Migrate 10 solutions to Defender XDR Custom Detections and Workbooks (V3.1) by alon-karmona1 · Pull Request #15372 · Azure/Azure-Sentinel

Alon Karmona (alon-karmona1) · 2026-10-20T17:50:11Z

Change(s):

Migrate 10 Microsoft Sentinel Content Hub solutions to include Microsoft Defender XDR Custom Detections (XDR Detections/*.yaml), XDR Workbooks (XDR Workbooks/*.json), qualification evidence bundles (Evidence/), updated solution metadata/release notes, and V3.1 solution packages (Package/):

CrowdStrike Falcon Endpoint Protection (3.4.4) — 2 XDR Detections, 1 XDR Workbook (CrowdStrikeFalconEndpointProtection.json), V3.1 package, qualification evidence
GoogleCloudPlatformIAM (3.2.2) — 10 XDR Detections, 1 XDR Workbook (GCP_IAM.json), V3.1 package, qualification evidence
Malware Protection Essentials (3.2.2) — 6 XDR Detections, 1 XDR Workbook (MalwareProtectionEssentialsWorkbook.json), V3.1 package, qualification evidence
QualysVM (3.2.2) — 2 XDR Detections, 1 XDR Workbook (QualysVMv2.json), V3.1 package, qualification evidence
Salesforce Service Cloud (3.7.2) — 3 XDR Detections, 1 XDR Workbook (SalesforceServiceCloud.json), V3.1 package, qualification evidence
Snowflake (3.2.2) — 10 XDR Detections, 1 XDR Workbook (Snowflake.json), V3.1 package, qualification evidence
Sophos XG Firewall (3.2.2) — 2 XDR Detections, 1 XDR Workbook (SophosXGFirewall.json), V3.1 package, qualification evidence
Ubiquiti UniFi (3.2.2) — 10 XDR Detections, 1 XDR Workbook (Ubiquiti.json), V3.1 package, qualification evidence
Windows Server DNS (3.2.2) — 5 XDR Detections, 1 XDR Workbook (Dns.json), V3.1 package, qualification evidence
Zscaler Private Access (ZPA) (3.2.2) — 10 XDR Detections, 1 XDR Workbook (ZscalerZPA.json), V3.1 package, qualification evidence

Partner Center Publishing Readiness & Qualification Status

Guidance for the Partner Center Publishing Team:

All 10 of 10 solutions (add cscript summary hunting query #1–example function - perform baselining #10 below) are fully remediated at 0 FAIL (Qualified / Conditionally Qualified) and ready for Partner Center publishing — with inlined workspace/ASIM parsers (let ... = view() { ... };), V3.1 packaging, ARM & Graph deployment readbacks, live AR/CD row & alert parity, XDR Workbook query verification, and Playwright UI verification completed.

All 10/10 Solutions — Remediated & Qualified (`0 FAIL`, Ready for Partner Center)

Order	Solution	Target Version	Content Scope	Remediation & Parser Details	Qualification Verdict & Check Summary
1	Sophos XG Firewall	`3.2.2`	2 CDs, 1 XDR WB (`SophosXGFirewall.json`)	Inlined `SophosXGFirewall` parser into 2 CDs & XDR WB; repackaged `3.2.2`; 2/2 AR/CD parity & 10/10 WB queries verified live.	✅ Qualified (`0 FAIL`) — `73 PASS / 0 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
2	CrowdStrike Falcon Endpoint Protection	`3.4.4`	2 CDs, 1 XDR WB (`CrowdStrikeFalconEndpointProtection.json`)	Standard `CommonSecurityLog` detections & XDR WB; repackaged `3.4.4`; 2/2 AR/CD parity & WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `69 PASS / 6 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
3	QualysVM	`3.2.2`	2 CDs, 1 XDR WB (`QualysVMv2.json`)	Inlined `QualysHostDetection` parser into 2 CDs & 14 XDR WB queries; repackaged `3.2.2`; 2/2 AR/CD parity & 14/14 WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `74 PASS / 1 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
4	Salesforce Service Cloud	`3.7.2`	3 CDs, 1 XDR WB (`SalesforceServiceCloud.json`)	Inlined `SalesforceServiceCloud` parser into XDR WB queries & 3 CDs; repackaged `3.7.2`; 3/3 AR/CD parity & 12/12 WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `69 PASS / 4 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
5	GoogleCloudPlatformIAM	`3.2.2`	10 CDs, 1 XDR WB (`GCP_IAM.json`)	Inlined `XdrInlineGCPIAM` parser into all 10 CDs, fixed `GCP_IAM.json` workbook icon, repackaged `3.2.2`; 10/10 AR/CD parity & 14/14 WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `71 PASS / 4 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
6	Malware Protection Essentials	`3.2.2`	6 CDs, 1 XDR WB (`MalwareProtectionEssentialsWorkbook.json`)	Inlined `XdrInlineASimProcessEvent` (2 CDs) and `XdrInlineASimRegistryEvent` (4 CDs), repackaged `3.2.2`; 6/6 AR/CD parity & WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `63 PASS / 4 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
7	Ubiquiti UniFi	`3.2.2`	10 CDs, 1 XDR WB (`Ubiquiti.json`)	Inlined `UbiquitiAuditEvent` parser into 10 CDs & 10 XDR WB queries; repackaged `3.2.2`; 10/10 AR/CD parity, 10/10 WB queries & 3/3 DC queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `63 PASS / 10 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
8	Windows Server DNS	`3.2.2`	5 CDs, 1 XDR WB (`Dns.json`)	Added 23-row `DnsEvents_mock.json` sample dataset; repackaged `3.2.2`; 5/5 AR/CD parity & 13/13 WB queries verified live (`Validated`).	✅ Conditionally Qualified (`0 FAIL`) — `61 PASS / 9 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
9	Zscaler Private Access (ZPA)	`3.2.2`	10 CDs, 1 XDR WB (`ZscalerZPA.json`)	Inlined `ZPAEvent` parser into 10 CDs & 9 XDR WB queries; repackaged `3.2.2`; 10/10 AR/CD parity, 9/9 WB queries & 4/4 DC queries verified live (`Validated`).	✅ Conditionally Qualified (`0 FAIL`) — `65 PASS / 8 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`
10	Snowflake	`3.2.2`	10 CDs, 1 XDR WB (`Snowflake.json`)	Inlined `SnowflakeEvents` parser into 10 CDs & 13 XDR WB queries; repackaged `3.2.2`; 10/10 AR/CD parity & 13/13 WB queries verified live.	✅ Conditionally Qualified (`0 FAIL`) — `62 PASS / 11 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL`

Reason for Change(s):

Enable hybrid Microsoft Sentinel and Microsoft Defender XDR deployment for these 10 Content Hub solutions using the V3.1 packaging format (package-v3-1) and provide complete qualification evidence bundles (Evidence/) aligned with the Sentinel-to-Defender-XDR migration workflow.

Version Updated:

Yes

Testing Completed:

Yes — validated and qualified across all 10 solutions (10/10 at 0 FAIL):

pwsh -NoProfile -File .script/local-validation/build-and-validate.ps1 -SolutionName "<Solution>" — passed packaging/structural validation across all 10 solutions.
sentinel-xdr-migration pr-qualify --solution "Solutions/<Solution>" --mode full --is-migration — all 10/10 solutions verified at 0 FAIL (Sophos XG Firewall, CrowdStrike Falcon Endpoint Protection, QualysVM, Salesforce Service Cloud, GoogleCloudPlatformIAM, Malware Protection Essentials, Ubiquiti UniFi, Windows Server DNS, Zscaler Private Access (ZPA), Snowflake).

Checked that the validations are passing and have addressed any issues that are present:

Yes

…ns and workbooks (V3.1) - CrowdStrike Falcon Endpoint Protection (3.4.4) - GoogleCloudPlatformIAM (3.2.2) - Malware Protection Essentials (3.2.2) - QualysVM (3.2.2) - Salesforce Service Cloud (3.7.2) - Snowflake (3.2.2) - Sophos XG Firewall (3.2.2) - Ubiquiti UniFi (3.2.2) - Windows Server DNS (3.2.2) - Zscaler Private Access (ZPA) (3.2.2) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e

…repackage V3.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e

… WB) live qualification evidence Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e

…tion-batch1

…phos, CrowdStrike) Custom Detections and Defender workbooks cannot resolve Sentinel workspace functions (CD enable returns 400; portal query executor returns 400), so the parser is inlined. Verified live: row/alert parity, 100% HTTP 200 on the portal query executor, ARM redeploy and readback. Sophos XG Firewall: Validated / Qualified / Migration Verified. CrowdStrike Falcon Endpoint Protection: Partially Validated / Conditionally Qualified / Conditionally Migrated, with evidence-backed author waivers (Evidence/waivers.json) for platform and toolkit gaps. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ebb616b-a5a2-4558-8204-0f1fa54437c2

…alysVM, Salesforce Service Cloud) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8223a71f-8c93-4e25-8f91-95479c961b0c

…ogleCloudPlatformIAM, Malware Protection Essentials) - GoogleCloudPlatformIAM: inline XdrInlineGCPIAM parser into all 10 XDR Detections, fix broken icon in GCP_IAM.json workbook, repackage 3.2.2, and complete live lab qualification (71 PASS / 4 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL) - Malware Protection Essentials: inline XdrInlineASimProcessEvent and XdrInlineASimRegistryEvent views into all 6 XDR Detections, repackage 3.2.2, and complete qualification (63 PASS / 4 WAIVED / 4 HUMAN_REVIEW_REQUIRED / 0 FAIL) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8223a71f-8c93-4e25-8f91-95479c961b0c

… FAIL - Ubiquiti UniFi: inline UbiquitiAuditEvent parser into 10 XDR Detections and Ubiquiti.json workbook, refresh SHA-256 provenance, repackage V3.1 (3.2.2), redeploy ARM & verify live LA/AH runtime parity, and document 10 pre-existing waivers (63 PASS / 10 WAIVED / 0 FAIL, Conditionally Qualified). - Windows Server DNS: add 23-row DnsEvents_mock.json sample dataset, execute live ARM redeploy and LA/AH detection (5/5) + workbook (13/13) runtime verification, refresh Evidence receipts, and document 9 pre-existing waivers (61 PASS / 9 WAIVED / 0 FAIL, Conditionally Qualified, Validated). - Zscaler Private Access (ZPA): inline ZPAEvent parser into 10 XDR Detections and ZscalerZPA.json workbook, refresh provenance, repackage V3.1 (3.2.2), redeploy ARM & PATCH 10 live Graph detectionRules, verify 10/10 rule parity + 9/9 workbook queries + 4/4 connector queries on LA/AH, and document 8 pre-existing waivers (65 PASS / 8 WAIVED / 0 FAIL, Conditionally Qualified, Validated). - Snowflake: inline compact SnowflakeEvents parser into 10 XDR Detections and Snowflake.json workbook (13 queries), refresh provenance, repackage V3.1 (3.2.2), redeploy ARM & verify live LA/AH runtime parity, acknowledge 23 unmodified Data Connectors, and document 11 pre-existing waivers (62 PASS / 11 WAIVED / 0 FAIL, Conditionally Qualified). All 10/10 solutions in Batch 1 now pass PR qualification with 0 FAIL. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e09bc79-f2bd-4c4c-9ad3-8be4ea750ef4

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 19313cc7-ccea-4b93-987e-d499d1baf5a6

Alon Karmona (alon-karmona1) · 2026-10-26T14:46:25Z

Hi v-atulyadav — rebased with latest master, marked Ready for Review, and verified all 10 solutions' ARM-TTK, SolutionValidations, DetectionsValidations, WorkbooksTemplateValidations, KqlValidations, and PR qualification evidence (Evidence/pr-qualification/) are green. Ready for review whenever you have a moment. Thanks!

Copilot

🟡 Changes recommended

One or more issues must be addressed before approval.

8 open issues

What changed in this PR

Extends ten Content Hub solutions for hybrid Microsoft Sentinel and Defender XDR deployment using V3.1 packaging.

Changes:

Registers XDR detections/workbooks and updates attribution, versions, and release notes.
Adds Windows DNS Custom Detection payloads and corrects selected Sentinel rule/workbook fields.
Adds qualification receipts, decision manifests, waivers, and reviewer guides.

Review findings concern outdated qualification evidence, contradictory reviewer guidance, and parity claims unsupported by the committed receipts. Generated Package/ and Data Connectors/ changes were excluded from review.

File	Description
Solutions/Zscaler Private Access (ZPA)/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Package/testParameters.json	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Data/Solution_Zscaler Private Access (ZPA).json	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAUnexpectedSessionDuration.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsOutsideOperationalHours.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewIP.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewCountry.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByNewUser.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsByDormantUser.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedUpdateOperation.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountries.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerUnexpectedCountEventResult.yaml	Updated as part of this pull request.
Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerSharedZPASession.yaml	Updated as part of this pull request.
Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml	Updated as part of this pull request.
Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml	Updated as part of this pull request.
Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml	Updated as part of this pull request.
Solutions/Windows Server DNS/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Windows Server DNS/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Windows Server DNS/Package/testParameters.json	Updated as part of this pull request.
Solutions/Windows Server DNS/Evidence/README.md	Updated as part of this pull request.
Solutions/Windows Server DNS/Data/Solution_DNS.json	Updated as part of this pull request.
Solutions/Ubiquiti UniFi/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Ubiquiti UniFi/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Ubiquiti UniFi/Package/testParameters.json	Updated as part of this pull request.
Solutions/Ubiquiti UniFi/Data/Solution_Ubiquiti UniFi.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Package/testParameters.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Evidence/receipts/graph-detection-deployment.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Evidence/README.md	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Evidence/decision-manifest.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Data/Solution_SophosXGFirewall.json	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Analytic Rules/PortScanDetected.yaml	Updated as part of this pull request.
Solutions/Sophos XG Firewall/Analytic Rules/ExcessiveAmountofDeniedConnectionsfromASingleSource.yaml	Updated as part of this pull request.
Solutions/Snowflake/Workbooks/Snowflake.json	Updated as part of this pull request.
Solutions/Snowflake/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Snowflake/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Snowflake/Package/testParameters.json	Updated as part of this pull request.
Solutions/Snowflake/Data/Solution_Snowflake.json	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/Package/testParameters.json	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/Evidence/waivers.json	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/Evidence/README.md	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json	Updated as part of this pull request.
Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml	Updated as part of this pull request.
Solutions/QualysVM/SolutionMetadata.json	Updated as part of this pull request.
Solutions/QualysVM/ReleaseNotes.md	Updated as part of this pull request.
Solutions/QualysVM/Package/testParameters.json	Updated as part of this pull request.
Solutions/QualysVM/Evidence/waivers.json	Updated as part of this pull request.
Solutions/QualysVM/Evidence/receipts/graph-detection-deployment.json	Updated as part of this pull request.
Solutions/QualysVM/Evidence/README.md	Updated as part of this pull request.
Solutions/QualysVM/Evidence/decision-manifest.json	Updated as part of this pull request.
Solutions/QualysVM/data/Solution_QualysVM.json	Updated as part of this pull request.
Solutions/QualysVM/Data Connectors/QualysVM_API_FunctionApp.json	Updated as part of this pull request.
Solutions/QualysVM/Analytic Rules/NewHighSeverityVulnDetectedAcrossMulitpleHostsV2.yaml	Updated as part of this pull request.
Solutions/Malware Protection Essentials/SolutionMetadata.json	Updated as part of this pull request.
Solutions/Malware Protection Essentials/ReleaseNotes.md	Updated as part of this pull request.
Solutions/Malware Protection Essentials/Package/testParameters.json	Updated as part of this pull request.
Solutions/Malware Protection Essentials/Evidence/waivers.json	Updated as part of this pull request.
Solutions/Malware Protection Essentials/Evidence/README.md	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Workbooks/GCP_IAM.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/SolutionMetadata.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/ReleaseNotes.md	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Playbooks/GCP_IAMConnector/azuredeploy.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Package/testParameters.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Evidence/waivers.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Evidence/README.md	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Data/Solution_GoogleCloudPlatformIAM.json	Updated as part of this pull request.
Solutions/GoogleCloudPlatformIAM/Data Connectors/GCP_IAM_API_FunctionApp.json	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/Evidence/receipts/graph-detection-deployment.json	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/Evidence/README.md	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json	Updated as part of this pull request.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeReplicatorCLv2/CSFDRv2_Deploymnet/createUiDefinition_csfdrv2_connector.json	Updated as part of this pull request.

_{Review effort: Balanced}

v-sabiraj · 2026-10-27T18:06:30Z

+      // SophosXGFirewall parser inlined: Defender XDR Custom Detections cannot be enabled when the query calls a workspace function.
+      Syslog
+      | where Facility == "local0"
+      | where CollectorHostName in (forwarder_host_names) or Computer in (forwarder_host_names)


Alon Karmona (@alon-karmona1) , the rule query filter Syslog against the literal hostname1/hostname2 placeholders, while the parser also accepts hosts configured through the ASimSourceType watchlist? Should the query include a filter for those hosts as well?

In Defender XDR Custom Detections, Sentinel workspace functions such as _GetWatchlist('ASimSourceType') are not supported by the Advanced Hunting / Graph /beta/security/rules/detectionRules validator (referencing _GetWatchlist causes rule creation/activation with isEnabled: true to fail with HTTP 400 BadRequest). Per the XDR migration pattern, the SophosXGFirewall parser is inlined using let forwarder_host_names = dynamic([]); so the detection compiles and runs natively in Defender XDR.

v-sabiraj · 2026-10-27T18:09:36Z

+    {
+      "type": 1,
+      "content": {
+        "json": "\r\n|File|Process|Registry|\r\n|------|-------|----|\r\n|Files Created in Startup Folders|List of Suspicious Processes Created with Base64 CommandLine Argumnet|Startup Registry Creation/Moification|\r\n|Top 10 Hosts where Files Created in Startup Folders|Top 10 Devices with Suspicious Process|Top 10 Devices with Most Startup Registry Modification|\r\n|Top 10 Accounts to Create Files in Startup Folders|Top 10 Processes with Suspicious CommandLine|Top 10 Users with Most Startup Registry Modification|\r\n|List of Scheduled Task Created with Encoded Command|List of Backup Deletion Acitivties using LOL Binaries|Windows Update Disabled Devices|\r\n|Top 10 Processes Creating Scheduled Task with Encoded Command|Top 10 Devices with Most Backup Deletion Activity|Windows Firewall Allow Rule Addition Events|\r\n|Top 10 Users Creating Scheduled Task with Encoded Command|List of Processes Started from Unusual Locations|Top 10 Devices with Most Windows Firewall Allow Rule Addition|\r\n||Top 10 Devices where Processes Started from Unusual Locations|Top 10 Users to add Windows Firewall Allow Rule|"


Alon Karmona (@alon-karmona1) , please fix typo from Argumnet to Argument

Fixed in commit a5d5785 (Argumnet -> Argument in workbook, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:09:49Z

+              "version": "KqlItem/1.0",
+              "query": "_ASim_ProcessEvent\r\n  | where EventType == 'ProcessCreated'\r\n  | extend CommandLineArgs = todynamic(array_slice(split(CommandLine, \" \"), 1, -1))\r\n  | where strlen(CommandLineArgs) > 0\r\n  | mv-apply CommandLineArgs on \r\n      (\r\n      where CommandLineArgs contains \"base64\"\r\n      )\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      DvcIpAddr,\r\n      DvcDomain,\r\n      TargetUsername,\r\n      TargetProcessName,\r\n      CommandLine",
+              "size": 0,
+              "title": "List of Suspicious Processes Created with Base64 CommandLine Argumnet {TimeRange}",


Alon Karmona (@alon-karmona1) , please fix typo from Argumnet to Argument

Fixed in commit a5d5785 (Argumnet -> Argument in workbook, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:11:04Z

+  detectionAction:
+    alertTemplate:
+      title: New High Severity Vulnerability Detected Across Multiple Hosts
+      description: '''This creates an incident when a new high severity vulnerability is detected across multilple hosts'''


Fix typo multilple to multiple

Fixed in commit a5d5785 (multilple -> multiple in XDR detection YAML, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:13:28Z

+    {
+      "type": 1,
+      "content": {
+        "json": "\r\n|File|Process|Registry|\r\n|------|-------|----|\r\n|Files Created in Startup Folders|List of Suspicious Processes Created with Base64 CommandLine Argumnet|Startup Registry Creation/Moification|\r\n|Top 10 Hosts where Files Created in Startup Folders|Top 10 Devices with Suspicious Process|Top 10 Devices with Most Startup Registry Modification|\r\n|Top 10 Accounts to Create Files in Startup Folders|Top 10 Processes with Suspicious CommandLine|Top 10 Users with Most Startup Registry Modification|\r\n|List of Scheduled Task Created with Encoded Command|List of Backup Deletion Acitivties using LOL Binaries|Windows Update Disabled Devices|\r\n|Top 10 Processes Creating Scheduled Task with Encoded Command|Top 10 Devices with Most Backup Deletion Activity|Windows Firewall Allow Rule Addition Events|\r\n|Top 10 Users Creating Scheduled Task with Encoded Command|List of Processes Started from Unusual Locations|Top 10 Devices with Most Windows Firewall Allow Rule Addition|\r\n||Top 10 Devices where Processes Started from Unusual Locations|Top 10 Users to add Windows Firewall Allow Rule|"


Fix typo from Moification to Modification

Fixed in commit a5d5785 (Moification -> Modification in workbook, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:13:40Z

+              "version": "KqlItem/1.0",
+              "query": "let startupRegistryList = dynamic([\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServicesOnce',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunServices',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit',\r\n      'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell',\r\n      'HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows'\r\n    ]);\r\n  _ASim_RegistryEvent\r\n  | where EventType in ('RegistryValueSet', 'RegistryKeyCreated') and RegistryKey has_any (startupRegistryList)\r\n  | project\r\n      TimeGenerated,\r\n      DvcHostname,\r\n      ActorUsername,\r\n      ActorUsernameType,\r\n      ActingProcessId,\r\n      ActingProcessName,\r\n      ActingProcessCommandLine,\r\n      RegistryKey,\r\n      RegistryValue,\r\n      RegistryValueType,\r\n      RegistryValueData",
+              "size": 0,
+              "title": "Startup Registry Creation/Moification {TimeRange}",


Fix typo from Moification to Modification

Fixed in commit a5d5785 (Moification -> Modification in workbook, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:15:16Z

