Obs/bin/GMA/Monitoring/Agent/initconfig/2.0/Standard/ServiceDependencyImportOffline2.xml

<?xml version="1.0" encoding="utf-8"?>
<MonitoringManagement version="1.0" namespace="GenevaMdm" timestamp="2018-03-06T02:25:38.0823856Z" eventVersion="1">
  <Events>
    <TextLogSubscriptions>
         
      <Subscription format="W3c"
                    eventName="MdaSvcDepRaw"
                    storeType="Local"
                    path="%ProgramFiles%\Microsoft Dependency Agent\storage"
                    nameFilter=".*\.csv"
                    directoryQuotaInMB="50" >
        <Delimiters>
          <Delimiter>,</Delimiter>
        </Delimiters>
        <Schema textQualifier="&quot;" />
      </Subscription>
     
    </TextLogSubscriptions>
 
    <DerivedEvents>
 
      <DerivedEvent eventName="MdaSvcDepIdentity"
                    storeType="CentralBond"
                    duration="PT5M">
        <Query>
          <![CDATA[
            let ConfigNamespace = GetEnvironmentVariable("MA_CONFIG_NAMESPACE")
             
            let Tenant = GetEnvironmentVariable("MA_TENANT_IDENTITY")
            let Role = GetEnvironmentVariable("MA_ROLE_IDENTITY")
            let RoleInstance = GetEnvironmentVariable("MA_ROLEINSTANCE_IDENTITY")
             
            let AzureVmIdentity = GetEnvironmentVariable("MA_AZURE_VM_NAME")
            let AzureVmIdentity = AzureVmIdentity ?? "_n/a"
            let AzureNodeIdentity = GetEnvironmentVariable("MA_AZURE_NODE_IDENTITY")
            let AzureNodeIdentity = AzureNodeIdentity ?? "_n/a"
            let AzureIdentity = GetEnvironmentVariable("MA_AZURE_IDENTITY")
            let AzureIdentity = AzureIdentity ?? "_n/a"
             
            let MonitoringAccount = GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT")
            let MAHeartbeatIdentity = GetEnvironmentVariable("MA_HEARTBEAT_IDENTITY")
             
            let IdentityMetric = SetMdmMeasureMetric(
                GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                "ServiceDependency2",
                "SourceIdentity",
                1,
                "Tenant",
                Tenant,
                "Role",
                Role,
                "RoleInstance",
                RoleInstance,
                "ConfigNamespace",
                ConfigNamespace,
                "AzureVmIdentity",
                AzureVmIdentity,
                "AzureNodeIdentity",
                AzureNodeIdentity,
                "AzureIdentity",
                AzureIdentity
                )
            ]]>
        </Query>
      </DerivedEvent>
       
      <DerivedEvent source="MdaSvcDepRaw"
                    eventName="MdaSvcDepAgentHeartbeat"
                    storeType="CentralBond"
                    duration="PT1M">
        <Query>
          <![CDATA[
            let AgentVersion = AgentVersion ?? "_n/a_"
            where (AgentVersion != "_n/a_")
             
            groupby AgentVersion, InboundConnectionsTruncated, OutboundConnectionsTruncated, BoundPortsTruncated, DnsErrorsTruncated, DnsPerformanceTruncated, HttpTruncated
             
            let Tenant = GetEnvironmentVariable("MA_TENANT_IDENTITY")
            let Role = GetEnvironmentVariable("MA_ROLE_IDENTITY")
            let RoleInstance = GetEnvironmentVariable("MA_ROLEINSTANCE_IDENTITY")
 
            let HearbeatMetric = SetMdmMeasureMetric(
                GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                "ServiceDependency2",
                "AgentHeartbeat",
                1,
                "Tenant",
                Tenant,
                "Role",
                Role,
                "RoleInstance",
                RoleInstance,
                "AgentVersion",
                AgentVersion
                )
          ]]>
        </Query>
      </DerivedEvent>
 
