feat: split device import into 4 steps, using hash() to bucket device IDS

Author: jame2O

plugins/MicrosoftDefender/v1/dataStreams/listDevices.json

@@ -13,12 +13,15 @@
     "expandInnerObjects": true,
     "endpointPath": "runHuntingQuery",
     "postBody": {
-      "Query": "DeviceInfo | where isnotempty(DeviceName) | project Timestamp, DeviceId, DeviceName | summarize arg_max(Timestamp, *) by DeviceId"
+      "Query": "DeviceInfo | where isnotempty(DeviceName) and hash(DeviceId, 4) == {{shardIndex}} | project Timestamp, DeviceId, DeviceName | summarize arg_max(Timestamp, *) by DeviceId"
     },
     "pathToData": "results",
     "getArgs": [],
     "headers": []
   },
+  "ui": [
+    { "name": "shardIndex", "label": "Shard Index", "type": "text", "defaultValue": "0" }
+  ],
   "providesPluginDiagnostics": true,
   "manualConfigApply": true,
   "timeframes": false,

plugins/MicrosoftDefender/v1/indexDefinitions/default.json

@@ -1,9 +1,55 @@
 {
     "steps": [
         {
-            "name": "Import Devices",
+            "name": "Import Devices (1)",
             "dataStream": {
-                "name": "listDevices"
+                "name": "listDevices",
+                "config": { "shardIndex": "0" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (2)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "1" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (3)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "2" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (4)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "3" }
             },
             "timeframe": "none",
             "objectMapping": {