Repository navigation
Migrate 10 solutions to Defender XDR Custom Detections and Workbooks (V3.1) - #15372
Draft
Alon Karmona (alon-karmona1) wants to merge 5 commits into
Draft
Alon Karmona (alon-karmona1) wants to merge 5 commits into
Alon Karmona (alon-karmona1) wants to merge 5 commits into
Conversation
This was referenced Oct 20, 2026
Closed
Alon Karmona (alon-karmona1)
changed the title
Alon Karmona (alon-karmona1)
marked this pull request as draft
October 20, 2026 20:09
v-atulyadav
added
Solution
Ofer Inbar (oferInbar)
added
1P Solution
…ns and workbooks (V3.1) - CrowdStrike Falcon Endpoint Protection (3.4.4) - GoogleCloudPlatformIAM (3.2.2) - Malware Protection Essentials (3.2.2) - QualysVM (3.2.2) - Salesforce Service Cloud (3.7.2) - Snowflake (3.2.2) - Sophos XG Firewall (3.2.2) - Ubiquiti UniFi (3.2.2) - Windows Server DNS (3.2.2) - Zscaler Private Access (ZPA) (3.2.2) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e
Alon Karmona (alon-karmona1)
force-pushed
the
content/xdr-migration-batch1
branch
from
October 21, 2026 21:09
ba0efde to
d42f2b9
Compare
…repackage V3.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e
github-actions
Bot
added
the
Qualification
… WB) live qualification evidence Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e
…phos, CrowdStrike) Custom Detections and Defender workbooks cannot resolve Sentinel workspace functions (CD enable returns 400; portal query executor returns 400), so the parser is inlined. Verified live: row/alert parity, 100% HTTP 200 on the portal query executor, ARM redeploy and readback. Sophos XG Firewall: Validated / Qualified / Migration Verified. CrowdStrike Falcon Endpoint Protection: Partially Validated / Conditionally Qualified / Conditionally Migrated, with evidence-backed author waivers (Evidence/waivers.json) for platform and toolkit gaps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ebb616b-a5a2-4558-8204-0f1fa54437c2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Migrate 10 Microsoft Sentinel Content Hub solutions to include Microsoft Defender XDR Custom Detections (
XDR Detections/*.yaml), XDR Workbooks (XDR Workbooks/*.json), qualification evidence bundles (Evidence/), updated solution metadata/release notes, and V3.1 solution packages (Package/):3.4.4) — 2 XDR Detections, 1 XDR Workbook (CrowdStrikeFalconEndpointProtection.json), V3.1 package, qualification evidence3.2.2) — 10 XDR Detections, 1 XDR Workbook (GCP_IAM.json), V3.1 package, qualification evidence3.2.2) — 6 XDR Detections, 1 XDR Workbook (MalwareProtectionEssentialsWorkbook.json), V3.1 package, qualification evidence3.2.2) — 2 XDR Detections, 1 XDR Workbook (QualysVMv2.json), V3.1 package, qualification evidence3.7.2) — 3 XDR Detections, 1 XDR Workbook (SalesforceServiceCloud.json), V3.1 package, qualification evidence3.2.2) — 10 XDR Detections, 1 XDR Workbook (Snowflake.json), V3.1 package, qualification evidence3.2.2) — 2 XDR Detections, 1 XDR Workbook (SophosXGFirewall.json), V3.1 package, qualification evidence3.2.2) — 10 XDR Detections, 1 XDR Workbook (Ubiquiti.json), V3.1 package, qualification evidence3.2.2) — 5 XDR Detections, 1 XDR Workbook (Dns.json), V3.1 package, qualification evidence3.2.2) — 10 XDR Detections, 1 XDR Workbook (ZscalerZPA.json), V3.1 package, qualification evidencePartner Center Publishing Readiness & Recommended Rollout Order (1 → 10)
Tier 1 — Fully Working & Ready for Partner Center (10/10 Solutions, Ordered Easiest → Most Complex)
3.2.2SecurityEventtable only; 0 custom parsers, 0_CLtables, 0 legacy AR edits.3.4.4CommonSecurityLog; 0 custom parsers, 0 legacy AR edits.3.7.2SalesforceServiceCloud_CLdirectly; 0 custom parsers.3.2.2DnsEvents/DnsInventory; 0 custom parsers, 0 legacy AR edits.3.2.2GCP_IAM); 0 legacy AR edits.3.2.2UbiquitiAuditEvent); 0 legacy AR edits.3.2.2Snowflake) over custom_CLschema; 0 legacy AR edits.3.2.2ZPA_Event) +datatypes→dataTypesschema fix & patch version bump on 10 legacy ARs.Qualification Details for Newly Remediated Solutions (#9–#10)
3.2.2QualysVMv2.json)68 PASS / 7 FAIL;2/2AR/CD row parity;14/14WB queries returned rows on both Sentinel and Defender XDR; UI, URL, and deployment readback verification passed after remediation.3.2.2SophosXGFirewall.json)68 PASS / 5 FAIL;2/2AR/CD row parity;10/10WB queries returned rows on both Sentinel and Defender XDR; UI, URL, and deployment readback verification passed after remediation.Reason for Change(s):
Enable hybrid Microsoft Sentinel and Microsoft Defender XDR deployment for these 10 Content Hub solutions using the V3.1 packaging format (
package-v3-1) and provide complete qualification evidence bundles (Evidence/) aligned with the Sentinel-to-Defender-XDR migration workflow.Version Updated:
Yes
Testing Completed:
Yes — validated and qualified across all 10 solutions:
pwsh -NoProfile -File .script/local-validation/build-and-validate.ps1 -SolutionName "<Solution>"— passed packaging/structural validation across all 10 solutions (29/29 GitHub CI checks passing).python -m sentinel_xdr_converter validate --solution-folder "Solutions/<Solution>" --validation-mode structural --validation-mode sentinel-kql --validation-mode xdr— passed structural and Sentinel SDK validation across all 10 solutions; all 10 solutions have now been remediated and verified for live qualification on both surfaces (QualysVM: 68 PASS / 7 FAIL, 2/2 AR/CD parity, 14/14 WB queries; Sophos XG Firewall: 68 PASS / 5 FAIL, 2/2 AR/CD parity, 10/10 WB queries).python -m sentinel_xdr_converter package-v3-1 --solution-folder "Solutions/<Solution>"— passed V3.1 hybrid packaging across all 10 solutions.python -m sentinel_xdr_converter pr-qualify --solution-folder "Solutions/<Solution>" --mode full --is-migration— executed end-to-end qualification checks, ARM + Graph deployment readbacks (all Analytic Rules and Custom Detections verified disabled at rest), URL/SVG asset verification, and portal UI traversal checks across all 10 solutions.Checked that the validations are passing and have addressed any issues that are present:
Yes