      <DerivedEvent source="MdaSvcDepRaw"
                    eventName="MdaSvcDepHttp"
                    storeType="CentralBond"
                    duration="PT1M">
        <Query>
          <![CDATA[
          var HttpTableQuery =
            let FileVersion = ToString(FileVersion ?? "_n/a_")
            let DestinationPort = ToString(DestinationPort ?? "_n/a_")
            let HttpMethod = ToString(HttpMethod ?? "_n/a_")
 
            where (HttpMethod != "_n/a_") && (DestinationPort != "_n/a_") && (!Contains(DestinationPort, ".")) && (DestinationPort != "TCP") && (DestinationPort != "UDP")
 
            let HostIsLocal = HostIsLocal ?? "0"
                         
            groupby Host, HostIsLocal, DestinationPort, HttpMethod, HttpStatus, Path, RejectReason, Process
 
                        let CountRequest = Sum(ToInt32(_CountRequest != null && _CountRequest != "_n/a_" ? _CountRequest : "0"))
                        let MaxLatencyMs = Sum(ToInt32(_MaxLatencyMs != null && _MaxLatencyMs != "_n/a_" ? _MaxLatencyMs : "0"))
                        let MinLatencyMs = Sum(ToInt32(_MinLatencyMs != null && _MinLatencyMs != "_n/a_" ? _MinLatencyMs : "0"))
                        let SumLatencyMs = Sum(ToInt64(_SumLatencyMs != null && _SumLatencyMs != "_n/a_" ? _SumLatencyMs : "0"))
 
            let Tenant = GetEnvironmentVariable("MA_TENANT_IDENTITY")
            let Role = GetEnvironmentVariable("MA_ROLE_IDENTITY")
            let RoleInstance = GetEnvironmentVariable("MA_ROLEINSTANCE_IDENTITY")
 
            let IsOutbound = "0";
             
          from HttpTableQuery
           
          let HttpReqCount = False
          let HttpReqMaxLatencyMs = False
          let HttpReqMinLatencyMs = False
          let HttpReqSumLatencyMs = False
           
          if (HostIsLocal == "0")
          {
            HttpReqCount = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Http/RequestCount",
              CountRequest,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Host",
              Host,
              "HttpVerb",
              HttpMethod,
              "HttpStatus",
              HttpStatus,
              "Path",
              Path,
              "RejectReason",
              RejectReason,
              "Port",
              DestinationPort,
              "ProcessName",
              Process,
              "IsOutbound",
              IsOutbound
              );
 
            HttpReqMaxLatencyMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Http/MaxLatencyMs",
              MaxLatencyMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Host",
              Host,
              "HttpVerb",
              HttpMethod,
              "HttpStatus",
              HttpStatus,
              "Path",
              Path,
              "RejectReason",
              RejectReason,
              "Port",
              DestinationPort,
              "ProcessName",
              Process,
              "IsOutbound",
              IsOutbound
              );
 
            HttpReqMinLatencyMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Http/MinLatencyMs",
              MinLatencyMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Host",
              Host,
              "HttpVerb",
              HttpMethod,
              "HttpStatus",
              HttpStatus,
              "Path",
              Path,
              "RejectReason",
              RejectReason,
              "Port",
              DestinationPort,
              "ProcessName",
              Process,
              "IsOutbound",
              IsOutbound
              );
 
            HttpReqSumLatencyMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Http/SumLatencyMs",
              SumLatencyMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Host",
              Host,
              "HttpVerb",
              HttpMethod,
              "HttpStatus",
              HttpStatus,
              "Path",
              Path,
              "RejectReason",
              RejectReason,
              "Port",
              DestinationPort,
              "ProcessName",
              Process,
              "IsOutbound",
              IsOutbound
              );
          }
        ]]>
        </Query>
      </DerivedEvent>
 
      <DerivedEvent source="MdaSvcDepRaw"
                    eventName="MdaSvcDepNet"
                    storeType="CentralBond"
                    duration="PT1M">
        <Query>
          <![CDATA[
          var NetConnectionTableQuery =
            let FileVersion = ToString(FileVersion ?? "_n/a_")
            let Protocol = Protocol ?? "_n/a_"
            let DestinationPort = ToString(DestinationPort ?? "_n/a_")
            let SourceIp = ToString(SourceIp ?? "_n/a_")
            let DestinationIp = ToString(DestinationIp ?? "_n/a_")
            let IsOutbound = ToString(IsOutbound ?? "_n/a_")
            let RemoteEndpointClassification = ToString(RemoteEndpointClassification ?? "_n/a_")
            let TlsCipherSuites = ToString(TlsCipherSuites ?? "_n/a_")
            let TlsVersions = ToString(TlsVersions ?? "_n/a_")
            let Process = Process ?? "_n/a_"
 
