Abnormal Security CCF Connector: Schema Alignment Fixes Column Visibility Gaps

What Changed

Abnormal Security CCF connector updated to v3.0.1 with comprehensive table schema changes affecting all 9 event streams. Column naming conventions updated to match Microsoft Log Analytics auto-expansion behavior, and previously missing metadata columns added.

Security Impact (Visibility & Fidelity)

Column naming misalignment fix: All abx_body_* columns renamed to abx_body_abx_body_* across 9 event streams — queries referencing the original column names against CCF tables returned null for all rows. This was a data fidelity gap affecting any custom KQL queries built against the CCF connector.

Missing metadata columns restored: Added abx_body_abx_metadata_event_type_s, abx_body_abx_metadata_timestamp_s, and abx_body_abx_metadata_trace_id_g columns — these fields were available in the Microsoft Log Analytics connector but missing from CCF tables, creating detection coverage gaps for correlation and timeline analysis.

Data type correction: Changed abx_metadata_timestamp from datetime to string type to match MLA behavior — queries expecting string format previously failed.

This change ensures CCF and MLA connector deployments present identical table schemas, eliminating detection logic differences between ingestion methods.

Affected Files

Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_DCR.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbnormalSecurityLogs.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbuseMailbox.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AtoCase.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AuditLog.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Case.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_PostureChange.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Remediation.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_ThreatLog.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_VendorCase.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ABUSE_MAILBOX_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ATO_CASE_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_AUDIT_LOG_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_CASE_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_POSTURE_CHANGE_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_REMEDIATION_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_THREAT_LOG_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_VENDOR_CASE_CL.json
Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/AbnormalSecurityLogs_CL.json
(packaging artefacts: 3.0.1.zip, ReleaseNotes.md, Solution_AbnormalSecurity.json, mainTemplate.json)