Repository navigation

Sync master with Azure/Azure-Sentinel - #5

Open

Edouard360 wants to merge 6298 commits into

masterfrom

sync-upstream-to-azure

Open

Sync master with Azure/Azure-Sentinel#5
Edouard360 wants to merge 6298 commits into
masterfrom
sync-upstream-to-azure

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 18, 2026
- Updated solution zip
  niralishah-crest
  committed
  4c692ef
- Merge branch 'master' into GTI_Solution_for_Vulnerability
  devendra-chavda
  committed
  57c3dda
- Merge pull request #14508 from niralishah-crest/VectraRUX
  v-atulyadav
  authored
  f55ef94
- Fix ARM-TTK module path compatibility
  
  idoshabi07
  and
  Copilot
  committed
  0fad563
- Validate Security Hub filter structure
  
  idoshabi07
  and
  Copilot
  committed
  9fb51d0
- Scope GitHub App private key to token step
  
  idoshabi07
  and
  Copilot
  committed
  4be49c0
- feat(corelight): add aggregation log support to analytic rules
  shashankshah-crest
  committed
  baebf9d
- Wiz 3.0.2: repackage with V3 tool and clarify STEP 1 instructions
  
  marekq
  and
  claude
  committed
  9b7cf83
- [Salesforce] - Audit Logs parser, table defs and updated connector configs (#14936)
  
  srikarshastry
  and
  Srikar Shastry
  authored
  cd455a8
- Updated Endpoint Threat Protection Essentials Solution
  v-utpalkumar
  committed
  b4b7cd1
- Merge branch 'master' into V-Utpal/EndpointThreatProtectionEssentialsSolutionUpdate
  v-utpalkumar
  committed
  4a087e9
- updated release notes
  v-dhbedu
  committed
  996468f
- [Cisco Meraki REST API Connector] - Fixed Timespan on Air Marshal Events (#14817)
  
  authored
  721cf97
- Add hunting queries: break-glass account hunting pack (2 queries)
  descambiado
  committed
  85586db
Commits on Aug 19, 2026
- Sentinel Bicep file
  josamontiel
  authored
  aa94e62
- Merge branch 'Azure:master' into master
  josamontiel
  authored
  b9128a6
- Merge pull request #14931 from pagoudjo/feature/pagoudjo/mulesoftcloudhubalerts.promotetoga.01.01
  v-atulyadav
  authored
  170848d
- Merge branch 'master' into pr/14878
  v-maheshbh
  committed
  cce67d9
- Preserve centralized Cybersixgill package values
  
  idoshabi07
  and
  Copilot
  committed
  b058aea
- Fix Logic App parameter type casing
  
  idoshabi07
  and
  Copilot
  committed
  276e16b
- Merge pull request #14878 from EnisAksu/Cybereinforce
  v-atulyadav
  authored
  06bc362
- Fix SampleId mapping in Recorded Future package
  v-maheshbh
  committed
  baa337c
- Merge pull request #14916 from kingwil/user/kingwil/sapremoval
  v-atulyadav
  authored
  55effb8
- Restore Veeam TLS certificate validation
  idoshabi07
  committed
  7cfb338
- Address Veeam TLS review feedback
  
  idoshabi07
  and
  Copilot
  committed
  c4f7592
- Merge pull request #14905 from idoshabi07/ai-scan/recorded-future-secret
  v-atulyadav
  authored
  cb9cd7a
- fixes malformed dataCollectionEndpoint expression in dcrConfig
  chkp-kirilll
  committed
  b0fe47b
- feat: migrate v3.0 playbooks to Log Ingestion API (DCE/DCR)
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  2048434
- docs: minor readme updates
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  fcd1aa5
- fix: remove possibility to change table names
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  14e9f8f
- fix: remove unused param
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  9f5e61d
- docs: update playbook prereqs
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  536c3f1
- docs: document duplication between template files
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  443e2ea
- temp: point v3.0 readme deploy buttons to fork/branch for testing
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  81ec19b
- docs: fix v3.0 readme
  
  aommm
  authored and
  ErikMangstenRecFut
  committed
  1f9f172
- Update NordStellar connector to version 3.0.1
  mantasg-nordsec
  committed
  713be40
- Merge pull request #14875 from marekq/fix/sentinel-service-principal-instructions
  v-atulyadav
  authored
  58ca74b
- Retrigger validation checks
  
  idoshabi07
  and
  Copilot
  committed
  d6b7572
- Regenerate AWS Security Hub packages
  
  idoshabi07
  and
  Copilot
  committed
  8e6d27e
- Code review fixes
  mantasg-nordsec
  committed
  d368eea
- Intel 471: repackage as 3.0.1, playbook template versions and Key Vault fixes
  
  mmolenda
  and
  claude
  committed
  462007b
- Repackage Threat Intelligence (NEW) solution with the V3 tool
  github-actions[bot]
  committed
  7c87132
- Merge branch 'master' into stratosecure-v1.0.0
  
  freddan58
  and
  claude
  committed
  c0fd23b
- Potential fix for pull request finding
  
  josamontiel
  and
  Copilot
  authored
  1e75cf3
- Fix solution categories and restore the missing workbooks in the package
  
  freddan58
  and
  claude
  committed
  abc2a29
- Modify customer-managed key parameter for Sentinel
  josamontiel
  authored
  533bba1
- Complete break-glass account hunting pack with membership query
  descambiado
  committed
  6aae45e
- Cross-reference all three break-glass queries in their descriptions
  descambiado
  committed
  916acaa
- Fix target-user extraction and operation-name coverage on two queries
  descambiado
  committed
  597e8a1
- Pin RoleChangesBase and GroupChangesBase with materialize()
  descambiado
  committed
  f1eff38
- Fix GitHub issue to add support for a configurable page size for the Workday data connector. (#14939)
  v-ezequielbi
  authored
  1443d88
- Merge remote-tracking branch 'upstream/master' into contraforce-events-solution
  DanielMLCF
  committed
  f2e4115
- Add support email to SolutionMetadata and regenerate the package
  DanielMLCF
  committed
  41af167
- Merge pull request #14932 from AmirSasson/blob-storage-source-scope-parameters
  AmirSasson
  authored
  04549c0
Commits on Aug 20, 2026
- Merge remote-tracking branch 'origin/master' into add-speculus-threat-intelligence
  speculusmarc
  committed
  d55a6f7
- [Airlock Digital] Update solution to version 3.2.0
  ChrisMaureder
  committed
  3030957
- Refresh CI merge ref
  speculusmarc
  committed
  df0617f
- Merge branch 'master' into GTI_Solution_for_Vulnerability
  devendra-chavda
  committed
  7a60bcf
- Merge pull request #14607 from SpeculusDevelopers/add-speculus-threat-intelligence
  v-atulyadav
  authored
  c48b4b7
- Merge branch 'master' into datazag-solution
  peterchap
  authored
  c642393
- Datazag: single 3.0.0 package, per review feedback
  
  peterchap
  and
  claude
  committed
  8f07325
- Re-register DatazagThreatIntelligence in ValidConnectorIds.json
  
  peterchap
  and
  claude
  committed
  4f434f3
- VaronisSaaS 3.2.0: CCF connector ingests into dedicated VaronisAlertsV2_CL table
  vdobrotskyi-varonis
  committed
  53cdb48
- Bump Microsoft Defender XDR solution to v3.0.17
  v-kasghosh
  committed
  264e4dd
- Update CrowdStrike solution to 3.4.1
  v-kasghosh
  committed
  8070c3e
- Bump CMMC 2.0 solution to v3.1.1
  v-kasghosh
  committed
  cdb1b1a
- Update readme.md
  v-kasghosh
  committed
  4d2f0fa
- Merge pull request #14839 from ChrisMaureder/airlockdigital-3.2.0
  v-atulyadav
  authored
  ed14196
- Datazag: align the rule confidence floor with the feed (85 -> 55)
  
  peterchap
  and
  claude
  committed
  d7370d6
- Update WS40007 to HMS30001 and also update respective description
  Shubhangi Pagar
  committed
  4ba7d6c
- Fix arm-ttk Hardcoded.Url.Reference in Threat Intelligence (NEW) mainTemplate
  nzdsf2-gif
  committed
  1663444
- Update WS40007 to HMS30001 and also update respective description
  Shubhangi Pagar
  committed
  282e88c
- fix typo
  Shubhangi Pagar
  committed
  01e6d91
- Merge pull request #14938 from Azure/V-Utpal/EndpointThreatProtectionEssentialsSolutionUpdate
  v-atulyadav
  authored
  7ea6947
- Fix KqlValidations: read watchlist lookup from SearchKey
  descambiado
  committed
  fb9f94a
- Update WorkspaceUsage.json
  clivewatson
  authored
  d759e7c
- Update WorkbooksMetadata.json
  clivewatson
  authored
  22a2c09
- fix: Update solutionId to match Partner Center Offer Name
  nikhildubey-trend
  committed
  c27e2ce
- Remove pattern validation for workspaceName
  josamontiel
  authored
  356c6bc
Commits on Aug 21, 2026
Commits on Aug 22, 2026
- Address review feedback on break-glass hunting pack
  descambiado
  committed
  ee49fbf
- Possible Exfilteration detection rule added for CISCO ASA
  Rajaravi99
  committed
  d579ede
Commits on Aug 24, 2026
- Restore 3.0.0 package, shorten release notes; use new URL for nordstellar
  mantasg-nordsec
  committed
  9577a84
- Merge pull request #14943 from chkp-public-forks/fix/checkpoint-em-malformed-dataCollectionEndpoint-in-dcrConfig
  v-dvedak
  authored
  72bfbab
- Update URL for microsoft doc
  devendra-chavda
  committed
  21afb27
- Datazag: remove the data connector, use Sentinel's built-in TAXII connector
  
  peterchap
  and
  claude
  committed
  f1d9d28
- updating corelight doc url
  shashankshah-crest
  committed
  8557df2
- added DQL support with DynatraceRuntimeVulnerabilitiesV3
  keyoke
  committed
  341477d
- added DQL support with DynatraceAttacksV3
  keyoke
  committed
  5766baa
- added DQL support with DynatraceAuditLogsV3
  keyoke
  committed
  e48855a
- added DQL support with DynatraceProblemsV3
  keyoke
  committed
  fe608cd
- Updating polling freq and Added Add_DynatraceApplicationSecurityAttackSourceIpSTIXThreatIntelligence
  keyoke
  committed
  6ca6aae
- fixed metadata and repackaged
  keyoke
  committed
  fdddb61
- fixed issues with problems connector
  keyoke
  committed
  32f25d2
- updated version number in playbook templates
  keyoke
  committed
  0bb0f79
- moved away from hardcoded query windows for v3
  keyoke
  committed
  f7db372
- updated dynatrace polling config
  keyoke
  committed
  e7059df
- updated dynatrace package
  keyoke
  committed
  a3fab11
- deprecated the dynatrace v1 connectors for future removal
  keyoke
  committed
  24cc228
- fixed [Deprecated] arm escaping issue
  keyoke
  committed
  98c49dc
- fixed analytics rules datasources
  keyoke
  committed
  eedc480
- dynatrace connector updates
  keyoke
  committed
  ad15ff5
- renamed summary rule template
  keyoke
  committed
  5e10050
- fixed dynatrace workbook query
  keyoke
  committed
  515b313
- ARM template parameter types are expected to be lowercase (e.g., "string")
  keyoke
  committed
  5ee6a59
- The Parse JSON schema defines "AttackIdentifier" (capital A/I), but the later expression references "attackIdentifier" (lowercase).
  keyoke
  committed
  9026127
- The ApiKey value has mismatched brackets ("[[...']"), which will break ARM/template parsing.
  keyoke
  committed
  af10648
- Setting TimeGenerated = now() discards the actual event timestamp coming from Dynatrace (the poller query fetches a "timestamp" field).
  keyoke
  committed
  48dd791
- The description block scalar is wrapped in single quotes, which will make the quotes part of the rendered text. If the intent is plain text, remove the surrounding single quotes and keep the conten…
  keyoke
  committed
  9fef567
- Add missing CCP connector IDs to ValidConnectorIds.json, bump analytic rule versions, update release notes
  
  keyoke
  and
  claude
  committed
  d736b7a
- repackaged
  keyoke
  committed
  121f324
- Remove duplicate data connector text blocks in TI UI
  v-shukore
  committed
  f71c354
- Restore Cyborg Security HUNTER solution, reissue duplicated hunting query IDs
  
  mmolenda
  and
  claude
  committed
  af6f5d9
- Intel 471: add release checklist
  
  mmolenda
  and
  claude
  committed
  53d0f37
- Merge remote-tracking branch 'origin/master' into hunting_queries
  mmolenda
  committed
  c3f7db8
- Fix hunting query YAML indentation and repackage 3.0.1 with the latest queries
  
  mmolenda
  and
  claude
  committed
  6ef2a39
- Sentinel playbook: make the Key Vault secret-name parameters unmistakable
  
  mmolenda
  and
  claude
  committed
  3c06c25
- Add data connector sections to TI (NEW) createUiDefinition
  v-shukore
  committed
  b8b1274
- Sentinel playbook README: add an upgrade section for 2.0.0 users
  
  mmolenda
  and
  claude
  committed
  2144789
- Repackage Intel 471 solution 3.0.1 after playbook parameter rename
  
  mmolenda
  and
  claude
  committed
  ba07147
- Merge pull request #14858 from Jack22132/patch-1
  v-atulyadav
  authored
  54e8521
- Merge branch 'master' into stratosecure-v1.0.0
  
  freddan58
  and
  claude
  committed
  7dcba4f
- Replace the workbook preview images with per-workbook renders
  
  freddan58
  and
  claude
  committed
  8158ad1
- Merge pull request #14948 from descambiado/add-breakglass-account-hunting-pack
  v-atulyadav
  authored
  83ec0be
- chore: fix github links
  ErikMangstenRecFut
  committed
  cd5ea33
- Merge branch 'master' into stratosecure-v1.0.0
  freddan58
  committed
  2c46542
- Add the solution logo and reference it from the workbook metadata
  
  freddan58
  and
  claude
  committed
  bd85d8a
- Fix two defects that only surface when the package is actually deployed
  
  freddan58
  and
  claude
  committed
  cd07c25
- Fixed duplicate records issue
  v-dhbedu
  committed
  026bebd
- Merge remote-tracking branch 'upstream/master' into users/v-dhbedu/CiscoMeraki
  v-dhbedu
  committed
  1326a06
Commits on Aug 25, 2026
- Cisco Meraki: restore DCR and Connector Definition to match master; regenerate 3.1.2 package
  v-dhbedu
  committed
  12edf60
- Cisco Meraki: sync regenerated 3.1.2 package zip
  v-dhbedu
  committed
  87332bc
- Merge pull request #14947 from vdobrotskyi-varonis/users/VitaliiD/ccf-dedicated-table
  v-atulyadav
  authored
  a5a5b6d
- Reverted DCR changes
  v-dhbedu
  committed
  1791348
- Align custom data types' lastDataReceivedQuery with parser alias names
  v-dhbedu
  committed
  ea860f4
- Changed the solution version to 3.1.1
  v-dhbedu
  committed
  78aab27
- Update version from 3.1.2 to 3.1.1 in ReleaseNotes.md
  dhanunjaya1054
  authored
  fa5bda7
- Merge pull request #14885 from keyoke/users/gaemslie/dynatrace-dql-query
  v-atulyadav
  authored
  1dc6e1c
- Update threat intelligence connector labels
  v-shukore
  committed
  17f09ac
- Adding sample data and table schema
  shashankshah-crest
  committed
  d6d196d
- Limit credential logging PR to source fixes
  
  idoshabi07
  and
  Copilot
  committed
  505de11
- Restore Cybersixgill solution metadata
  
  idoshabi07
  and
  Copilot
  committed
  4900ac7
- Restore Cybersixgill runtime package
  
  idoshabi07
  and
  Copilot
  committed
  5f3bd22
- Restore solution metadata without packages
  
  idoshabi07
  and
  Copilot
  committed
  021d01a
- Preserve Cybersixgill metadata formatting
  
  idoshabi07
  and
  Copilot
  committed
  790d11a
- Remove generated Veeam solution package
  
  idoshabi07
  and
  Copilot
  committed
  e265532
- Remove Veeam data and release-note changes
  
  idoshabi07
  and
  Copilot
  committed
  45d5986
- Remove solution data and release-note changes
  
  idoshabi07
  and
  Copilot
  committed
  b2ca32c
- Remove Veeam solution metadata change
  
  idoshabi07
  and
  Copilot
  committed
  10dd29a
- Merge pull request #14945 from mantasg-nordsec/master
  v-atulyadav
  authored
  d1db789
- Merge pull request #14907 from idoshabi07/ai-scan/veeam-tls
  v-atulyadav
  authored
  3911963
- Merge pull request #14923 from idoshabi07/ai-scan/sensitive-connector-logging
  v-atulyadav
  authored
  bc82147
- Merge pull request #14924 from nzdsf2-gif/fix/ti-domain-commonsecuritylog-join
  v-atulyadav
  authored
  49818c4
- Merge branch 'master' into pr/14933
  v-maheshbh
  committed
  d996e8f
- Remove GitHub App secrets from KQL validation
  
  idoshabi07
  and
  Copilot
  committed
  1254ab1
- Update GTI Azure Gov deploy badges
  v-maheshbh
  committed
  8146f76
- Update ReleaseNotes.md
  v-kasghosh
  committed
  c7c6d08
- added and updated custom functions
  shashankshah-crest
  committed
  f03b02a
- Update ReleaseNotes.md
  v-kasghosh
  committed
  3a6207b
- Merge pull request #14820 from devendra-chavda/GTI_Solution_for_Vulnerability
  v-atulyadav
  authored
  1e4c680
- Merge pull request #14950 from Azure/v-kasghosh/Crowdstrike_falcon_endpoint/Bug_fixing
  v-atulyadav
  authored
  1820d79
- [Cisco Meraki REST API Connector] : Fix duplicate ingestion, add parsers (#14971)
  
  authored
  027a0f9
- Stabilize ASIM parser filtering tests (#14970)
  
  michaelatmsft
  and
  Copilot
  authored
  1c07685
- Fix Fortinet DNS parser default event type filtering (#14958)
  
  michaelatmsft
  and
  Copilot
  authored
  f2f10bc
- Fix Blob CCF role assignment GUID collisions
  jasonheard
  committed
  c4be31e
Commits on Aug 26, 2026
- Merge pull request #14850 from eileen-zhaoo/eileen-zhaoo-1password-ccp-revert-paging
  v-atulyadav
  authored
  a4a063a
- Merge pull request #14952 from shubhangipagar-gh/updateReadme
  v-atulyadav
  authored
  dcb9981
- Merge pull request #14944 from recordedfuture/feat/RFPD-77178-log-ingestion-api-2
  v-dvedak
  authored
  93bf6ce
- Add Uniqkey solution with CCF data connector, analytic rules and workbook
  
  fahrneren
  and
  claude
  committed
  70639b1
- [Cisco Meraki REST API Connector] : Consolidate release notes for version 3.1.1
  dhanunjaya1054
  authored
  1386476
- Merge branch 'master' into users/v-dhbedu/CiscoMeraki
  dhanunjaya1054
  authored
  96e8f1e
- Merge pull request #14979 from dhanunjaya1054/users/v-dhbedu/CiscoMeraki
  v-maheshbh
  authored
  0717e8d
- Potential fix for pull request finding
  
  fahrneren
  and
  Copilot
  authored
  e246992
- Add explicit time window filter to ingestion canary rule
  
  fahrneren
  and
  claude
  committed
  e692af5
- Remove UTF-8 BOM from solution README
  
  fahrneren
  and
  claude
  committed
  cd32970
- Revert "Potential fix for pull request finding"
  fahrneren
  committed
  9c0d388
- Merge pull request #14906 from idoshabi07/ai-scan/solution-tooling
  v-atulyadav
  authored
  4e02990
- Fix missing .png extensions in GoogleThreatIntelligence workbook metadata
  
