tests/KqlvalidationsTests/CustomTables/DarktraceIncidents_CL.json

@@ -0,0 +1,121 @@
+{
+  "Name": "DarktraceIncidents_CL",
+  "Properties": [
+    {
+      "name": "activityId",
+      "type": "string"
+    },
+    {
+      "name": "aiaScore",
+      "type": "int"
+    },
+    {
+      "name": "bestAssetName",
+      "type": "string"
+    },
+    {
+      "name": "currentGroup",
+      "type": "string"
+    },
+    {
+      "name": "customLabel",
+      "type": "string"
+    },
+    {
+      "name": "darktraceProduct",
+      "type": "string"
+    },
+    {
+      "name": "deviceHostname",
+      "type": "string"
+    },
+    {
+      "name": "deviceIp",
+      "type": "string"
+    },
+    {
+      "name": "deviceIdentifier",
+      "type": "string"
+    },
+    {
+      "name": "deviceMac",
+      "type": "string"
+    },
+    {
+      "name": "deviceSubnet",
+      "type": "string"
+    },
+    {
+      "name": "devices",
+      "type": "dynamic"
+    },
+    {
+      "name": "endTime",
+      "type": "string"
+    },
+    {
+      "name": "externalId",
+      "type": "string"
+    },
+    {
+      "name": "groupByActivity",
+      "type": "boolean"
+    },
+    {
+      "name": "groupCategory",
+      "type": "string"
+    },
+    {
+      "name": "groupPreviousGroups",
+      "type": "dynamic"
+    },
+    {
+      "name": "groupScore",
+      "type": "int"
+    },
+    {
+      "name": "groupingId",
+      "type": "string"
+    },
+    {
+      "name": "incidentEventTime",
+      "type": "datetime"
+    },
+    {
+      "name": "incidentEventTitle",
+      "type": "string"
+    },
+    {
+      "name": "latitude",
+      "type": "real"
+    },
+    {
+      "name": "longitude",
+      "type": "real"
+    },
+    {
+      "name": "newEvent",
+      "type": "boolean"
+    },
+    {
+      "name": "severity",
+      "type": "int"
+    },
+    {
+      "name": "startTime",
+      "type": "string"
+    },
+    {
+      "name": "summary",
+      "type": "string"
+    },
+    {
+      "name": "summaryFirstSentence",
+      "type": "string"
+    },
+    {
+      "name": "url",
+      "type": "string"
+    }
+  ]
+}