Merge pull request #14060 from DThreeDev/d3-smart-soar-v3.3.0

Add analytics rule for D3 Smart SOAR high/critical severity incidents

Author: v-atulyadav

.script/tests/KqlvalidationsTests/CustomTables/D3SOARIncidents_CL.json

@@ -0,0 +1,28 @@
+{
+  "Name": "D3SOARIncidents_CL",
+  "Properties": [
+    { "Name": "TimeGenerated", "Type": "datetime" },
+    { "Name": "DateCreated", "Type": "datetime" },
+    { "Name": "DateModified", "Type": "datetime" },
+    { "Name": "IncidentNumber", "Type": "string" },
+    { "Name": "IncidentType", "Type": "string" },
+    { "Name": "IncidentTitle", "Type": "string" },
+    { "Name": "IncidentStatus", "Type": "string" },
+    { "Name": "IncidentSeverity", "Type": "string" },
+    { "Name": "IncidentStage", "Type": "string" },
+    { "Name": "IncidentPriority", "Type": "string" },
+    { "Name": "IncidentDisposition", "Type": "string" },
+    { "Name": "IncidentTags", "Type": "string" },
+    { "Name": "IncidentOwner", "Type": "string" },
+    { "Name": "IncidentCreator", "Type": "string" },
+    { "Name": "IncidentTimezone", "Type": "string" },
+    { "Name": "IncidentPlaybook", "Type": "string" },
+    { "Name": "IncidentDescription", "Type": "string" },
+    { "Name": "IncidentConclusion", "Type": "string" },
+    { "Name": "InvestigationTeam", "Type": "string" },
+    { "Name": "LinkedIncidents", "Type": "dynamic" },
+    { "Name": "IncidentRawData", "Type": "dynamic" },
+    { "Name": "EventRawData", "Type": "dynamic" },
+    { "Name": "RawRecord", "Type": "dynamic" }
+  ]
+}