SynqlyIntegrationConnector 3.0.1: add new ASIM tables and alert rule for converting ASIM Alert events

[Luke Woodward (lkwdwrd)]

Change(s):

• Expand the Synqly Integration Connector from 10 to 13 ASIM schema types, adding AgentEvent, AlertEvent, and Asset.
• DCR now projects an explicit column list per target table.
• Add the solution's first analytic rule template, "Synqly Alert Event" (optional; the customer creates it from the template).
• Add ASimAlertEventLogs to .script/tests/KqlvalidationsTests/CustomTables/.
• Add SynqlyIntegrationConnector to ValidConnectorIds.json.
• Bump to 3.0.1 and repackage with the V3 tool.

Reason for Change(s):

• Synqly integrations now emit agent, alert, and asset records, which had no route into Sentinel.
• The explicit DCR projections stop us sending fields that do not exist in a target table.
• The two files under .script/ are needed for CI, not for the solution: ASimAlertEventLogs is a built-in Microsoft table that the KQL validator does not know (it is absent from both the bundled KustoServices package and CustomTables/), so the new rule cannot be validated without its schema. The connector ID addition is what the connector-ID test error message instructs contributors to do.

Version Updated:

• Yes. Solution 3.0.1. The analytic rule is new, at version 1.0.0.

Testing Completed:

• Yes. KQL validation run against the rule using the repo's own analyzer and the pinned KustoServices 7.1.0 package: passes.
• All 13 DCR projections verified against the live ASIM table schemas in a test workspace: every projected column exists in its destination table, no type mismatches.
• Package regenerated with Tools/Create-Azure-Sentinel-Solution/V3 and verified consistent with the connector, DCR, and rule source files.

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Synqly Integration Connector solution to v3.0.1 by expanding ASIM coverage (10 → 13 schema types) and adding an optional analytics rule template that promotes ASIM Alert Events into Sentinel alerts.

Changes:

• Added support for ASimAgentEventLogs, ASimAlertEventLogs, and ASimAssetEntityLogs across solution metadata, connector definition, and DCR transforms.
• Updated DCR transforms to project explicit destination column lists for each ASIM target table.
• Introduced a new scheduled analytics rule template (“Synqly Alert Event”) and added CI support files for KQL validation.

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Solutions/SynqlyIntegrationConnector/SolutionMetadata.json	Updates solution publish metadata date for v3.0.1 release.
Solutions/SynqlyIntegrationConnector/ReleaseNotes.md	Adds 3.0.1 release entry describing new schemas + rule template.
Solutions/SynqlyIntegrationConnector/Package/createUiDefinition.json	Updates installer UX text and adds an Analytics blade describing the new rule template.
Solutions/SynqlyIntegrationConnector/Data/Solution_Synqly.json	Bumps solution version to 3.0.1 and references the new analytic rule.
Solutions/SynqlyIntegrationConnector/Data Connectors/SynqlyIntegrationConnector_CCF/SynqlyIntegrationConnector_DCR.json	Adds new columns and explicit project lists; routes AgentEvent/AlertEvent/Asset to ASIM tables.
Solutions/SynqlyIntegrationConnector/Data Connectors/SynqlyIntegrationConnector_CCF/SynqlyIntegrationConnector_ConnectorDefinition.json	Updates description, queries, and dataTypes to include new ASIM tables and optional analytics guidance.
Solutions/SynqlyIntegrationConnector/Analytic Rules/SynqlyAlertEventToSentinelAlert.yaml	Adds a new scheduled analytic rule template converting ASIM Alert Events into Sentinel alerts.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Adds SynqlyIntegrationConnector to allow rule schema validation in CI.
.script/tests/KqlvalidationsTests/CustomTables/ASimAlertEventLogs.json	Adds ASimAlertEventLogs schema for CI KQL validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-maheshbh (v-maheshbh)]

Hi Luke Woodward (@lkwdwrd)

Copilot review comments have been added. Kindly validate and address the relevant feedback.

Kindly attach a screenshot showing the CCF connector in a connected state for verification.

Thanks!

[Luke Woodward (lkwdwrd)]

Hi Luke Woodward (Luke Woodward (@lkwdwrd))

Copilot review comments have been added. Kindly validate and address the relevant feedback.

Kindly attach a screenshot showing the CCF connector in a connected state for verification.

Thanks!

After evaluating the comments from Copilot, none of the feedback was directly actionable, all rationale was provided in-line. Here is the screenshot of the connector:

Thank you!

[v-maheshbh (v-maheshbh)]

Hi Luke Woodward (@lkwdwrd)

tactics and relevantTechniques are currently empty. Please map the rule to the appropriate MITRE ATT&CK tactics and techniques based on the detection logic. This helps provide proper threat context and aligns with Sentinel content requirements.

Thanks!

[Luke Woodward (lkwdwrd)]

Hi Luke Woodward (Luke Woodward (@lkwdwrd))

tactics and relevantTechniques are currently empty. Please map the rule to the appropriate MITRE ATT&CK tactics and techniques based on the detection logic. This helps provide proper threat context and aligns with Sentinel content requirements.

Thanks!

Because this rule is promoting items written by the connector to the ASIM AlertEvent table, there are no specific tactics or techniques that can be embedded in the rule itself -- they are unknown until processing the event that was written. This is why they are empty. As mentioned in #14987 (comment) -- we heavily tested the dynamic addition of tactics and techniques. Tactics properly populate, however techniques fail to populate as documented. The main idea, though, is this is not a rule for a specific detection, it's a rule to promote specific alerts that came in directly through the built-in ASIM tables (this rule targets Synqly written events only).