fix: change references to deviceid to rawId

Author: jame2O

plugins/MicrosoftDefender/v1/dataStreams/Vulnerabilities.json

@@ -13,7 +13,7 @@
         "expandInnerObjects": true,
         "endpointPath": "runHuntingQuery",
         "postBody": {
-            "Query": "DeviceTvmSoftwareVulnerabilities | where DeviceId in ({{objects.map(o => {return `\"${o.deviceid}\"`}).join(\",\")}})",
+            "Query": "DeviceTvmSoftwareVulnerabilities | where DeviceId in ({{objects.map(o => {return `\"${o.rawId}\"`}).join(\",\")}})",
             "Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
         },
         "pathToData": "results",

plugins/MicrosoftDefender/v1/dataStreams/devices.json

@@ -13,7 +13,7 @@
         "expandInnerObjects": true,
         "endpointPath": "runHuntingQuery",
         "postBody": {
-            "Query": "DeviceInfo | where DeviceId in ({{objects.map(o => {return `\"${o.deviceid}\"`}).join(\",\")}}) | summarize arg_max(Timestamp, *) by DeviceId"
+            "Query": "DeviceInfo | where DeviceId in ({{objects.map(o => {return `\"${o.rawId}\"`}).join(\",\")}}) | summarize arg_max(Timestamp, *) by DeviceId"
         },
         "pathToData": "results",
         "getArgs": [],

plugins/MicrosoftDefender/v1/dataStreams/recommendations.json

@@ -13,7 +13,7 @@
         "expandInnerObjects": true,
         "endpointPath": "runHuntingQuery",
         "postBody": {
-            "Query": "DeviceTvmSecureConfigurationAssessment | where DeviceId in ({{objects.map(o => {return `\"${o.deviceid}\"`}).join(\",\")}}) | join kind=leftouter (DeviceTvmSecureConfigurationAssessmentKB) on ConfigurationId | project DeviceId, DeviceName, Timestamp, ConfigurationId, ConfigurationName, ConfigurationCategory, ConfigurationSubcategory, ConfigurationImpact, RiskDescription, RemediationOptions, IsApplicable, IsCompliant, Tags",
+            "Query": "DeviceTvmSecureConfigurationAssessment | where DeviceId in ({{objects.map(o => {return `\"${o.rawId}\"`}).join(\",\")}}) | join kind=leftouter (DeviceTvmSecureConfigurationAssessmentKB) on ConfigurationId | project DeviceId, DeviceName, Timestamp, ConfigurationId, ConfigurationName, ConfigurationCategory, ConfigurationSubcategory, ConfigurationImpact, RiskDescription, RemediationOptions, IsApplicable, IsCompliant, Tags",
             "Timespan": "{{timeframe.enum != \"none\" ? `${timeframe.start}/${timeframe.end}` : \"\" }}"
         },
         "pathToData": "results",

plugins/MicrosoftDefender/v1/indexDefinitions/default.json

@@ -18,10 +18,7 @@
                     "OSVersion",
                     "PublicIP",
                     "OSBuild",
-                    "OSArchitecture",
-                    {
-                        "deviceid": "DeviceId"
-                    }
+                    "OSArchitecture"
                 ]
             }
         }