Skip to content

Merge Azure Sentinel Master into fork#26

Closed
Phrozyn wants to merge 10000 commits intoarmor:masterfrom
Azure:master
Closed

Merge Azure Sentinel Master into fork#26
Phrozyn wants to merge 10000 commits intoarmor:masterfrom
Azure:master

Conversation

@Phrozyn
Copy link
Copy Markdown

@Phrozyn Phrozyn commented Jun 20, 2024

Required items, please complete

Change(s):

  • See guidance below

Reason for Change(s):

  • See guidance below

Version Updated:

  • Required only for Detections/Analytic Rule templates
  • See guidance below

Testing Completed:

  • See guidance below

Checked that the validations are passing and have addressed any issues that are present:

  • See guidance below

Guidance <- remove section before submitting


Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

  • Updated syntax for XYZ.yaml

Reason for Change(s):

Version updated:

  • Yes
  • Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

  • Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

  • Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:


Fuqing Wang and others added 30 commits March 24, 2026 09:29
…ta-Connectors/azure-core-1.38.0

Bump azure-core from 1.32.0 to 1.38.0 in /Solutions/XBOW/Data Connectors
Reorder and simplify the Threat Intelligence analytic query to deduplicate records earlier and apply active/expiration filters afterwards. Added summarize arg_max(TimeGenerated, *) by Id, Url and by Id, ObservableValue to get the latest record before filtering, moved IsActive/ValidUntil/ExpirationDateTime checks to follow deduplication, and removed redundant time-order checks and extra arg_max usages related to EmailUrlInfo. These changes ensure the latest valid indicators are retained and simplify the join logic. Bumped version 1.0.5 -> 1.0.6.
Introduce MicrosoftCopilotActivityMonitoring workbook and wire it into the Microsoft Copilot solution. Changes include: add workbook JSON under Workbooks/, reference it in Solution_MicrosoftCopilot.json, add Workbooks step to createUiDefinition, add workbook parameters/variables/resources/template-spec and metadata to mainTemplate.json, include the workbook in the content package manifest, add test parameter for workbook name, and fix KQL parameter quoting in the workbook queries. Updated packaged zip accordingly.
Reorder and clean up ThreatIntelIndicators handling for URL and domain matches. For URLs, summarize (arg_max) by Id/ObservableValue first, then filter for active/unexpired indicators, and normalize ObservableValue to lowercase before joining with EmailUrlInfo_. For domains, normalize DomainName to lowercase earlier and correct the projected active field name to IsActive. These changes ensure joins use the latest, active indicators and consistent casing for reliable matching.
Release update for Threat Intelligence (NEW): add packaged artifact 3.0.16.zip and bump solution/template versions to 3.0.16. Update analytic rule 6 version to 1.0.6 and refine its KQL query logic to use arg_max(TimeGenerated,*) and improved filtering for URL/domain indicators. Standardize/roll back several resource apiVersion values (various Microsoft.OperationalInsights and Microsoft.SecurityInsights providers) and update resource descriptions and field mappings formatting across templates.
…tructions

Optimize TI analytic rule deduplication and filters
…etoCCF

rename to VMware Carbon Black Cloud via AWS S3(via Codeless Connector Framework)
…oCCF

Rename CCF to Sophos Endpoint Protection (via Codeless Connector Platform)
…nametoCCF

Rename CCF solution to SentinelOne (via Codeless Connector Framework)
Rename CCF solution to Okta Single Sign-On (via Codeless Connector Framework)
rename Box Events(CCP) to Box Events (via Codeless Connector Framework)
…etoCCF

rename Netskopev2(CCP) to Netskope(via Codeless Connector Framework)
…csv date field (#13899)

* Fixing null byte corruption in the azure state manager timestamp and date formatting filed for csv

* updated the code and .zip to address comment of Guarding the none in format_date

---------

Co-authored-by: Krishna Chilukamarri <v-krishna_microsoft.com@microsoft.com>
* Create parser and changelog

* Update changelog

* Update asimtester

* Fix kql validation

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* FIx kql and update changelog

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* Align schema ver

* Remove Proxy from file names and keep as CiscoUmbrella

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

---------

Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-authored-by: github-actions[bot] <>
AmirSasson and others added 29 commits April 6, 2026 14:47
[ASIM Parser] Add Polo Alto Pan-OS Authentication log ASIM Parser
* Create parser for Cisco IOS

* Update changelog

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* Add function

* Update dates

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

---------

Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-authored-by: github-actions[bot] <>
Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update D3 Smart SOAR solution to v3.2.0 with new offer ID
…stems/DataConnectors/aiohttp-3.13.4

Bump aiohttp from 3.13.3 to 3.13.4 in /Solutions/Open Systems/DataConnectors
…pace-resourceid

Fix: Cyren-SentinelOne workspaceResourceId ARM deployment error (InvalidTemplate on workspace name)
* Create parser

* Update readme

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* KQL fixes

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* More kql fix

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* Adjust parser to include AVSVcSyslog

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

* Create AVSVCSyslog table for validation

* update dates

* Fix parameter in asim auth

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

---------

Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-authored-by: github-actions[bot] <>
…-names-for-arg

Update ARG Tables' name to align with those in Tabel Management part.
…small-fix

remove redundant [] in arm template
Enhance reader role for reduced scope of agentless connector
Add Citrix Analytics CCF solution (Push connector via Codeless Connector Framework)
…oPrismaCloud/Data-Connectors/aiohttp-3.13.4

Bump aiohttp from 3.13.3 to 3.13.4 in /Solutions/PaloAltoPrismaCloud/Data Connectors
#14010)

* [AtlassianConfluenceAuditConnector] - update streamDeclarations in DCR

* Update Solutions/AtlassianConfluenceAudit/Data/Solution_AtlassianConfluenceAudit.json

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Srikar Shastry <Srikar.Sistla@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Derrick Lee <derricklee@microsoft.com>
@Phrozyn Phrozyn closed this Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.