Skip to content

Comments

Merge Azure Sentinel Master into fork#26

Open
Phrozyn wants to merge 10000 commits intoarmor:masterfrom
Azure:master
Open

Merge Azure Sentinel Master into fork#26
Phrozyn wants to merge 10000 commits intoarmor:masterfrom
Azure:master

Conversation

@Phrozyn
Copy link

@Phrozyn Phrozyn commented Jun 20, 2024

Required items, please complete

Change(s):

  • See guidance below

Reason for Change(s):

  • See guidance below

Version Updated:

  • Required only for Detections/Analytic Rule templates
  • See guidance below

Testing Completed:

  • See guidance below

Checked that the validations are passing and have addressed any issues that are present:

  • See guidance below

Guidance <- remove section before submitting


Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

  • Updated syntax for XYZ.yaml

Reason for Change(s):

Version updated:

  • Yes
  • Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

  • Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

  • Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:


Shams-Z and others added 30 commits February 9, 2026 19:20
Paging bug fix
…ration-change

[Tenable App][rsyslog] - Change in rsyslog configuration
* Remove PII sample values from UEBABehaviorsAnalysisWorkbook

Replaced hardcoded sample PII values with empty strings:
- AWS IAM ARN
- Incident time timestamp
- Time window values (24h and 12h)

* Packaged

---------

Co-authored-by: shlomimaa10-art <shlomimaa10@gmail.com>
Co-authored-by: v-atulyadav <v-atulyadav@microsoft.com>
Handle multiple offers in GetCatalogDetails
connector id added to ValidConnectorIds.json
- Changed paging from Offset to PersistentToken to prevent duplicate ingestion
- Offset paging resets to 0 each poll cycle; Cyren API clamps low offsets to
  startOffset, causing ~99.99% duplicate records (1.19M ingested, 100 unique)
- PersistentToken saves last offset across poll cycles via JSONPath extraction
- Added ago(2d) filter in DCR transform as additional cost protection
- Removed old 3.0.0.zip and 3.0.1.zip packages
Visa TI Solution for Microsoft Sentinel Content hub
- Restore functionCode.zip that was accidentally deleted during folder restructure
  The Function App template references this zip via WEBSITE_RUN_FROM_PACKAGE but
  the file was removed in commit 4c731dd per reviewer request without relocation
- Remove workspace-scoped roleAssignment resources from Function App template
  These cause InvalidTemplate errors when deployed through Content Hub template specs
  (@ character parsing failure). No other Azure-Sentinel solution uses workspace-scoped
  roleAssignments in Function App templates. Role assignments are now documented as
  post-deployment steps matching the standard pattern (Fortinet, Zscaler, etc.)
- Version bump to 3.0.1
Bumps [cryptography](https://github.com/pyca/cryptography) from 3.4.8 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@3.4.8...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@41.0.3...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [cryptography](https://github.com/pyca/cryptography) from 42.0.8 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@42.0.8...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [cryptography](https://github.com/pyca/cryptography) from 43.0.1 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.1...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
v-dvedak and others added 30 commits February 23, 2026 15:38
…blockaad

Updating permissions for blockaad user incident trigger
…s to 3.2.3

Release bump to version 3.2.3: adds the packaged release archive (Solutions/Microsoft Business Applications/Package/3.2.3.zip) and updates mainTemplate.json to reference 3.2.3 across the solution variable, resource descriptions, content/version fields for workbooks, analytic rules, hunting queries, playbooks, and parsers. Also adjusts technique IDs in a few rule/query entries (T0819 -> T1190).
…SessionEssentials_LinkFix

[Network Session Essentials]: Links fixed. Removed review.
…imDnsActivityLogs

Add missing field (EventSchemaVersion) to ASimDnsNative parsers
* Fix typos

* [ASIM Parsers] Generate deployable ARM templates from KQL function YAML files.

---------

Co-authored-by: Derrick Lee <derricklee@microsoft.com>
Co-authored-by: github-actions[bot] <>
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.13.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bump Microsoft.OperationalInsights/savedSearches apiVersion from 2022-10-01 to 2025-07-01 for hunting queries in mainTemplate.json, remove the HTML deprecation note about the legacy Log Analytics agent from solution metadata (Solution_Windows Security Events.json, createUiDefinition.json, mainTemplate.json), and refresh the packaged solution zip (3.0.12.zip). These changes align saved search resources with a newer API version and clean up installer documentation.
Update savedSearches apiVersion and solution description
CrowdSecurity PlayBook - Detect Authentication from suspicious IPs
Checkout PR branch; block fork test infra changes
Update mainTemplate.json to use Microsoft.OperationalInsights API version 2025-07-01 for savedSearches and workspace savedSearches resources. Also bump the ExchagngeSuspiciousFileDownloads.yaml detection version from 1.0.4 to 1.0.5 and refresh the packaged solution (3.2.3.zip) to include these changes.
Change parameter types from "string" to "securestring" for sensitive parameters (connectorDefinitionName, workspace, tenantId, clientId, clientSecret, auditHost, innerWorkspace, etc.) across multiple parameter blocks in Solutions/Microsoft Business Applications/Package/mainTemplate.json. The packaged artifact Solutions/Microsoft Business Applications/Package/3.2.3.zip was also updated to reflect these template changes.
Updated technique in hunting query and Microsoft Business Application…
Add a missing period and normalize trailing spaces on the 3.0.2 entry in Solutions/WithSecureElementsViaFunction/ReleaseNotes.md for consistency.
Add support of lacking event types
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.