[Edouard360]

Required items, please complete

Change(s):

• See guidance below

Reason for Change(s):

• See guidance below

Version Updated:

• Required only for Detections/Analytic Rule templates
• See guidance below

Testing Completed:

• See guidance below

Checked that the validations are passing and have addressed any issues that are present:

• See guidance below

Guidance <- remove section before submitting

---

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

• Updated syntax for XYZ.yaml

Reason for Change(s):

• New schema used for XYZ.yaml
• Resolves ISSUE Add Logstash required version to Readme file Azure/Azure-Sentinel#1234

Version updated:

• Yes
• Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

• Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

• Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

• Guidance for Detection checks
• General contribution guidance
• PR validation troubleshooting

---

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2026-02-27T23:48:06.101Z
Learn more: GitHub Security Lab - Preventing PWN Requests

In general, to fix an unused local variable you either (1) remove the variable and, if needed, keep only the right-hand side expression for its side effects, or (2) rename the variable to an obviously-unused name (like _ or containing unused) if it is intentionally not read. Here, the ingestion call is needed for its side effect, but the return value is not used, so we should remove the result = part.

The best minimal-change fix is to replace result = ingest_client.ingest_from_file(...) with a bare call ingest_client.ingest_from_file(...). This preserves the ingestion behavior, avoids introducing new behavior or dependencies, and removes the unused variable so that the CodeQL warning is resolved. No imports, method signatures, or other parts of the file need to be touched.

Concretely, in Tools/Solutions Analyzer/upload_to_kusto.py, within the function that uploads CSV content (shown around lines 230–272), update line 266 so that it no longer assigns to result, leaving everything else intact.

To fix the unused local variable, remove the unnecessary assignment to result while preserving the side effect of calling ingest_client.ingest_from_file(...). This means we keep the ingestion call but do not store its return value.

Concretely, in Tools/Solutions Analyzer/upload_to_kusto.py, inside the function that uploads a CSV file to Kusto (the one where line 215 appears), replace the line:

result = ingest_client.ingest_from_file(str(csv_path), ingestion_properties=ingestion_props)

with a call that is not assigned to any variable:

ingest_client.ingest_from_file(str(csv_path), ingestion_properties=ingestion_props)

No additional imports, methods, or definitions are required. Existing functionality is unchanged: ingestion is still performed, exceptions are still caught and printed, and the function still returns True on success and False on failure.

---

To fix the problem, remove the unused Dict symbol from the typing import so that only the actually used types remain. This keeps the import clean, preserves all existing functionality, and resolves the CodeQL warning.

Concretely, in Tools/Solutions Analyzer/upload_to_kusto.py at line 34, change from typing import List, Tuple, Optional, Dict to from typing import List, Tuple, Optional. No other code changes are required, because Dict is not referenced elsewhere in the given snippet.

In general, empty except blocks should either be removed (letting the exception propagate) or replaced with explicit handling, such as logging, metric updates, or setting a safe fallback value, plus a brief comment if ignoring is intentional. Here, we want to keep the functional behavior: if parsing Retry-After fails, we should still use the exponential backoff branch. That already happens when retry_after remains None, so the main fix is to add logging inside the except block, and possibly an explanatory comment, rather than changing control flow.

Concretely, in GlobalRateLimiter.handle_rate_limit, around lines 324–330, replace the empty except (ValueError, TypeError): pass with an except block that logs a warning or debug message indicating the header value could not be parsed and that exponential backoff will be used instead. This uses the already-present self.logger and does not require any new imports or additional helper methods. No other parts of the file need to change.

In general, empty except blocks should either be removed (letting the exception propagate) or replaced with explicit handling such as logging, transforming, or re-raising the exception. If an exception is intentionally ignored, there should be a clear comment explaining why, to avoid confusion and to make static analyzers less likely to flag it.

For this specific case, the best fix that preserves existing behavior is to keep the fallback behavior (treat malformed Retry-After as “no header”), but add a small logging statement in the except ValueError: block. This way, the code still uses the exponential backoff when parsing fails, but operators can see that a malformed header was received. We should not change the computed delay logic, and we should not raise the exception, as that would alter the retry behavior. The change is limited to the try/except around retry_after = int(response.headers['Retry-After']) in bloodhound_manager.py, and no new imports or helper methods are needed, since self.logger is already used in the surrounding code.

Concretely, in Solutions/BloodHound Enterprise/Data Connectors/BloodHoundDataConnector/SharedCode/utility/bloodhound_manager.py, locate the except ValueError: block around line 392–395 and replace the empty body with a log message (e.g., self.logger.warning(...)) explaining that the Retry-After header could not be parsed and that the default backoff will be used.

In general, empty except blocks should either (a) handle the error meaningfully (e.g., by logging, fallback logic, or re‑raising) or (b) clearly document why the exception is safe to ignore. Here, _get_retry_after_delay already defines the fallback behavior (return None on invalid/missing header), so the best fix is to keep that behavior but add logging in the except block to record that an invalid Retry-After header was encountered. This addresses the static analysis complaint, preserves existing functionality, and aids troubleshooting.

Concretely, in Solutions/BloodHound Enterprise/Data Connectors/BloodHoundDataConnector/SharedCode/utility/bloodhound_manager.py, within _get_retry_after_delay, replace the pass in the except (ValueError, TypeError) block with a logging.debug (or logging.warning if you prefer stronger visibility) message that includes the offending header value. No new imports are needed because logging is already imported at the top of the file. The rest of the function, including returning None after the except, should remain unchanged.

To fix an unused import, you remove the import statement so that the code only depends on modules it actually uses. This improves readability and avoids confusion about nonexistent or removed functionality.

In this file, the single best fix is to delete the import json line near the top of tier_zero_assets_collector.py, leaving the other imports unchanged. No further code changes are required, since no references to json exist in the shown code. Specifically, in Solutions/BloodHound Enterprise/Data Connectors/BloodHoundDataConnector/SharedCode/azure_functions/tier_zero_assets_collector.py, remove line 4 (import json) and do not add any new imports or functions.

To fix an unused import, the general solution is to remove the import statement for the symbol that is not used anywhere in the module. This avoids unnecessary dependencies, keeps the code cleaner, and can slightly improve import time.

In this case, the best fix is to delete the line from azure.core.exceptions import ResourceNotFoundError at the top of tier_zero_assets_collector.py. No other code changes are required, because there are no references to ResourceNotFoundError in the shown file. This change preserves existing functionality while resolving the static analysis warning.

You only need to edit Solutions/BloodHound Enterprise/Data Connectors/BloodHoundDataConnector/SharedCode/azure_functions/tier_zero_assets_collector.py, removing the exact import line 5. No new methods, imports, or definitions are needed.

[olivierfeedly]

ok