[adbhogeGit]

Required items, please complete

Change(s):

• Preserve the source-defined id column through ASIM ingestion-time fixture schema resolution and optional raw-table replay.
• Keep existing reserved-column protections unchanged, including _ItemId, _ResourceId, _SubscriptionId, TenantId, and Type.
• Add regression coverage for inferred, explicit, discovered, and repository schemas and for the real Proofpoint POD MailLog fixture.
• Extend mocked replay tests to verify id:string and its value across the snapshot, table/DCR schemas, and uploads; document the behavior.

Reason for Change(s):

• In [ASIM] Add Proofpoint POD MailLog ingestion-time parser #15463, CI run 41142174672 attempt 1 failed QTP execution because the source raw table schema lacked id, even though the fixture and source schema define it as a string.
• Preserve the legitimate source identifier through schema preparation without changing parser content or adding column_ifexists fallbacks.
• This is a separate toolkit maintainer fix, based on master; it is not stacked on [ASIM] Add Proofpoint POD MailLog ingestion-time parser #15463 or Fix Proofpoint POD MailLog ingestion-time relay-host normalization parity #15512.

Version Updated:

• N/A. No detection, analytic-rule template, parser content, or solution content changes.

Testing Completed:

• Offline only; no Azure operations or live ingestion. The harness regression uses a fake HTTP session.
• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s '.script\tests\asimParsersTest\ingestTimeParser\tests' -p 'test_asim_fixture_preparation.py' — passed, 30 tests.
• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s '.script\tests\asimParsersTest\ingestTimeParser\tests' -p 'test_asim_ingestion_harness.py' — passed, 28 tests.
• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s '.script\tests\asimParsersTest\ingestTimeParser\tests' -p 'test_asim_*.py' — passed, 168 tests.
• git --no-pager diff --check — passed.
• The ::error::Output path must not replace the source fixture. line is expected output from a passing negative CLI test.

Checked that the validations are passing and have addressed any issues that are present:

• Yes for the documented offline regression suite and diff check. Live Sentinel validation and GitHub CI have not been run locally.