Add Menlo Security solution - #14964
Conversation
b10f242 to
e378db0
Compare
e378db0 to
efcf231
Compare
Adds the Menlo Security data connector solution. It ingests Audit, Bandwidth, and Web proxy logs from the Menlo Security Log Fetch API into the MenloAudit_CL, MenloBandwidth_CL, and MenloWeb_CL custom Log Analytics tables via three timer-triggered Azure Functions and the Azure Monitor Logs Ingestion API (Data Collection Endpoint + Data Collection Rule).
efcf231 to
bbc2083
Compare
|
@microsoft-github-policy-service agree [company="Menlo Security"] |
|
@microsoft-github-policy-service agree company="Menlo Security" |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a new Menlo Security Microsoft Sentinel solution that deploys an Azure Functions–based connector to ingest Menlo Audit, Bandwidth, and Web proxy logs into custom Log Analytics tables via the Azure Monitor Logs Ingestion API (DCE/DCR).
Changes:
- Introduces Menlo Security solution metadata/docs and Content Hub packaging artifacts under
Solutions/MenloSecurity/. - Adds ARM templates + createUiDefinition to deploy connector infrastructure and custom tables.
- Adds custom table schemas for KQL validation tests.
Reviewed changes
Copilot reviewed 13 out of 16 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/MenloSecurity/SolutionMetadata.json | Defines solution identity, versioning, support info, and icon. |
| Solutions/MenloSecurity/ReleaseNotes.md | Adds initial release notes entry for v3.0.0. |
| Solutions/MenloSecurity/README.md | Documents connector behavior, deployment, and configuration. |
| Solutions/MenloSecurity/Package/testParameters.json | Provides ARM-TTK-friendly test parameters for packaging. |
| Solutions/MenloSecurity/Package/mainTemplate.json | Content Hub package template wiring content package + connector template. |
| Solutions/MenloSecurity/Package/createUiDefinition.json | Content Hub installer UI for selecting workspace/region. |
| Solutions/MenloSecurity/Data/Solution_MenloSecurity.json | Solution manifest used by Sentinel solution infrastructure. |
| Solutions/MenloSecurity/Data Connectors/createUiDefinition_MenloSecurity_API_FunctionApp.json | “Deploy to Azure” UI for deploying connector resources. |
| Solutions/MenloSecurity/Data Connectors/azuredeploy_MenloSecurity_API_FunctionApp.json | Main ARM template deploying Functions, DCE/DCR, tables, and RBAC. |
| Solutions/MenloSecurity/Data Connectors/MenloSecurity.json | GenericUI data connector definition surfaced in Sentinel. |
| .script/tests/KqlvalidationsTests/CustomTables/MenloWeb_CL.json | Adds schema for MenloWeb_CL table validation. |
| .script/tests/KqlvalidationsTests/CustomTables/MenloBandwidth_CL.json | Adds schema for MenloBandwidth_CL table validation. |
| .script/tests/KqlvalidationsTests/CustomTables/MenloAudit_CL.json | Adds schema for MenloAudit_CL table validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ||
| |-------------|--------------------------------|---------------------------| | ||
| | 3.0.0 | 21-08-2026 | Initial solution release. Adds the **Menlo Security** data connector, which ingests Audit, Bandwidth, and Web proxy logs into the `MenloAudit_CL`, `MenloBandwidth_CL`, and `MenloWeb_CL` custom Log Analytics tables via three timer-triggered Azure Functions and the Azure Monitor Logs Ingestion API (DCE/DCR). | |
| ### Verifying ingestion | ||
|
|
||
| After enabling at least one log type, wait 5–10 minutes for the first data to appear, then run in Microsoft Sentinel **Logs**: | ||
|
|
| "type": "Microsoft.Authorization/roleAssignments", | ||
| "apiVersion": "2022-04-01", | ||
| "scope": "[format('Microsoft.Insights/dataCollectionRules/{0}', variables('dcrName'))]", | ||
| "name": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', variables('dcrName')), resourceId('Microsoft.Web/sites', variables('functionAppName')), 'MonitoringMetricsPublisher')]", |
| "siteConfig": { | ||
| "ipSecurityRestrictions": [ | ||
| { | ||
| "action": "Deny", | ||
| "priority": 100, | ||
| "name": "DenyAll", | ||
| "ipAddress": "Any" | ||
| } | ||
| ], | ||
| "scmIpSecurityRestrictionsUseMain": false, |
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "tx_bytes", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "cumulative_bytes", | ||
| "type": "int" | ||
| }, | ||
| { | ||
| "name": "sum_bytes", | ||
| "type": "int" |
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", | ||
| "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", | ||
| "providerDisplayName": "Keys", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "action": true | ||
| } | ||
| } |
|
We are putting your PR on hold because your solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com to discuss available options. Thanks! |
|
Hi v-maheshbh (@v-maheshbh), We evaluated CCF RestApiPoller (incl. POST bodies and pagingInfoPlacement: RequestBody). Menlo's Log Fetch API paginates with a multi-field pagingIdentifiers object echoed back in the POST body, and terminates on a last_iteration=true flag while still returning that cursor on the final page. CCF's NextPageToken/PersistentToken model a single scalar cursor and offer only a has-next flag (no negation / no "stop on last-page" semantics), so neither the object cursor nor the termination condition is expressible. This is why we implemented the connector as an Azure Function. If there's a supported way to round-trip an object cursor and invert the stop condition, we're glad to reconsider. |
Change(s):
Solutions/MenloSecurity/.MenloAudit_CL,MenloBandwidth_CL, andMenloWeb_CL.azuredeploy_MenloSecurity_API_FunctionApp.json(with a "Deploy to Azure" button + createUiDefinition wizard that auto-derives the workspace region), the function code zip,SolutionMetadata.json,ReleaseNotes.md,README.md, and the V3-tool-generatedPackage/.Reason for Change(s):
Version Updated:
Testing Completed:
IDs Should Be Derived From ResourceIDs/contentProductIdexception common to all Sentinel solutions) andaz deployment group validate. Performed an end-to-end deployment into a test Microsoft Sentinel workspace: infrastructure deploys, function code is delivered via the deployment script, the three custom tables are created, and the DCE/DCR are wired using a system-assigned managed identity with least-privilege RBAC. Verified cross-region behavior (connector resources co-locate with the selected workspace via the createUiDefinition wizard).Checked that the validations are passing and have addressed any issues that are present: