Add ThinkstCanary Solution

[Jay (jayjb)]

Change(s):

• Added Thinkst Canary solution with data connector and an analytic rule.

Reason for Change(s):

• New solution for Thinkst Canary integration with Microsoft Sentinel.

Version updated:

• Yes — 1.0.0

Testing Completed:

• Yes — deployed mainTemplate.json to dev workspace, confirmed data ingestion in ThinkstCanaryIncidents_CL, analytic rules active.

Checked that the validations are passing and have addressed any issues that are present:

• Yes — ran local validation suite, all checks pass.

[Jay (jayjb)]

@microsoft-github-policy-service agree company="Thinkst Canary"

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Microsoft Sentinel solution package for Thinkst Canary, including a Codeless Connector Framework (CCF) data connector and an analytics rule template to create incidents from ingested Canary alerts.

Changes:

• Introduces Thinkst Canary solution metadata, release notes, and installer UI definition.
• Adds ARM/CCF artifacts for the connector (table, DCR, polling config, connector definition) and a packaged mainTemplate.json.
• Adds an NRT analytic rule template plus repository validation updates (valid connector IDs + custom table schema for KQL validation).

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
Solutions/ThinkstCanary/SolutionMetadata.json	Declares solution identity, publisher/support info, and marketplace metadata.
Solutions/ThinkstCanary/ReleaseNotes.md	Adds initial release notes entry for v1.0.0.
Solutions/ThinkstCanary/Package/testParameters.json	Provides ARM test parameters for validating the solution package deployment.
Solutions/ThinkstCanary/Package/mainTemplate.json	Main solution deployment template (content package + connector + analytic rule template).
Solutions/ThinkstCanary/Package/createUiDefinition.json	Installer UX for selecting workspace and describing included content.
Solutions/ThinkstCanary/Data/Solution_ThinkstCanary.json	Solution manifest wiring together connector + analytic rule + metadata.
Solutions/ThinkstCanary/Data Connectors/ThinkstCanaryLogs_ccp/ThinkstCanary_Table.json	Custom table resource definition for Thinkst Canary incidents.
Solutions/ThinkstCanary/Data Connectors/ThinkstCanaryLogs_ccp/ThinkstCanary_PollingConfig.json	RestApiPoller configuration (endpoint, auth header, paging, schedule).
Solutions/ThinkstCanary/Data Connectors/ThinkstCanaryLogs_ccp/ThinkstCanary_DCR.json	Data Collection Rule mapping raw API payload to the custom table schema.
Solutions/ThinkstCanary/Data Connectors/ThinkstCanaryLogs_ccp/ThinkstCanary_ConnectorDefinition.json	Connector UI definition + required permissions/instructions.
Solutions/ThinkstCanary/Data Connectors/ThinkstCanaryLogs_ccp/ThinkstCanary_ArmTemplate.json	ARM template packaging the connector assets for CCF deployment.
Solutions/ThinkstCanary/Analytic Rules/SentinelIncidentsFromThinkstCanaryAlerts.yaml	Adds NRT analytic rule template to create incidents from Canary events.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Registers ThinkstCanary as a valid connectorId for detections schema tests.
.script/tests/KqlvalidationsTests/CustomTables/ThinkstCanaryIncidents_CL.json	Adds custom table schema for KQL validation tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jay (jayjb)]

Hi v-atulyadav, v-maheshbh (@v-maheshbh)

Please let me know if there is anything more you need from me.

Thank you

[v-atulyadav]

Hi Jay (@jayjb),
Please review the points below and take the necessary action:

1. The analytical rule is missing the relevantTechniques for the respective tactics used in the rule.

2. The release note version should be 3.0.0 instead of 1.0.0. Also, the date column header and value format are incorrect.

Please refer to the example below and update them accordingly.

3. Please confirm whether the publisherId is correct?

4. While deploying the mainTemplate, the error below is occurring. Please investigate and rectify the issue accordingly.

5. After addressing all the suggested changes, please repackage the solution again.
6. Please share a screenshot showing the connector running successfully.

Thank you

[v-atulyadav]

Hi Jay (@jayjb),
Please review the comments above and take the necessary action accordingly. Thanks