            where (FileVersion != "_n/a_") && (DestinationPort != "_n/a_") && (!Contains(DestinationPort, ".")) && (DestinationPort != "TCP") && (DestinationPort != "UDP") && (Protocol != "_n/a_") && (DestinationIp != "_n/a_") && (TransactionPattern == null)
 
            groupby SourceIp, DestinationIp, DestinationPort, RemoteEndpointClassification, Process, Protocol, IsOutbound, TlsCipherSuites, TlsVersions
 
            let ConnectionClosed = Sum(ToInt32(_SumConnectionsClose != null && _SumConnectionsClose != "_n/a_" ? _SumConnectionsClose : "0"))
            let ConnectionOpened = Sum(ToInt32(_SumConnectionsOpen != null && _SumConnectionsOpen != "_n/a_" ? _SumConnectionsOpen : "0"))
            let ConnectionFailed = Sum(ToInt32(_SumConnectionsFail != null && _SumConnectionsFail != "_n/a_" ? _SumConnectionsFail : "0"))
            let ActiveConnectionCount = Sum(ToInt32(_CountLiveConnections != null && _CountLiveConnections != "_n/a_" ? _CountLiveConnections : "0"))
            let BytesSent = Sum(ToInt32(_SumBytesSent != null && _SumBytesSent != "_n/a_" ? _SumBytesSent : "0"))
            let BytesReceived = Sum(ToInt32(_SumBytesReceived != null && _SumBytesReceived != "_n/a_" ? _SumBytesReceived : "0"))
            let ResponseCount = Sum(ToInt32(_CountResponses != null && _CountResponses != "_n/a_" ? _CountResponses : "0"))
            let SumResponseTimeMs = Sum(ToInt32(_SumResponseTimeMs != null && _SumResponseTimeMs != "_n/a_" ? _SumResponseTimeMs : "0"))
            let MinResponseTimeMs = Min(ToInt32(_MinResponseTimeMs != null && _MinResponseTimeMs != "_n/a_" ? _MinResponseTimeMs : "0"))
            let MaxResponseTimeMs = Max(ToInt32(_MaxResponseTimeMs != null && _MaxResponseTimeMs != "_n/a_" ? _MaxResponseTimeMs : "0"))
            let TlsHandshakesComplete = Sum(ToInt32(_SumTlsHandshakesComplete != null && _SumTlsHandshakesComplete != "_n/a_" ? _SumTlsHandshakesComplete : "0"))
            let TlsHandshakesFailed = Sum(ToInt32(_SumTlsHandshakesFailed != null && _SumTlsHandshakesFailed != "_n/a_" ? _SumTlsHandshakesFailed : "0"))
            let SumTlsHandshakeLatencyMs = Sum(ToInt32(_SumTlsHandshakeLatencyMs != null && _SumTlsHandshakeLatencyMs != "_n/a_" ? _SumTlsHandshakeLatencyMs : "0"))
 
            let Tenant = GetEnvironmentVariable("MA_TENANT_IDENTITY")
            let Role = GetEnvironmentVariable("MA_ROLE_IDENTITY")
            let RoleInstance = GetEnvironmentVariable("MA_ROLEINSTANCE_IDENTITY")
 
            let IsOutbound = IsOutbound == "_n/a_" ? "0" : IsOutbound
            let RemoteTag = RemoteEndpointClassification == "_n/a_" ? "_n/a_" : SplitAndIndex(";", 2, RemoteEndpointClassification)
            let IsBoundPortAggregateData = SourceIp == "_n/a_" ? "1" : "0"
             
            let HasTLS10 = Contains(TlsVersions, "TLS1.0") ? "1" : "0"
            let HasTLS11 = Contains(TlsVersions, "TLS1.1") ? "1" : "0"
            let HasTLS12 = Contains(TlsVersions, "TLS1.2") ? "1" : "0"
            let HasTLS13 = Contains(TlsVersions, "TLS1.3") ? "1" : "0";
           
          from NetConnectionTableQuery
           
          let NetConnectionsClosed = False
          let NetConnectionsOpened = False
          let NetConnectionsReset = False
          let NetBytesSent = False
          let NetBytesReceived = False
          let NetResponseCount = False
          let NetSumResponseTimeMs = False
          let NetMinResponseTimeMs = False
          let NetMaxResponseTimeMs = False
          let NetActiveConnectionCount = False
          let NetTlsHandshakesComplete = False
          let NetTlsHandshakesFailed = False
          let NetSumTlsHandshakeLatencyMs = False
           
          if (IsOutbound == "1" || SourceIp == "_n/a_")
          {
            NetConnectionsClosed = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ConnectionClosed",
              ConnectionClosed,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
 
