Fix GitHubAuditData dropping rows when source timestamp is missing

[d4rk pr10r (d4rk-pri0r)]

Summary

• Fixes Solutions/GitHub/Parsers/GitHubAuditData.yaml: all three views (GitHubAuditLogPolling_CL, GitHubAuditLogsV2_CL, GitHubAuditLogsV3_CL) used unguarded unixtime_milliseconds_todatetime(...). Missing source timestamp columns produced null TimeGenerated and those rows vanished from every query using the parser.
• Pattern from Replaced the direct unixtime_milliseconds_todatetime() calls with a safe fallback pattern #14842 (credit Bhagya Lakshmi Kukula (@Bhagya767)): coalesce(unixtime_milliseconds_todatetime(column_ifexists(...)), TimeGenerated).
• Parser version 1.1.0 → 1.1.1.
• V3 packaged GitHub solution 3.5.1 → 3.5.2 (Package/mainTemplate.json, Package/3.5.2.zip, data/Solution_GitHub.json, ReleaseNotes.md) so this does not bounce the way Replaced the direct unixtime_milliseconds_todatetime() calls with a safe fallback pattern #14842 did.

Closes #14659

Test Plan

• Confirm the three TimeGenerated= lines in the parser YAML use coalesce + column_ifexists
• Confirm Package/mainTemplate.json embeds coalesce(unixtime (not the old unguarded calls only)
• V3 package version is 3.5.2 throughout

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR prevents GitHub audit rows from disappearing when the source timestamp field is missing by falling back to ingestion TimeGenerated, and bumps the parser/solution versions accordingly.

Changes:

• Update GitHubAuditData parser to use coalesce(unixtime_milliseconds_todatetime(column_ifexists(...)), TimeGenerated) for TimeGenerated.
• Bump parser version 1.1.0 → 1.1.1 and solution/package version 3.5.1 → 3.5.2.
• Document the change in release notes.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 3 comments.

File	Description
Solutions/GitHub/data/Solution_GitHub.json	Bumps GitHub solution version to 3.5.2.
Solutions/GitHub/ReleaseNotes.md	Adds a 3.5.2 entry describing the parser fix.
Solutions/GitHub/Parsers/GitHubAuditData.yaml	Guards source timestamp conversion to preserve ingestion TimeGenerated.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-maheshbh (v-maheshbh)]

Hi d4rk pr10r (@d4rk-pri0r)

Kindly verify the Copilot comments, make the necessary changes, and mark the conversations as resolved.

Thanks!

[d4rk pr10r (d4rk-pri0r)]

Hi v-maheshbh (@v-maheshbh) — Copilot comments addressed.

All three column_ifexists(..., real(null)) defaults are now long(null) so unixtime_milliseconds_todatetime stays on integer milliseconds. Parser 1.1.2, V3 package 3.5.3. Conversations resolved.

[v-maheshbh (v-maheshbh)]

Hi d4rk pr10r (@d4rk-pri0r)

Kindly repackage the solution with 3.5.2, as the previous package version was 3.5.1. Please update the release notes accordingly.

Thanks!