+              "version": "KqlItem/1.0",
+              "query": "// SalesforceServiceCloud parser inlined: Defender workbooks cannot resolve Sentinel workspace functions.\nlet SalesforceServiceCloudEvents_Parser = SalesforceServiceCloud_CL\n| extend\n        RequestSize=column_ifexists('request_size_s',''),\n        ExecTime=column_ifexists('exec_time_s',''),\n        Action=column_ifexists('action_s',''),\n        PlatformType=column_ifexists('platform_type_s',''),\n        OsName=column_ifexists('os_name_s',''),\n        OsVersion=column_ifexists('os_version_s',''),\n        Timestamp=column_ifexists('timestamp_s',''),\n        StatusCode=column_ifexists('status_code_s',''),\n        EventType=column_ifexists('event_type_s',''),\n        ReferrerUri=column_ifexists('referrer_uri_s',''),\n        UserAgent=column_ifexists('user_agent_s',''),\n        BrowserType=column_ifexists('browser_type_s',''),\n        Time=column_ifexists('time_s',''),\n        ResponseSize=column_ifexists('response_size_s',''),\n        DeviceId=column_ifexists('device_id_s',''),\n        DeviceModel=column_ifexists('device_model_s',''),\n        SourceIp=column_ifexists('source_ip_s',''),\n        ClientIp=column_ifexists('client_ip_s',''),\n        Success=column_ifexists('success_s',''),\n        Uri=column_ifexists('uri_s',''),\n        Url=column_ifexists('url_s',''),\n        ClientName=column_ifexists('client_name_s',''),\n        UserType=column_ifexists('user_type_s',''),\n        UserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n        UserIdDerived=column_ifexists('user_id_derived_s',''),\n        UserId=column_ifexists('user_id_s',''),\n        UserEmail=column_ifexists('user_email_s',''),\n        User=column_ifexists('user_name_s',''),\n        UriIdDerived=column_ifexists('uri_id_derived_s',''),\n        UiEventType=column_ifexists('ui_event_type_s',''),\n        UiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n        UiEventSource=column_ifexists('ui_event_source_s',''),\n        UiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n        UiEventId=column_ifexists('ui_event_id_s',''),\n        TlsProtocol=column_ifexists('tls_protocol_s',''),\n        TimestampDerived=column_ifexists('timestamp_derived_t',''),\n        TargetUiElement=column_ifexists('target_ui_element_s',''),\n        Sort=column_ifexists('sort_s',''),\n        SessionType=column_ifexists('session_type_s',''),\n        SessionLevel=column_ifexists('session_level_s',''),\n        SessionKey=column_ifexists('session_key_s',''),\n        SearchQuery=column_ifexists('search_query_s',''),\n        SdkVersion=column_ifexists('sdk_version_s',''),\n        SdkAppVersion=column_ifexists('sdk_app_version_s',''),\n        SdkAppType=column_ifexists('sdk_app_type_s',''),\n        RunTime=column_ifexists('run_time_s',''),\n        RowsProcessed=column_ifexists('rows_processed_s',''),\n        RowCount=column_ifexists('row_count_s',''),\n        ResolutionType=column_ifexists('resolution_type_s',''),\n        RequestStatus=column_ifexists('request_status_s',''),\n        RequestId=column_ifexists('request_id_s',''),\n        ReportIdDerived=column_ifexists('report_id_derived_s',''),\n        ReportId=column_ifexists('report_id_s',''),\n        RenderingType=column_ifexists('rendering_type_s',''),\n        RelatedList=column_ifexists('related_list_s',''),\n        RecordType=column_ifexists('record_type_s',''),\n        RecordId=column_ifexists('record_id_s',''),\n        Quiddity=column_ifexists('quiddity_s',''),\n        QueryId=column_ifexists('query_id_s',''),\n        PrevpageUrl=column_ifexists('prevpage_url_s',''),\n        PrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n        PrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n        PrevpageContext=column_ifexists('prevpage_context_s',''),\n        PrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n        PrefixesSearched=column_ifexists('prefixes_searched_s',''),\n        ParentUiElement=column_ifexists('parent_ui_element_s',''),\n        PageUrl=column_ifexists('page_url_s',''),\n        PageStartTime=column_ifexists('page_start_time_s',''),\n        PageEntityType=column_ifexists('page_entity_type_s',''),\n        PageEntityId=column_ifexists('page_entity_id_s',''),\n        PageContext=column_ifexists('page_context_s',''),\n        PageAppName=column_ifexists('page_app_name_s',''),\n        Origin=column_ifexists('origin_s',''),\n        OrganizationId=column_ifexists('organization_id_s',''),\n        NumResults=column_ifexists('num_results_s',''),\n        NumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n        NumberFields=column_ifexists('number_fields_s',''),\n        NumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n        NumberColumns=column_ifexists('number_columns_s',''),\n        NumberBuckets=column_ifexists('number_buckets_s',''),\n        MethodName=column_ifexists('method_name_s',''),\n        Method=column_ifexists('method_s',''),\n        MediaType=column_ifexists('media_type_s',''),\n        LoginStatus=column_ifexists('login_status_s',''),\n        LoginKey=column_ifexists('login_key_s',''),\n        HttpMethod=column_ifexists('http_method_s',''),\n        GrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n        EntryPoint=column_ifexists('entry_point_s',''),\n        EntityName=column_ifexists('entity_name_s',''),\n        Entity=column_ifexists('entity_s',''),\n        EffectivePageTime=column_ifexists('effective_page_time_s',''),\n        Duration=column_ifexists('duration_s',''),\n        DisplayType=column_ifexists('display_type_s',''),\n        DeviceSessionId=column_ifexists('device_session_id_s',''),\n        DevicePlatform=column_ifexists('device_platform_s',''),\n        DbTotalTime=column_ifexists('db_total_time_s',''),\n        DbCpuTime=column_ifexists('db_cpu_time_s',''),\n        DbBlocks=column_ifexists('db_blocks_s',''),\n        CpuTime=column_ifexists('cpu_time_s',''),\n        ConnectionType=column_ifexists('connection_type_s',''),\n        ComponentName=column_ifexists('component_name_s',''),\n        ClientVersion=column_ifexists('client_version_s',''),\n        ClientId=column_ifexists('client_id_s',''),\n        CipherSuite=column_ifexists('cipher_suite_s',''),\n        CalloutTime=column_ifexists('callout_time_s',''),\n        BrowserVersion=column_ifexists('browser_version_s',''),\n        BrowserName=column_ifexists('browser_name_s',''),\n        AverageRowSize=column_ifexists('average_row_size_s',''),\n        