Sync master with Azure/Azure-Sentinel - #5
Open
Edouard360 wants to merge 6298 commits into
Open
Conversation
Added new playbooks, workbook and migrated from function app based data connector to CCF Data connector
Align the downloader and runner module paths, conditionally use basic parsing only on Windows PowerShell, and clarify the pinned release comment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sanitize parser and botocore validation failures so configured filter values cannot appear in error output. Validate supported GetFindings filter shapes against the AWS service model and cover representative filter variants. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add _agg log coverage to the 9 conn/dns/http analytic rules and align their dataTypes with the v3 schema. - Union base parser with matching _agg parser (conn_agg, dns_agg, http_agg) so rules cover aggregated log streams. - Add isfuzzy=true to rule-level unions. - Drop the redundant _red union leg from the conn/dns rules: the base parsers already union Corelight_v3_*_red_CL internally, so the extra leg bypassed the parser's arg_max dedup and could double-count. - Replace v2 dataTypes with the v3 parser names actually consumed, keeping _red/_long/http2 so the content hub still reports them as required ingestion sources. - Bump rule versions to 2.2.0. Verified: all columns referenced by each rule exist in the matching _agg parser projection; YAML validated; CRLF endings preserved.
Repackage the Wiz solution with the V3 tool so mainTemplate.json and the version zip are generated, not hand-edited. This addresses the reviewer request to run the V3 packaging tool. Also apply the Copilot review suggestions in the source connector: - State that the command output is the service principal object ID. - Use a bracket-free placeholder (WIZ_APP_ID_HERE) to avoid HTML-tag rendering. - Add a note to rerun without 2>/dev/null to see the full error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…nfigs (Azure#14936) Co-authored-by: Srikar Shastry <Srikar.Sistla@microsoft.com>
…nts (Azure#14817) * Updated DCR and Polling Config * Reverting the changes * Cisco Meraki Events via REST API updates * Cisco Meraki Events via REST API v3.1.2 - Fix duplicate ingestion in Air Marshal polling (ICM 2606010050005678) - Changed queryTimeFormat from UnixTimestamp to yyyy-MM-ddTHH:mm:ssZ for Organizations API - Updated Air Marshal Events data type to use checkpointed t0 windowing instead of fixed 3600s timespan - This prevents duplicate event ingestion during polling cycles - Version bumped to 3.1.2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Added t0 and t1 Parameters to AirMarshal endpoint * Scope Cisco Meraki PR to Air Marshal only; restore Network Clients to 3.1.0 Reverted out-of-scope Network Clients changes (parent queryTimeFormat back to yyyy-MM-ddTHH:mm:ssZ and nested clients timespan back to 2592000). Only Air Marshal now switches to UnixTimestamp t0/t1 checkpointing. Repackaged 3.1.1. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Cisco Meraki: apply uniform t0/t1 UnixTimestamp checkpointing to Network Clients for consistency with ASIM/Air Marshal endpoints Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Cisco Meraki: standardize t0/t1 UnixTimestamp checkpointing across all CCP data types (Organizations, Organization Networks) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * updated release notes --------- Co-authored-by: Dhanunjaya Bedudooru <v-dhbedu@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Sign-in to a designated emergency access account (T1078.004) - Credential or MFA modification on a designated emergency access account (T1098, T1556.006) Both queries key off a BreakGlassAccounts watchlist (AccountUPN column) since break-glass accounts cannot be reliably inferred from log data alone.
This deploys a fresh Log Analytics workspace and onboards Microsoft Sentinel onto it, both grounded in the current MS Learn resource definitions.
…tcloudhubalerts.promotetoga.01.01 [Mulesoft Cloud Hub Alerts] - Promote connector to General Availability
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep ARM secret parameters as securestring and Logic App workflow secrets as SecureString, while correcting the adjacent workflow String type to match the workflow definition schema. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add Cybereinforce Threat Enforcement solution
Updates the Recorded Future solution package template to use a shared `SampleId` variable in alert entity mappings, avoiding hardcoded duplication across rules. Also refreshes the packaged artifacts and reformats `ReleaseNotes.md` table spacing without changing release content.
Removal of agent install/update scripts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ccff4d4a-3094-4de9-a5c0-d00c63d96a37
Test the actual VBR and VONE handlers, remove the static test factory, and regenerate the solution package as 3.1.2 on current master. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…e-secret Secure Recorded Future sandbox API key handling
They are anyway hardcoded within DCE/DCR, no need for params
…criptions Shorten hunting queries descriptions
…validation Skip additional ASIM union parsers during validation
…or when migrating from Azure Function to CCF connector" This reverts commit 5c828e8.
Normalize scope, principal, and role definition inputs before generating deterministic assignment names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5b420f3d-419a-4be9-b451-4a015cf6aba6
…-role-assignment-guids Fix Blob CCF role assignment GUID collisions
…reIntelToGraphSecurity
[Solution] StratoSecure Security Platform v1.0.0
Solution NISTSP50082: Fixed gov deploy to azure button and repackage
Add Uniqkey solution with CCF data connector, analytic rules and work…
…t-version fix: replace deprecated distutils.[version|util] for python 3
Update AzureBuiltInRole.csv with latest Azure built-in roles
Intel471 v3.0.1: community hunting queries and playbook Key Vault fixes
Add Datazag Threat Intelligence solution
SynqlyIntegrationConnector 3.0.1: add new ASIM tables and alert rule for converting ASIM Alert events
* fix * changelog * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: github-actions[bot] <>
…empty fields (Azure#14991) * Parser update * Implemented review comments --------- Co-authored-by: Bhagya lakshmi Kukula <v-bhk@microsoft.com>
Bring feedly/Azure-Sentinel master to the same tree as Azure/Azure-Sentinel master so the fork is no longer thousands of commits behind. The previous unique commit (N3) is preserved in history and on backup/n3-before-upstream-sync.
Edouard360
marked this pull request as draft
August 28, 2026 20:06
Collaborator
Author
|
Local This PR is that review path. I cancelled the Azure Sentinel validation workflows (they would scan thousands of upstream files). After one write-access approval, merge with a merge commit (fast-forward). To discard |
Edouard360
marked this pull request as ready for review
August 28, 2026 20:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
N3 (#4)) and ~6297 commits behindAzure/Azure-Sentinel.masterbecause the org default-branch ruleset blocks force-push.master(1d670fa) as a parent and sets the tree identical to Azure, so the fork is no longer behind.The old unique commit is kept on
backup/n3-before-upstream-sync.Test plan
Azure/Azure-SentinelmasterAzure:master...feedly:mastershould be 0 behind