            NetConnectionsOpened = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ConnectionOpened",
              ConnectionOpened,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
 
            NetConnectionsReset = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ConnectionFailed",
              ConnectionFailed,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
 
            NetBytesSent = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/SentBytes",
              BytesSent,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
 
            NetBytesReceived = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ReceivedBytes",
              BytesReceived,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
               
            NetActiveConnectionCount = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ActiveConnectionCount",
              ActiveConnectionCount,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
 
            NetResponseCount = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/ResponseCount",
              ResponseCount,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetSumResponseTimeMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/SumResponseTimeMs",
              SumResponseTimeMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetMinResponseTimeMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/MinResponseTimeMs",
              MinResponseTimeMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetMaxResponseTimeMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/MaxResponseTimeMs",
              MaxResponseTimeMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetTlsHandshakesComplete = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/TlsHandshakesComplete",
              TlsHandshakesComplete,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetTlsHandshakesFailed = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/TlsHandshakesFailed",
              TlsHandshakesFailed,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
             
            NetSumTlsHandshakeLatencyMs = SetMdmMeasureMetric(
              GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
              "ServiceDependency2",
              "Network/SumTlsHandshakeLatencyMs",
              SumTlsHandshakeLatencyMs,
              "Tenant",
              Tenant,
              "Role",
              Role,
              "RoleInstance",
              RoleInstance,
              "Vip",
              DestinationIp,
              "RemoteTag",
              RemoteTag,
              "ProcessName",
              Process,
              "Protocol",
              Protocol,
              "Port",
              DestinationPort,
              "IsOutbound",
              IsOutbound,
              "HasTLS1.0",
              HasTLS10,
              "HasTLS1.1",
              HasTLS11,
              "HasTLS1.2",
              HasTLS12,
              "HasTLS1.3",
              HasTLS13
              );
           }
        ]]>
        </Query>
      </DerivedEvent>
 
      <!--
        Upload DNS metrics. Break DnsQuestions to individual FQDNs if multi-valued.
        This is intended to pull from the NetworkConnections table, so ensure that we do not also include rows from the DNS table by excluding
        rows with a TransactionPattern set as this is only included in the DNS table. Combined with requiring the DnsQuestions column, this
        will give us the NetworkConnections table.
      -->
      <DerivedEvent source="MdaSvcDepRaw"
                    eventName="MdaSvcDepDns"
                    storeType="CentralBond"
                        duration="PT1M">
        <Query>
          <![CDATA[
          let DestinationIp = DestinationIp ?? "_n/a_"
          let DnsQuestions = DnsQuestions ?? "_n/a_"
          let DnsResponses = DnsResponses ?? "_n/a_"
          let Status = Status ?? "_n/a_"
          where DnsQuestions != "_Unknown_" && DnsQuestions != "_n/a_" && DestinationIp != "_Unknown_" && DestinationIp != "_n/a_" && TransactionPattern == null
 
          groupby DestinationIp, RemoteEndpointClassification, DnsQuestions, DnsResponses
 
          let fqdn1 = SplitAndIndex(";", 0, DnsQuestions)
          let fqdn2 = Contains(DnsQuestions, Concat(";", fqdn1, "")) ? SplitAndIndex(";", 1, DnsQuestions) : ""
          let fqdn3 = Contains(DnsQuestions, Concat(";", fqdn1, fqdn2, "")) ? SplitAndIndex(";", 2, DnsQuestions) : ""
          let fqdn4 = Contains(DnsQuestions, Concat(";", fqdn1, fqdn2, fqdn3, "")) ? SplitAndIndex(";", 3, DnsQuestions) : ""
          let fqdn5 = Contains(DnsQuestions, Concat(";", fqdn1, fqdn2, fqdn3, fqdn4, "")) ? SplitAndIndex(";", 4, DnsQuestions) : ""
 