AppType=column_ifexists('app_type_s',''),\n        AppName=column_ifexists('app_name_s',''),\n        ApiVersion=column_ifexists('api_version_s',''),\n        ApiType=column_ifexists('api_type_s',''),\n        ArticleVersionId=column_ifexists('article_version_id_s',''),\n        ArticleVersion=column_ifexists('article_version_s',''),\n        ArticleStatus=column_ifexists('article_status_s',''),\n        ArticleId=column_ifexists('article_id_s',''),\n        AnalyticsMode=column_ifexists('analytics_mode_s',''),\n        BatchId=column_ifexists('batch_id_s',''),\n        ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n        ClassName=column_ifexists('class_name_s',''),\n        ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n        ComponentId=column_ifexists('component_id_s',''),\n        ControllerType=column_ifexists('controller_type_s',''),\n        Context=column_ifexists('context_s',''),\n        ConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n        ConsoleId=column_ifexists('console_id_s',''),\n        ClientInfo=column_ifexists('client_info_s',''),\n        DstBytes=column_ifexists('request_size_s',''),\n        DstUser=column_ifexists('delegated_user_name_s',''),\n        DstUserSid=column_ifexists('delegated_user_id_s',''),\n        DstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n        Data=column_ifexists('data_s',''),\n        DashboardType=column_ifexists('dashboard_type_s',''),\n        DashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n        DashboardId=column_ifexists('dashboard_id_s',''),\n        DashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n        DvcAction=column_ifexists('action_s',''),\n        DvcOS=column_ifexists('platform_type_s',''),\n        DvcOSName=column_ifexists('os_name_s',''),\n        DvcOSVersion=column_ifexists('os_version_s',''),\n        DeliveryLocation=column_ifexists('delivery_location_s',''),\n        DeliveryId=column_ifexists('delivery_id_s',''),\n        DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n        DocumentId=column_ifexists('document_id_s',''),\n        EntityType=column_ifexists('entity_type_s',''),\n        EntityId=column_ifexists('entity_id_s',''),\n        FileType=column_ifexists('file_type_s',''),\n        FilePreviewType=column_ifexists('file_preview_type_s',''),\n        ExceptionType=column_ifexists('exception_type_s',''),\n        ExceptionMessage=column_ifexists('exception_message_s',''),\n        Ept=column_ifexists('ept_s',''),\n        EventCount=column_ifexists('number_of_records_s',''),\n        EventEndTime=column_ifexists('timestamp_s',''),\n        EventResult=column_ifexists('status_code_s',''),\n        FileSize=column_ifexists('size_bytes_s',''),\n        HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n        HttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n        HttpUserAgent=column_ifexists('browser_type_s',''),\n        LogGroupId=column_ifexists('log_group_id_s',''),\n        LimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n        LicenseContext=column_ifexists('license_context_s',''),\n        LastVersion=column_ifexists('last_version_s',''),\n        Language=column_ifexists('language_s',''),\n        JobId=column_ifexists('job_id_s',''),\n        IsSuccess=column_ifexists('is_success_s',''),\n        IsSecure=column_ifexists('is_secure_s',''),\n        IsScheduled=column_ifexists('is_scheduled_s',''),\n        IsNew=column_ifexists('is_new_s',''),\n        IsMobile=column_ifexists('is_mobile_s',''),\n        IsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n        IsGuest=column_ifexists('is_guest_s',''),\n        IsFirstRequest=column_ifexists('is_first_request_s',''),\n        IsError=column_ifexists('is_error_s',''),\n        IsApi=column_ifexists('is_api_s',''),\n        IsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n        ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n        HttpHeaders=column_ifexists('http_headers_s',''),\n        NetworkDuration=column_ifexists('time_s',''),\n        Name=column_ifexists('name_s',''),\n        NumberFailures=column_ifexists('number_failures_s',''),\n        NumClicks=column_ifexists('num_clicks_s',''),\n        OperationType=column_ifexists('operation_type_s',''),\n        NumSessions=column_ifexists('num_sessions_s',''),\n        PageName=column_ifexists('page_name_s',''),\n        Query=column_ifexists('query_s',''),\n        RequestType=column_ifexists('request_type_s',''),\n        ReportDescription=column_ifexists('report_description_s',''),\n        ReopenCount=column_ifexists('reopen_count_s',''),\n        RelatedEntityId=column_ifexists('related_entity_id_s',''),\n        RecordIdDerived=column_ifexists('record_id_derived_s',''),\n        ReadTime=column_ifexists('read_time_s',''),\n        Rank=column_ifexists('rank_s',''),\n        SrcBytes=column_ifexists('response_size_s',''),\n        SrcDvcId=column_ifexists('device_id_s',''),\n        SrcDvcModelName=column_ifexists('device_model_s',''),\n        SrcIpAddr=column_ifexists('source_ip_s',''),\n        SrcNatIpAddr=column_ifexists('client_ip_s',''),\n        SessionId=column_ifexists('session_id_s',''),\n        SiteId=column_ifexists('site_id_s',''),\n        SharingPermission=column_ifexists('sharing_permission_s',''),\n        SharingOperation=column_ifexists('sharing_operation_s',''),\n        SharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n        UrlOriginal=column_ifexists('url_s',''),\n        WaveTimestamp=column_ifexists('wave_timestamp_s',''),\n        WaveSessionId=column_ifexists('wave_session_id_g',''),\n        ViewStateSize=column_ifexists('view_state_size_s',''),\n        VersionIdDerived=column_ifexists('version_id_derived_s',''),\n        VersionId=column_ifexists('version_id_s',''),\n        TriggerType=column_ifexists('trigger_type_s',''),\n        TriggerName=column_ifexists('trigger_name_s',''),\n        TriggerId=column_ifexists('trigger_id_s',''),\n        TransactionType=column_ifexists('transaction_type_s',''),\n        TotalTime=column_ifexists('total_time_s',''),\n        TabId=column_ifexists('tab_id_s',''),\n        StackTrace=column_ifexists('stack_trace_s','')\n| project-away  *_s\n| union isfuzzy=true SalesforceServiceCloudV2_CL\n| union isfuzzy=true SalesforceServiceCloudV3_CL;\nSalesforceServiceCloudEvents_Parser\n| where EventType == 'Login'\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp\n| top 10 by count_",
+              "size": 0,
+              "title": "Top 10 users with maximun logins - {TimeRange:label}",


Fix typo from maximun to maximum.

Fixed in commit a5d5785 (maximun -> maximum in workbook, Package/mainTemplate.json, and Package/3.7.2.zip).

v-sabiraj · 2026-10-27T18:15:49Z

+          {
+            "type": 1,
+            "content": {
+              "json": "To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelIndicators table should have information of malicious IP.",


Fix typo from infomation to information

Fixed in commit a5d5785 (infomation -> information in workbook, Package/mainTemplate.json, and Package/3.7.2.zip).

v-sabiraj · 2026-10-27T18:16:51Z

+  detectionAction:
+    alertTemplate:
+      title: Snowflake - Abnormal query process time
+      description: '''Detects query with abnormal proccess time.'''


Fix typo proccess to process

Fixed in commit a5d5785 (proccess -> process in XDR detection YAML, Package/mainTemplate.json, and Package/3.2.2.zip).

v-sabiraj · 2026-10-27T18:18:00Z

+  detectionAction:
+    alertTemplate:
+      title: Snowflake - User granted admin privileges
+      description: '''Detects when user asigned admin privileges.'''


fix typo from asigned to assigned

Fixed in commit a5d5785 (asigned -> assigned in XDR detection YAML, Package/mainTemplate.json, and Package/3.2.2.zip).

v-amolpatil · 2026-10-28T08:32:21Z

+      targetQuerySha256: 5bf3d9adc2553f33e1fb8da40b076f4ccb308618087141d851f829927bf0bf04
+properties:
+  id: xdr-7feb3c32-2a11-4eb8-a2d7-e3792b31cb80
+  displayName: Ubiquiti - Possible connection to cryptominning pool


typo in cryptominning

Fixed in commit a5d5785 (cryptominning -> cryptomining in displayName and title in XDR detection YAML, Package/mainTemplate.json, and Package/3.2.2.zip).

…and update evidence READMEs/waivers - Fix typos in Malware Protection Essentials workbook (Argumnet -> Argument, Moification -> Modification) - Fix typos in Salesforce Service Cloud workbook (maximun -> maximum, infomation -> information) - Fix typos in QualysVM, Snowflake, and Ubiquiti UniFi XDR detections (multilple -> multiple, proccess -> process, asigned -> assigned, cryptominning -> cryptomining) - Regenerate Package/mainTemplate.json, Package/*.zip, and Evidence hashes for affected solutions - Clarify Evidence/README.md and waivers.json across 6 solutions per review feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7900a45f-3d8c-4905-a2a4-0722d409f7cf

v-amolpatil · 2026-10-28T10:27:32Z

+  status: disabled
+  queryCondition:
+    queryText: |-
+      // ZPAEvent parser inlined (Log Analytics workspace functions are not available on Defender XDR Advanced Hunting)


Alon Karmona (@alon-karmona1) This query is not reflecting in maintemplate.json file due to this in XDR portal this query is failing.

Currently when we deploy maintemplate we see below which fails when running the query in KQL:

Fixed in commit e376a32 — updated Solutions/Zscaler Private Access (ZPA)/Package/mainTemplate.json and repackaged Package/3.2.2.zip so all 10 Zscaler Private Access (ZPA) XDR Detection queries use let ZPAEvent = ZPA_CL (matching XDR Detections/*.yaml). We also audited all 10 solutions in this PR to confirm 100% parity between XDR Detections/*.yaml and Package/mainTemplate.json, and updated the live XDR tenant rules accordingly.

Updated in fa75b33711 — all 10 XDR Detections/*.yaml files, Package/mainTemplate.json, and Package/3.2.2.zip are now aligned on let xdr_inline_ZPAEvent = ZPA_CL to avoid colliding with the workspace ZPAEvent parser.

v-amolpatil · 2026-10-28T10:30:43Z

+  status: disabled
+  queryCondition:
+    queryText: |-
+      // ZPAEvent parser inlined (Log Analytics workspace functions are not available on Defender XDR Advanced Hunting)


Same problem of query not updated in XDR in maintemplate.json file like previous comment. Please check for all other XDR detection queries are reflecting in maintemplate.json file correctly or not.

Fixed in commit e376a32 — updated Solutions/Zscaler Private Access (ZPA)/Package/mainTemplate.json and repackaged Package/3.2.2.zip so all 10 Zscaler Private Access (ZPA) XDR Detection queries use let ZPAEvent = ZPA_CL (matching XDR Detections/*.yaml). We also audited all 10 solutions in this PR to confirm 100% parity between XDR Detections/*.yaml and Package/mainTemplate.json across every solution, and updated the live XDR tenant rules accordingly.

Updated in fa75b33711 — all 10 XDR Detections/*.yaml files, Package/mainTemplate.json, and Package/3.2.2.zip are now aligned on let xdr_inline_ZPAEvent = ZPA_CL to avoid colliding with the workspace ZPAEvent parser.

…ate.json and 3.2.2.zip Use let ZPAEvent = ZPA_CL across all 10 ZPA XDR Custom Detections in Package/mainTemplate.json and Package/3.2.2.zip to match XDR Detections/*.yaml, and update ARM readback evidence. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fd0b72a1-d55b-4770-a253-3a905105b4bb

v-sabiraj · 2026-10-29T06:45:20Z

Hi Alon Karmona (@alon-karmona1) , for ZPA solution, all the queries has "Let" variable name same as parser name so, query is failing with Semantic error - Error message
Let with the same name was already used in current context: 'ZPAEvent'

Can you fix this so that we can proceed with the publishing of the solution.
Thanks.

