[ASIM] Make changes to Authentication ASIM OktaSSO and OktaV2 parser

[yummyblabla]

Changes to Authentication OktaSSO parser:

• Addition: EventResultDetails, SrcDeviceType
• Remaps: EventSubType --> EventOriginalSubtype, TargetUserType
• Extensions: ActorUserId, ActorUsername, etc. are extended from its Target counterparts.

EventSubType --> EventOriginalSubtype Change Rationale:

• Subtype did not fit EventSubtype enumerations

TargetUserType mapping addition Rationale:

• UserType did not fix UserType enumerations.

[oshezaf]

The column_if_exists statements are very expensive as they imply calculated columns later on. There is a reason to why they are used (needed only for V1 tables. I can explain more). It certainly makes prefiltering ineffective. The way around it is to use a union and s datatable:

let empty = datatable (uni_s:string) [];
(Syslog | union empty)
| where uni_s == ""

[oshezaf]

Thanks! looks good. Two small comments.

[oshezaf]

Split between extend for calculated fields and project-rename for just mapping.

[yummyblabla]

Agreed. Updated in latest iteration

[oshezaf]

No need for coalesce I think, so can be project-renamed.

[yummyblabla]

By product of initial testing. Removed.