          let RemoteTag = RemoteEndpointClassification == "_Unknown_" ? "_Unknown_" : SplitAndIndex(";", 2, RemoteEndpointClassification)
          let Tenant = GetEnvironmentVariable("MA_TENANT_IDENTITY")
          let Role = GetEnvironmentVariable("MA_ROLE_IDENTITY")
          let RoleInstance = GetEnvironmentVariable("MA_ROLEINSTANCE_IDENTITY")
          let ResolutionState = Status != "_n/a_" ? Status : "0"
 
          let dnsResolve1 = SetMdmMeasureMetric(
            GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
            "ServiceDependency2",
            "DNS/Resolution",
            1,
            "Tenant",
            Tenant,
            "Role",
            Role,
            "RoleInstance",
            RoleInstance,
            "DnsQuestion",
            fqdn1,
            "DnsResponse",
            DnsResponses,
            "ResolutionState",
            ResolutionState,
            "Vip",
            DestinationIp,
            "RemoteTag",
            RemoteTag
            )
 
          let dnsResolve2 = (fqdn2 == "" ? false :
                SetMdmMeasureMetric(
                    GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                    "ServiceDependency2",
                    "DNS/Resolution",
                    1,
                    "Tenant",
                    Tenant,
                    "Role",
                    Role,
                    "RoleInstance",
                    RoleInstance,
                    "DnsQuestion",
                    fqdn2,
                    "DnsResponse",
                    DnsResponses,
                    "ResolutionState",
                    ResolutionState,
                    "Vip",
                    DestinationIp,
                    "RemoteTag",
                    RemoteTag
                )
              )
 
          let dnsResolve3 = (fqdn3 == "" ? false :
                SetMdmMeasureMetric(
                    GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                    "ServiceDependency2",
                    "DNS/Resolution",
                    1,
                    "Tenant",
                    Tenant,
                    "Role",
                    Role,
                    "RoleInstance",
                    RoleInstance,
                    "DnsQuestion",
                    fqdn3,
                    "DnsResponse",
                    DnsResponses,
                    "ResolutionState",
                    ResolutionState,
                    "Vip",
                    DestinationIp,
                    "RemoteTag",
                    RemoteTag
                )
              )
 
          let dnsResolve4 = (fqdn4 == "" ? false :
                SetMdmMeasureMetric(
                    GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                    "ServiceDependency2",
                    "DNS/Resolution",
                    1,
                    "Tenant",
                    Tenant,
                    "Role",
                    Role,
                    "RoleInstance",
                    RoleInstance,
                    "DnsQuestion",
                    fqdn4,
                    "DnsResponse",
                    DnsResponses,
                    "ResolutionState",
                    ResolutionState,
                    "Vip",
                    DestinationIp,
                    "RemoteTag",
                    RemoteTag
                )
              )
 
          let dnsResolve5 = (fqdn5 == "" ? false :
                SetMdmMeasureMetric(
                    GetEnvironmentVariable("MA_AGENT_METRICS_ACCOUNT"),
                    "ServiceDependency2",
                    "DNS/Resolution",
                    1,
                    "Tenant",
                    Tenant,
                    "Role",
                    Role,
                    "RoleInstance",
                    RoleInstance,
                    "DnsQuestion",
                    fqdn5,
                    "DnsResponse",
                    DnsResponses,
                    "ResolutionState",
                    ResolutionState,
                    "Vip",
                    DestinationIp,
                    "RemoteTag",
                    RemoteTag
                )
              )
        ]]>
        </Query>
      </DerivedEvent>
 
    </DerivedEvents>
 
    <Extensions>
      <Extension extensionName="DependencyAgentExtension">
        <!--
            To enable the HTTP dataset, you can either set the MA_DA_AGENT_OPTIONS environment variable when starting MA
            as described here: https://genevamondocs.azurewebsites.net/alerts/AdvancedTopics/DependencyMonitoring/CustomizingDA.html#http-transactions-collection,
            or you can modify the command line of the extension to:
            <CommandLine><![CDATA[DAExtension.exe -http-transactions on ]]></CommandLine>
        -->
        <CommandLine><![CDATA[DAExtension.exe -http-transactions on ]]></CommandLine>
        <ResourceUsage cpuPercentUsage="2" cpuThrottling="true" memoryLimitInMB="100" memoryThrottling="true" recycleOnMemory="false" />
      </Extension>
    </Extensions>
  </Events>
</MonitoringManagement>