…dr_inline_ZPAEvent) Rename local `let ZPAEvent =` binding to `let __xdr_inline_ZPAEvent =` across all 10 ZPA XDR Detections YAML files and align Package/mainTemplate.json, Package/3.2.2.zip, and Evidence hashes so they do not collide with the workspace ZPAEvent parser. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 87ce6611-fe5b-4495-a84e-e1481315b271

Alon Karmona (alon-karmona1) · 2026-10-29T09:01:38Z

Hi v-sabiraj, v-amolpatil — fixed in commit fa75b33711:

Renamed the local inline parser binding in all 10 Zscaler Private Access (ZPA) XDR Detections/*.yaml files from let ZPAEvent = ZPA_CL to let xdr_inline_ZPAEvent = ZPA_CL (and all table references in the query body to xdr_inline_ZPAEvent) so it does not collide with the workspace parser ZPAEvent.
Synced Solutions/Zscaler Private Access (ZPA)/Package/mainTemplate.json (both the 10 install detectionRules resources and 10 contentTemplates registration resources), Package/3.2.2.zip, and Evidence/* SHA-256 hashes so the source YAML, mainTemplate.json, and 3.2.2.zip are 100% identical and have zero let ZPAEvent = collisions.
Verified XDR Workbooks/ZscalerZPA.json already uses let ZPAEventEvents = ZPA_CL (no collision) and audited the other 9 solutions in the batch to confirm no other inline parser collisions exist.

Defender XDR Advanced Hunting rejects let expression names starting with a leading underscore (Semantic error: Invalid name of let expression: '__xdr_inline_ZPAEvent'). Rename __xdr_inline_ZPAEvent to xdr_inline_ZPAEvent across all 10 ZPA XDR Detections YAML files, recompute argetQuerySha256, sync Package/mainTemplate.json and Package/3.2.2.zip, and update mainTemplateSha256 in qualification evidence receipts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9ef33d3e-a5f9-4f20-ad5e-c8dce2aaff90

Alon Karmona (alon-karmona1) requested review from a team as code owners October 20, 2026 17:50

Alon Karmona (alon-karmona1) changed the title ~~Migrate 7 solutions to Defender XDR Custom Detections and Workbooks (V3.1)~~ Migrate 10 solutions to Defender XDR Custom Detections and Workbooks (V3.1) Oct 20, 2026

This was referenced Oct 20, 2026

Migrate GoogleCloudPlatformIAM (3.2.2) to Defender XDR Custom Detections #15361

Closed

Migrate Ubiquiti UniFi (3.2.2) to Defender XDR Custom Detections #15362

Closed

Migrate Salesforce Service Cloud (3.7.1) to Defender XDR Custom Detections #15363

Closed

Alon Karmona (alon-karmona1) marked this pull request as draft October 20, 2026 20:09

v-atulyadav added Solution Solution specialty review needed XDR Defender XDR Custom Detection content labels Oct 21, 2026

v-atulyadav assigned v-amolpatil Oct 21, 2026

Ofer Inbar (oferInbar) added 1P Solution 1P Microsoft-owned Sentinel solution Migration Sentinel-to-Defender-XDR content migration (NPF) Validation Validation specialty review needed labels Oct 21, 2026

Alon Karmona (alon-karmona1) force-pushed the content/xdr-migration-batch1 branch from ba0efde to d42f2b9 Compare October 21, 2026 21:09

chore: bump modified AR versions, strip locale URLs in evidence, and …

661d697

…repackage V3.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e

github-actions Bot added the Qualification Live lab qualification evidence included (NPF) label Oct 22, 2026

Alon Karmona and others added 5 commits October 22, 2026 11:29

Complete QualysVM (14/14 WB) and Sophos XG Firewall (2/2 AR/CD, 10/10…

51081fa

… WB) live qualification evidence Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab4f2c8f-138e-46c3-920f-a4bb59885c7e

Merge remote-tracking branch 'upstream/master' into content/xdr-migra…

526d74a

…tion-batch1

Qualification fix: inline parsers in XDR detections and workbooks (Qu…

5a416cb

…alysVM, Salesforce Service Cloud) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8223a71f-8c93-4e25-8f91-95479c961b0c

Alon Karmona and others added 2 commits October 24, 2026 14:15

Merge upstream/master into content/xdr-migration-batch1

75a5ca7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 19313cc7-ccea-4b93-987e-d499d1baf5a6

Alon Karmona (alon-karmona1) marked this pull request as ready for review October 26, 2026 13:47

Fix DocumentsLinkValidation locale URLs in CrowdStrike receipt

ad2890c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 19313cc7-ccea-4b93-987e-d499d1baf5a6

v-sabiraj requested a balanced review from Copilot October 27, 2026 17:30

Copilot started reviewing on behalf of v-sabiraj October 27, 2026 17:31

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

v-sabiraj reviewed Oct 27, 2026

View reviewed changes

v-amolpatil reviewed Oct 28, 2026

View reviewed changes

v-amolpatil and others added 2 commits October 29, 2026 13:58

Updated For Windows Server data input file and same in createui and zip

b0d654d

v-amolpatil approved these changes Oct 29, 2026

View reviewed changes

v-atulyadav merged commit 79857ee into Azure:master Oct 29, 2026
48 of 49 checks passed

Conversation

Alon Karmona (alon-karmona1) commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change(s):

Partner Center Publishing Readiness & Qualification Status

All 10/10 Solutions — Remediated & Qualified (0 FAIL, Ready for Partner Center)

Reason for Change(s):

Version Updated:

Testing Completed:

Checked that the validations are passing and have addressed any issues that are present:

Uh oh!

Alon Karmona (alon-karmona1) commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Alon Karmona (alon-karmona1) Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Alon Karmona (alon-karmona1) commented Oct 20, 2026 •

edited

Loading

All 10/10 Solutions — Remediated & Qualified (`0 FAIL`, Ready for Partner Center)

Alon Karmona (alon-karmona1) Oct 29, 2026 •

edited

Loading

Alon Karmona (alon-karmona1) Oct 29, 2026 •

edited

Loading

Alon Karmona (alon-karmona1) commented Oct 29, 2026 •

edited

Loading