  fahrneren
  and
  claude
  committed
  6004927
- Updating as per KQL validation check failure
  shashankshah-crest
  committed
  9b01184
- Merge branch 'master' into stratosecure-v1.0.0
  
  freddan58
  and
  claude
  committed
  2417275
- Merge pull request #14963 from Rajaravi99/solves-#14224
  v-atulyadav
  authored
  aae474e
- [CloudFare CCF] - Fixed RoleAssignnmentUpdateNotPermitted error when migrating from Azure Function to CCF connector
  jasonheard
  committed
  5c828e8
- SynqlyIntegrationConnector 3.0.1: add new ASIM tables and alert rule for converting ASIM Alert events
  lkwdwrd
  committed
  f5675f0
- Skip additional ASIM union parsers
  
  mporfirov
  and
  Copilot
  committed
  ec46259
- Add OCI connector 3.0.11 upgrade notice
  jasonheard
  committed
  3494ae1
- [Salesforce] - Corrected the parser metadata version (#14985)
  
  srikarshastry
  and
  Srikar Shastry
  authored
  a38e375
- Merge pull request #14988 from jlheard/user/jlheard/oci-3.0.11-upgrade-notice
  destinywu
  authored
  ccbad45
- Cisco Umbrella CCF connections overwriting shared S3 buckets
  Echo-bot80
  committed
  2974764
- Fix OktaV2 Parser (#14957)
  bqiao-microsoft
  authored
  4921d35
- Centralize ASIM parser file classification
  
  mporfirov
  and
  Copilot
  committed
  c1c249b
Commits on Aug 27, 2026
- Remove empty lines
  mporfirov
  committed
  9a40a07
- Merge pull request #14975 from idoshabi07/ai-scan/kql-validation-secrets
  v-atulyadav
  authored
  4518e9a
- Merge pull request #14900 from idoshabi07/ai-scan/github-workflow
  v-atulyadav
  authored
  d630d39
- Format StratoSecure release notes table
  v-maheshbh
  committed
  8467baf
- Add Uniqkey logo to workbook gallery logos directory
  
  fahrneren
  and
  claude
  committed
  230f4fb
- Address review feedback: connector logo format and solution preview images
  
  fahrneren
  and
  claude
  committed
  85c0ab7
- Merge pull request #14989 from Bhagya767/ciscoumbrellamulti
  v-atulyadav
  authored
  2aca83b
- Merge pull request #14933 from shashankshah-crest/corelight-3.3.0-dcr-connector
  v-atulyadav
  authored
  7d2ca15
- Trim descriptions to schema limits, move onboarding into solution description, remove data connector
  peterchap
  committed
  2fe21d2
- Shorten hunting queries descriptions
  mmolenda
  committed
  13e9bd1
- Set package version to 3.0.0 for initial release
  peterchap
  committed
  80cf235
- Restore package-lock.json to match master
  
  freddan58
  and
  claude
  committed
  a2404bc
- Merge pull request #14781 from Azure/v-kasghosh/Microsoft_Defender_XDR/bug_fixing
  v-atulyadav
  authored
  63f6068
- Replace placeholder workbook preview images with real portal screenshots
  fahrneren
  committed
  7c0c629
- Update ReleaseNotes.md
  v-shukore
  committed
  bdf8825
- Merge pull request #24 from intel471/shorten_hunting_queries_descriptions
  mmolenda
  authored
  1290cb3
- Re-packaging after amending query descriptions
  mmolenda
  committed
  c91677b
- Add Datazag solution logo
  peterchap
  committed
  2eef3b4
- Merge pull request #14986 from Azure/mporfirov-fix-union-parser-validation
  mporfirov
  authored
  8f4b274
- Revert "[CloudFare CCF] - Fixed RoleAssignnmentUpdateNotPermitted error when migrating from Azure Function to CCF connector"
  jasonheard
  committed
  034195d
- Canonicalize Blob role assignment GUID seeds
  jasonheard
  committed
  bb4f7f5
Commits on Aug 28, 2026

Commits

Commits on Aug 18, 2026

Commits on Aug 19, 2026

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 22, 2026

Commits on Aug 24, 2026