Log Horizon 0.9.0

Remediation release from a full code and data review, verified against a live Microsoft Sentinel workspace at every step.

Install-Module LogHorizon -RequiredVersion 0.9.0
# or
Update-Module LogHorizon

Upgrading from 0.8.x

Az.Resources is no longer required; Az.Accounts and PwshSpectreConsole 2.6.3+ are the only dependencies. Microsoft.Graph.Authentication stays optional for -IncludeDefenderXDR as a signed-in user.
Data collection is cached by default under %LOCALAPPDATA%\LogHorizon\cache for 60 minutes. Use -NoCache to opt out, -RefreshCache to force a fresh collection, -CacheMaxAgeMinutes and -CachePath to tune it. The README describes what the cache holds.
-OutputPath without an extension is now a file name (the format extension is appended); an existing directory or a trailing separator still produces a timestamped file.
Licence is GPL-3.0.

Every table is priced by the plan observed in Usage.Plan (Analytics, Basic, Data Lake rates via -PricePerGB, -BasicPricePerGB, -LakePricePerGB), free status comes from Usage.IsBillable, volumes use billing GB (1000 MB).
Non-KQL rule kinds (Threat Intelligence matching, Fusion, UEBA, Microsoft incident creation) count as coverage for the tables they consume; platform tables Sentinel writes for itself get a Platform assessment and are never flagged as missing coverage.
New recommendations: PlanUsage, DeprecatedSource, RetentionInteractiveBelowBaseline. The DataLake recommendation only proposes the Auxiliary plan for tables that support it and falls back to a Basic plan suggestion otherwise. Savings are current cost minus the same volume at the target rate. One canonical sort order everywhere.

Auto-close attribution uses only enabled close-incident or playbook automation rules, matches on analytic rule id, title and severity conditions (ANDed like Sentinel), and buckets incidents by rule id so duplicate names score separately.
Scores need at least 3 rules with incidents; below that they show N/A with a stated reason.

DCR discovery runs at subscription scope filtered on the destination workspace, plus the workspace transformation DCR and workspace associations. Missing permissions produce a visible warning and a DiscoveryStatus block instead of silently reporting no transforms.
Workspace and multi-stage transforms are parsed, compound operations are labelled (Filter+Projection).
Split and tuning KQL is intersected with the live table schema; fields and predicates on joined tables or let variables are dropped and reported.

345 -> 481 tables: 80+ first-party tables (Sentinel, Entra, Defender XDR, Purview, Power Platform, Azure services, AWS, GCP, ASIM) and 35 successor tables for codeless connectors.
New optional keys: status (deprecated/legacy), replacedBy, xdrStreamable, platform. Connector label and isFree corrections.
basic-plan-tables.json regenerated and auxiliary-plan-tables.json added from the Azure Monitor table feature matrix.

ARM, Log Analytics and Graph endpoints follow the signed-in Azure environment (public, US Government, China).
SecurityInsights 2025-09-01, OperationalInsights 2025-07-01, recommendations 2025-10-01-preview.
REST retries on transport errors, Location-style async completion, workspace resolved over REST.

Dictionary menu with every term the tool uses, kept in step with the README by tests.
All Tables view with a per-table detail panel; Back is always the first choice; the Export menu asks for a path; rendering follows the current window size after a resize; lifecycle badges on deprecated and legacy tables.
Escaped TUI and Markdown output, CSP meta in the HTML report, exports return the written path.

No tokens, incident owners, rule authors or assigned-owner identities are stored in the cache or written to exports.

437 Pester tests (up from 203), PSScriptAnalyzer clean.
Live runs against a test workspace after every change, plus a manual test plan covering the CLI, cache, exports, every TUI menu, the retention command and the data files.