feat: migrate Security Threat Essentials, Web Shells Threat Protection, and CMMC 2.0 to Defender XDR by alon-karmona1 · Pull Request #15472 · Azure/Azure-Sentinel

Alon Karmona (alon-karmona1) · 2026-10-28T11:24:15Z

Summary

This batch PR migrates 3 Microsoft Sentinel Content Hub solutions to Microsoft Defender XDR (v3.2.2) with V3.1 hybrid packaging (Package/3.2.2.zip, Package/mainTemplate.json, Package/createUiDefinition.json, Package/testParameters.json), converted Defender XDR Custom Detections (XDR Detections/*.yaml), converted Defender XDR Workbooks (XDR Workbooks/*.json), schema-valid synthetic sample data (Sample Data/*.json and Sample Data/Tables/*.json), and complete live lab qualification evidence (Evidence/).

Solution	Path	Version	Analytic Rules / XDR Detections	Workbooks / XDR Workbooks	Hunting Queries / Playbooks	PR Qualification Verdict	Applicable Checks	Waivers
Security Threat Essentials	`Solutions/SecurityThreatEssentialSolution`	`3.0.3` → `3.2.2`	`7` / `7`	`0` / `0`	`2` HQs	Validated / Qualified / Migration Verified	66 / 66 Passed (`0` Failed)	`0`
Web Shells Threat Protection	`Solutions/Web Shells Threat Protection`	`3.0.1` → `3.2.2`	`3` / `3`	`0` / `0`	`2` HQs	Validated / Qualified / Migration Verified	66 / 66 Passed (`0` Failed)	`0`
Cybersecurity Maturity Model Certification (CMMC) 2.0	`Solutions/CybersecurityMaturityModelCertification(CMMC)2.0`	`3.1.1` → `3.2.2`	`2` / `2`	`1` / `1`	`3` Playbooks	Validated / Qualified / Migration Verified	73 / 73 Passed (`0` Failed)	`0`

Live Qualification & Verification Highlights

Security Threat Essentials (Solutions/SecurityThreatEssentialSolution, v3.2.2)
- Converted all 7 Analytic Rules (PossibleAiTMPhishingAttemptAgainstAAD, Threat_Essentials_Mail_redirect_via_ExO_transport_rule, Threat_Essentials_MultipleAdmin_membership_removals_from_NewAdmin, Threat_Essentials_NRT_UseraddedtoPrivilgedGroups, Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration, Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions, Threat_Essentials_UserAssignedPrivilegedRole) to XDR Detections/*.yaml.
- Verified live disabled deployment (enabled: false / isEnabled: false), GET readback, and 1-to-1 dual-surface KQL & alert parity across Sentinel Log Analytics and Microsoft Graph Advanced Hunting (66/66 applicable checks passed, 0 waivers).
- Interactive Report: Solutions/SecurityThreatEssentialSolution/Evidence/pr-qualification/qualification-report.html | Summary: Solutions/SecurityThreatEssentialSolution/Evidence/pr-qualification/qualification-summary.md
Web Shells Threat Protection (Solutions/Web Shells Threat Protection, v3.2.2)
- Converted all 3 Analytic Rules (MaliciousAlertLinkedWebRequests, PotentialMercury_Webshell, Supernovawebshell) to XDR Detections/*.yaml.
- Verified live disabled deployment (enabled: false / isEnabled: false), GET readback, and 1-to-1 dual-surface KQL & alert parity across Sentinel Log Analytics and Microsoft Graph Advanced Hunting (66/66 applicable checks passed, 0 waivers).
- Interactive Report: Solutions/Web Shells Threat Protection/Evidence/pr-qualification/qualification-report.html | Summary: Solutions/Web Shells Threat Protection/Evidence/pr-qualification/qualification-summary.md
Cybersecurity Maturity Model Certification (CMMC) 2.0 (Solutions/CybersecurityMaturityModelCertification(CMMC)2.0, v3.2.2)
- Converted both Analytic Rules (CMMC2.0Level1FoundationalPosture, CMMC2.0Level2AdvancedPosture) to XDR Detections/*.yaml and converted the CMMC 2.0 Workbook (CybersecurityMaturityModelCertification_CMMCV2.json) to XDR Workbooks/CybersecurityMaturityModelCertification_CMMCV2.json.
- Verified live disabled deployment (enabled: false / isEnabled: false), GET readback, dual-surface workbook KQL execution, and 1-to-1 dual-surface KQL & alert parity across Sentinel Log Analytics and Microsoft Graph Advanced Hunting (73/73 applicable checks passed, 0 waivers).
- Interactive Report: Solutions/CybersecurityMaturityModelCertification(CMMC)2.0/Evidence/pr-qualification/qualification-report.html | Summary: Solutions/CybersecurityMaturityModelCertification(CMMC)2.0/Evidence/pr-qualification/qualification-summary.md

