fix: SFI issue fixes

[AjitPadhi-Microsoft]

Purpose

• This pull request updates the data collection rules and destination naming for Jumpbox security event logs. The main goals are to filter out certain event types from log collection and to standardize the naming of Log Analytics destinations. These changes are applied consistently across both Bicep (infra/main.bicep, infra/main_custom.bicep) and the generated ARM template (infra/main.json).

Event log filtering improvements:

• Updated the xPathQueries for security event log collection to exclude events with EventID 4624, reducing noise by ignoring successful logon events. [1] [2] [3]

Log Analytics destination standardization:

• Introduced a variable (dcrLogAnalyticsDestinationName) to generate a consistent and descriptive name for Log Analytics destinations, replacing the previous hardcoded 'laDestination' value. [1] [2] [3]
• Updated all references to the Log Analytics destination in both the data collection rule and its associations to use the new variable instead of the old hardcoded name. [1] [2] [3] [4] [5] [6]

Template consistency:

• Regenerated the ARM template (infra/main.json) to reflect the above changes, including the updated templateHash.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR updates the Jumpbox Windows Security Event Log Data Collection Rule (DCR) configuration to (1) reduce collected event noise and (2) standardize the Log Analytics destination naming across the Bicep sources and the generated ARM template.

Changes:

• Updated the Windows Event Log xPathQueries filter to exclude EventID 4624.
• Standardized the Log Analytics destination name via a single variable (dcrLogAnalyticsDestinationName) and updated all references to use it.
• Regenerated infra/main.json to reflect the Bicep changes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
infra/main.bicep	Adds a destination-name variable for the Jumpbox DCR and updates the event XPath filter to exclude 4624.
infra/main_custom.bicep	Mirrors the same Jumpbox DCR destination naming and XPath filter updates as main.bicep.
infra/main.json	Regenerated template reflecting the updated XPath filter and destination naming variable usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.