ASIM Schema Tester: Fixing Critical Validation Gap for Common Fields

What Changed

The ASimSchemaTester function was updated to include both selected schema fields and Common schema fields during validation, with prioritization logic to prefer selected schema definitions when both exist.

Validation Impact (Data Fidelity)

Prior to this fix, the schema tester had a critical blind spot: queries referencing Common schema fields (which are shared across all ASIM schemas) were not being validated against the tester. This meant parsers could pass validation while missing mandatory Common fields like EventType, EventResult, or EventSchema — causing downstream detection rules that rely on these standardized fields to fail silently.

The fix implements prioritization logic where selected schema fields take precedence over Common fields when both define the same column, ensuring accurate validation without conflicts. Parser authors now receive complete validation coverage across both schema-specific and Common fields, eliminating a major gap in ASIM compliance testing.

Affected Files

ASIM/dev/ASimTester/ASimSchemaTester.json
ASIM/dev/ASimTester/Testers/ASimSchemaTester.yaml