Sentinel Central Workbook in correctly counting incidents

[melatonein5]

Describe the bug
When viewing the "Sentinel Central" workbook, all queries returning incident counts are returning incorrect numbers.

To Reproduce
Steps to reproduce the behavior:

1. Open a saved "Sentinel Central" workbook.
2. Note down the number of incidents in a workspace and the timeframe of the workbooks
3. Navigate the the "Incidents" tab in the Sentinel of the workspace that was noted down
4. Open the "Security Efficiency Workbook" in the top navigation bar.
5. Change the timeframe parameter of the workbook to match the timeframe noted.
6. The number of incidents will be different to Sentinel Central if incidents in the workspace have been modified

Expected behavior
Both incident counts should match.

Additional context
Opening this bug to reference the issue in the changelog. Adding | summarise arg_max(TimeGenerated, *) by IncidentName to affected queries fixes the issue. This is because every time an incident is modified, it creates a new log entry, which is not being accounted for in these queries.

[v-rusraut]

Hi @melatonein5,
Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 17 May 2024. Thanks!

[v-rusraut]

Hi @melatonein5,
We need more time to check and investigate into this issue. Thanks!

[v-rusraut]

Hi @melatonein5,
As you already raised PR #10466 for this issue, our team is validating changes, our team will provide update on PR.
Thanks