Azure/Azure-Network-Security

"FakeData" term used

hctrr opened this issue · 3 comments

hctrr commented

Is your feature request related to a problem? Please describe.
The queries use the term "FakeData"

image

chboeh commented

Ah, Great question.
The FakeData table is to allow cross-table correlation even if it doesn't exist. These queries are dependent on 3 different work streams. Meaning if you've only enabled 1 out of the 3, you'll be missing the references when running the query. As a result, 'FakeData' was added to make it look like the tables do exist even if they don't currently in your Log Analytics workspace.

chboeh commented

@hctrr , please let me know if this answered your question.

hctrr commented

thank you @chboeh for the explanation.
Would you consider changing the term away from the prefix of "fake"? The current term has a bad connotation that doesn't/wouldn't sit well for people that see these queries.

common statement when showing these queries is - "why does it say fakedata?"
at that point people start questioning the results and content being displayed.