Merge Azure Sentinel Master into fork#26
Closed
Phrozyn wants to merge 10000 commits intoarmor:masterfrom
Closed
Conversation
…nto user/fuqingwang/OktaRenametoCCF
…ors/azure-core-1.38.0
…ta-Connectors/azure-core-1.38.0 Bump azure-core from 1.32.0 to 1.38.0 in /Solutions/XBOW/Data Connectors
Reorder and simplify the Threat Intelligence analytic query to deduplicate records earlier and apply active/expiration filters afterwards. Added summarize arg_max(TimeGenerated, *) by Id, Url and by Id, ObservableValue to get the latest record before filtering, moved IsActive/ValidUntil/ExpirationDateTime checks to follow deduplication, and removed redundant time-order checks and extra arg_max usages related to EmailUrlInfo. These changes ensure the latest valid indicators are retained and simplify the join logic. Bumped version 1.0.5 -> 1.0.6.
Introduce MicrosoftCopilotActivityMonitoring workbook and wire it into the Microsoft Copilot solution. Changes include: add workbook JSON under Workbooks/, reference it in Solution_MicrosoftCopilot.json, add Workbooks step to createUiDefinition, add workbook parameters/variables/resources/template-spec and metadata to mainTemplate.json, include the workbook in the content package manifest, add test parameter for workbook name, and fix KQL parameter quoting in the workbook queries. Updated packaged zip accordingly.
Reorder and clean up ThreatIntelIndicators handling for URL and domain matches. For URLs, summarize (arg_max) by Id/ObservableValue first, then filter for active/unexpired indicators, and normalize ObservableValue to lowercase before joining with EmailUrlInfo_. For domains, normalize DomainName to lowercase earlier and correct the projected active field name to IsActive. These changes ensure joins use the latest, active indicators and consistent casing for reliable matching.
Release update for Threat Intelligence (NEW): add packaged artifact 3.0.16.zip and bump solution/template versions to 3.0.16. Update analytic rule 6 version to 1.0.6 and refine its KQL query logic to use arg_max(TimeGenerated,*) and improved filtering for URL/domain indicators. Standardize/roll back several resource apiVersion values (various Microsoft.OperationalInsights and Microsoft.SecurityInsights providers) and update resource descriptions and field mappings formatting across templates.
…tructions Optimize TI analytic rule deduplication and filters
…etoCCF rename to VMware Carbon Black Cloud via AWS S3(via Codeless Connector Framework)
…oCCF Rename CCF to Sophos Endpoint Protection (via Codeless Connector Platform)
…nametoCCF Rename CCF solution to SentinelOne (via Codeless Connector Framework)
Rename CCF solution to Okta Single Sign-On (via Codeless Connector Framework)
rename Box Events(CCP) to Box Events (via Codeless Connector Framework)
…etoCCF rename Netskopev2(CCP) to Netskope(via Codeless Connector Framework)
…_changes Varonis purview schema changes
…csv date field (#13899) * Fixing null byte corruption in the azure state manager timestamp and date formatting filed for csv * updated the code and .zip to address comment of Guarding the none in format_date --------- Co-authored-by: Krishna Chilukamarri <v-krishna_microsoft.com@microsoft.com>
* Create parser and changelog * Update changelog * Update asimtester * Fix kql validation * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * FIx kql and update changelog * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Align schema ver * Remove Proxy from file names and keep as CiscoUmbrella * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
[ASIM Parser] Add Polo Alto Pan-OS Authentication log ASIM Parser
* Create parser for Cisco IOS * Update changelog * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Add function * Update dates * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update D3 Smart SOAR solution to v3.2.0 with new offer ID
…Connectors/aiohttp-3.13.4
…stems/DataConnectors/aiohttp-3.13.4 Bump aiohttp from 3.13.3 to 3.13.4 in /Solutions/Open Systems/DataConnectors
…plate compatibility
…) to fix ARM InvalidTemplate error
…pace-resourceid Fix: Cyren-SentinelOne workspaceResourceId ARM deployment error (InvalidTemplate on workspace name)
* Create parser * Update readme * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * KQL fixes * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * More kql fix * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Adjust parser to include AVSVcSyslog * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. * Create AVSVCSyslog table for validation * update dates * Fix parameter in asim auth * [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files. --------- Co-authored-by: Derrick Lee <derricklee@microsoft.com> Co-authored-by: github-actions[bot] <>
Remove preview s4 pc
…-names-for-arg Update ARG Tables' name to align with those in Tabel Management part.
…small-fix remove redundant [] in arm template
Enhance reader role for reduced scope of agentless connector
Add Citrix Analytics CCF solution (Push connector via Codeless Connector Framework)
add_analytic_rules__first_commit
…ud/Data-Connectors/aiohttp-3.13.4
…oPrismaCloud/Data-Connectors/aiohttp-3.13.4 Bump aiohttp from 3.13.3 to 3.13.4 in /Solutions/PaloAltoPrismaCloud/Data Connectors
#14010) * [AtlassianConfluenceAuditConnector] - update streamDeclarations in DCR * Update Solutions/AtlassianConfluenceAudit/Data/Solution_AtlassianConfluenceAudit.json Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Srikar Shastry <Srikar.Sistla@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Derrick Lee <derricklee@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present:
Guidance <- remove section before submitting
Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:
Thank you for your contribution to the Microsoft Sentinel Github repo.
Change(s):
Reason for Change(s):
Version updated:
Testing Completed:
Note: If updating a detection, you must update the version field.
Checked that the validations are passing and have addressed any issues that are present:
Note: Let us know if you have tried fixing the validation error and need help.