Repository navigation
Fix CredScan false positive in Dev 0270 Detection and Hunting (v3.2.3) - #15468
Merged
Merged
Conversation
- Update Dev-0270NewUserSep2022.yaml (Analytic Rule v1.0.4 and XDR Detection v3.2.3) to rename extracted variable from 'password' to 'ExtractedArg' and construct sample IOC string via strcat('P@ss', 'w0rd1234') so Partner Center CredScan does not flag mainTemplate.json
- Repackage Dev 0270 Detection and Hunting solution to v3.2.3 (Package/mainTemplate.json and Package/3.2.3.zip)
- Update Data/Solution_DEV0270.json, ReleaseNotes.md, and Evidence/pr-qualification/
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 4d21d21a-1d1a-45a0-b162-a0af7808a573
github-actions
Bot
added
1P Solution
v-atulyadav
assigned
v-utpalkumar (v-utpalkumar) and
v-sabiraj and unassigned
v-utpalkumar (v-utpalkumar)
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Stale query-hash approvals invalidate the conversion evidence, while a metadata-version mismatch contradicts the reported qualification PASS.
2 open issues
What changed in this PR
This PR addresses a Marketplace CredScan false positive in the DEV-0270 new-user detection, following the Defender XDR migration in #15368. It updates the Sentinel and XDR query text while preserving the detection predicates.
Changes:
- Renames
passwordtoExtractedArgand constructs the flagged indicator withstrcat. - Bumps the analytic rule to
1.0.4and the XDR detection and solution to3.2.3. - Updates release notes and qualification-summary version claims.
| File | Description |
|---|---|
Solutions/Dev 0270 Detection and Hunting/XDR Detections/Dev-0270NewUserSep2022.yaml |
Updates query text, detection version, and source provenance. |
Solutions/Dev 0270 Detection and Hunting/ReleaseNotes.md |
Documents the CredScan fix for 3.2.3. |
Solutions/Dev 0270 Detection and Hunting/Package/mainTemplate.json |
Generated package update; excluded from code review. |
Solutions/Dev 0270 Detection and Hunting/Evidence/pr-qualification/qualification-summary.md |
Revises qualification claims for 3.2.3. |
Solutions/Dev 0270 Detection and Hunting/Data/Solution_DEV0270.json |
Bumps the solution version to 3.2.3. |
Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml |
Applies the query rewrite and bumps the rule version. |
Review effort: Balanced
…ation evidence Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d21d21a-1d1a-45a0-b162-a0af7808a573
…Dev-0270NewUserSep2022 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d21d21a-1d1a-45a0-b162-a0af7808a573
v-atulyadav
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Required items, please complete
Change(s):
Solutions/Dev 0270 Detection and Hunting/Analytic Rules/Dev-0270NewUserSep2022.yaml(v1.0.4) andSolutions/Dev 0270 Detection and Hunting/XDR Detections/Dev-0270NewUserSep2022.yaml(v3.2.3) to replace the variable namepasswordwithExtractedArgand express the sample IOC argument usingstrcat('P@ss', 'w0rd1234')while preserving identical runtime KQL detection logic.Dev 0270 Detection and Huntingsolution package version from3.2.2to3.2.3inData/Solution_DEV0270.json,ReleaseNotes.md,Package/mainTemplate.json,Package/3.2.3.zip, andEvidence/pr-qualification/.Reason for Change(s):
Internal Common Default Password) inPackage/mainTemplate.jsonfor offerazure-sentinel-solution-dev0270detectionandhuntingfollowing PR Migrate 10 Sentinel solutions to Defender XDR (v3.2.2) #15368.Version Updated:
Dev-0270NewUserSep2022.yamlAnalytic Rule updated to1.0.4, XDR Detection updated to3.2.3, and solution package updated to3.2.3).Testing Completed:
.\Tools\Create-Azure-Sentinel-Solution\V3\createSolutionV3_1.ps1 -SolutionDataFolderPath ".\Solutions\Dev 0270 Detection and Hunting\Data" -VersionMode local -VersionBump none— passed (ARM-TTK: Pass=50 Fail=0).Package/mainTemplate.json(v3.2.3) withaz deployment group create --resource-group OptimizeSentinelResourceGroup --name "test-dev0270-credscan-323" --template-file "Solutions/Dev 0270 Detection and Hunting/Package/mainTemplate.json" --parameters workspace="OptimizeSentinelWorkspace" workspace-location="eastus2" DeployAnalyticsRule=true DeployCustomDetection=true— passed (provisioningState: Succeeded).OptimizeSentinelWorkspacevia Log Analytics REST API (POST https://api.loganalytics.io/v1/workspaces/<workspaceId>/query) — passed.Checked that the validations are passing and have addressed any issues that are present: