Remove deprecated CitrixAnalytics_CCC_Events_V1_CL table and add workbook preview images

- Delete CitrixAnalytics_tableCCCEvents.json (table removed)
- Remove CCC stream declaration and dataFlow from CitrixAnalytics_DCR.json
- Remove CCC count from workbook KQL query
- Add 6 workbook preview images (Black/White x3) to Workbooks/Images/Preview/
- Regenerate Package (mainTemplate.json, createUiDefinition.json, 3.0.0.zip) with CCC removed

Author: Charles Zhao （赵灿）

Solutions/Citrix Analytics CCF/Data Connectors/CitrixAnalytics_CCF/CitrixAnalytics_DCR.json

@@ -106,25 +106,6 @@
             { "name": "indicator_category_id", "type": "int" }
         ]
       },
-      "Custom-CitrixAnalytics_CCC_Events_V1": {
-        "columns": [
-            { "name": "account_id", "type": "string" },
-            { "name": "client_ip", "type": "string" },
-            { "name": "client_os", "type": "string" },
-            { "name": "entity_id", "type": "string" },
-            { "name": "entity_type", "type": "string" },
-            { "name": "event_id", "type": "string" },
-            { "name": "event_type", "type": "string" },
-            { "name": "event_user_id", "type": "string" },
-            { "name": "oauth_client_id", "type": "string" },
-            { "name": "occurrence_event_type", "type": "string" },
-            { "name": "operation_name", "type": "string" },
-            { "name": "product", "type": "string" },
-            { "name": "tenant_id", "type": "string" },
-            { "name": "timestamp", "type": "datetime" },
-            { "name": "version", "type": "int" }
-        ]
-      },
       "Custom-CitrixAnalytics_CVAD_Events_V1": {
         "columns": [
             { "name": "event_type", "type": "string" },
@@ -255,16 +236,6 @@
         "transformKql": "source | where event_type=='indicatorSummary' | extend TimeGenerated = todatetime(timestamp)",
         "outputStream": "Custom-CitrixAnalytics_indicatorSummary_V1_CL"
       },
-      {
-        "streams": [
-          "Custom-CitrixAnalytics_CCC_Events_V1"
-        ],
-        "destinations": [
-          "clv2ws1"
-        ],
-        "transformKql": "source | where event_type=='datasourceCCCEventDetails' | extend TimeGenerated = todatetime(timestamp)",
-        "outputStream": "Custom-CitrixAnalytics_CCC_Events_V1_CL"
-      },
       {
         "streams": [
           "Custom-CitrixAnalytics_CVAD_Events_V1"

Solutions/Citrix Analytics CCF/Data Connectors/CitrixAnalytics_CCF/CitrixAnalytics_tableCCCEvents.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/citrix-logo-circle-black.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Citrix%20Analytics%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Citrix Analytics](https://www.citrix.com/solutions/analytics/) Solution for Microsoft Sentinel helps you to export data analyzed for the events(SPA, Security) from Citrix Analytics into Microsoft Sentinel environment. You can create custom dashboards, analyze data from other sources along with that from Citrix Analytics and create custom workflows using Logic Apps to monitor and mitigate the events. \nFor more details about this solution refer to https://docs.citrix.com/en-us/security-analytics/siem-integration/azure-sentinel-integration.html \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n a.[Azure Monitor HTTP Logs Ingestion API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview)\n\n**Data Connectors:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/citrix_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Citrix%20Analytics%20CCF/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[Citrix Analytics](https://www.citrix.com/solutions/analytics/) Solution for Microsoft Sentinel helps you to export data analyzed for the events(SPA, Security) from Citrix Analytics into Microsoft Sentinel environment. You can create custom dashboards, analyze data from other sources along with that from Citrix Analytics and create custom workflows using Logic Apps to monitor and mitigate the events. \nFor more details about this solution refer to https://docs.citrix.com/en-us/security-analytics/siem-integration/azure-sentinel-integration.html \n\n**Underlying Microsoft Technologies used:**\n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n a.[Azure Monitor HTTP Logs Ingestion API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview)\n\n**Data Connectors:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",

Solutions/Citrix Analytics CCF/Package/3.0.0.zip

@@ -128,7 +128,7 @@
             "type": 3,
             "content": {
               "version": "KqlItem/1.0",
-              "query": "let spaCount = CitrixAnalytics_SPA_Events_V1_CL | count; \nlet userProfileCount = CitrixAnalytics_userProfile_V1_CL | count; \nlet indicatorEventDetailCount = CitrixAnalytics_indicatorEventDetails_V1_CL | count; \nlet indicatorSummaryCount = CitrixAnalytics_indicatorSummary_V1_CL | count ;\nlet riskScoreChangeCount = CitrixAnalytics_riskScoreChange_V1_CL | count ;\nlet cccCount = CitrixAnalytics_CCC_Events_V1_CL | count ;\nlet cvadCount = CitrixAnalytics_CVAD_Events_V1_CL | count ;\nprint toscalar(spaCount)\n       +toscalar(userProfileCount)\n       +toscalar(indicatorEventDetailCount)\n       +toscalar(indicatorSummaryCount)\n       +toscalar(riskScoreChangeCount)\n       +toscalar(cccCount)\n       +toscalar(cvadCount);",
+              "query": "let spaCount = CitrixAnalytics_SPA_Events_V1_CL | count; \nlet userProfileCount = CitrixAnalytics_userProfile_V1_CL | count; \nlet indicatorEventDetailCount = CitrixAnalytics_indicatorEventDetails_V1_CL | count; \nlet indicatorSummaryCount = CitrixAnalytics_indicatorSummary_V1_CL | count ;\nlet riskScoreChangeCount = CitrixAnalytics_riskScoreChange_V1_CL | count ;\nlet cvadCount = CitrixAnalytics_CVAD_Events_V1_CL | count ;\nprint toscalar(spaCount)\n       +toscalar(userProfileCount)\n       +toscalar(indicatorEventDetailCount)\n       +toscalar(indicatorSummaryCount)\n       +toscalar(riskScoreChangeCount)\n       +toscalar(cvadCount);",
               "size": 4,
               "title": "# Received Events",
               "timeContextFromParameter": "timeRange",