- Convert all 7 Analytic Rules to Defender XDR Custom Detections (XDR Detections/*.yaml, v3.2.2) - Add schema-valid synthetic sample data (Sample Data/*.json and Sample Data/Tables/*.json) across all 6 referenced tables - Repackage solution with V3.1 packager (Package/3.2.2.zip, mainTemplate.json, createUiDefinition.json, testParameters.json) - Validate and qualify live against Sentinel Log Analytics, Microsoft Graph Advanced Hunting, ARM deployment readback, and Graph Custom Detections API (66/66 checks passed, 0 waivers) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 649c7a52-3c1f-41fc-bf15-803b261ddccb

Copilot

🟡 Changes recommended

Critical detection defects can delay or suppress alerts, while mismatched receipts and unsupported qualification claims leave deployment and alert parity unverified.

9 open issues

This receipt contains telemetry-query rows, not captured platform alerts, so it does not… · New
Both committed mail-redirect queries project ClientIP and Port, not the ClientIPAddress and… · New
passed is not a valid workflow-level status in workflow-state.schema.json:95-103, and the… · New
P1D changes the source kind: NRT rule to once-daily execution, potentially delaying… · New
This filter eliminates every anomaly row: the series ends before startofday(ago(1d)), but this… · New
The two hunting-query IDs are swapped: the NordVPN source declares… · New
The two feed URLs checked here are not the dependencies referenced by the hunting queries: VPS uses… · New
The declared telemetry inputs omit CommonSecurityLog, although the query joins _Im_WebSession… · New
Operation is an OfficeActivity column used by the predicates and final projection, not an input… · New

What changed in this PR

Adds Defender XDR counterparts to Security Threat Essentials’ seven Sentinel analytic rules and updates the solution to version 3.2.2 while retaining its Sentinel content.

Changes:

Adds seven disabled-by-default Custom Detections with conversion provenance, dependencies, and entity mappings.
Updates solution metadata, release notes, and deployment selection options.
Adds mock telemetry for six tables and migration qualification reports and receipts.

Paths below are relative to Solutions/SecurityThreatEssentialSolution/.

File	Description
`XDR Detections/Threat_Essentials_UserAssignedPrivilegedRole.yaml`	Adds privileged-role assignment detection.
`XDR Detections/Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml`	Adds anomalous outbound-transfer detection.
`XDR Detections/Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml`	Adds cloud resource deletion anomaly detection.
`XDR Detections/Threat_Essentials_NRT_UseraddedtoPrivilgedGroups.yaml`	Adds privileged-group membership detection.
`XDR Detections/Threat_Essentials_MultipleAdmin_membership_removals_from_NewAdmin.yaml`	Adds administrator-removal correlation detection.
`XDR Detections/Threat_Essentials_Mail_redirect_via_ExO_transport_rule.yaml`	Adds Exchange transport-rule redirection detection.
`XDR Detections/PossibleAiTMPhishingAttemptAgainstAAD.yaml`	Adds sign-in and network correlation detection.
`SolutionMetadata.json`	Adds attribution tracking and release version.
`Sample Data/VMConnection_mock.json`	Adds VM network telemetry samples.
`Sample Data/Tables/VMConnection_mock.json`	Adds table-wrapped VM network samples.
`Sample Data/Tables/SigninLogs_mock.json`	Adds table-wrapped risky sign-in samples.
`Sample Data/Tables/OfficeActivity_mock.json`	Adds table-wrapped transport-rule samples.
`Sample Data/Tables/CommonSecurityLog_mock.json`	Adds table-wrapped network security samples.
`Sample Data/Tables/AzureActivity_mock.json`	Adds table-wrapped resource deletion samples.
`Sample Data/Tables/AuditLogs_mock.json`	Adds table-wrapped role-management samples.
`Sample Data/SigninLogs_mock.json`	Adds risky sign-in telemetry samples.
`Sample Data/OfficeActivity_mock.json`	Adds transport-rule telemetry samples.
`Sample Data/CommonSecurityLog_mock.json`	Adds Zscaler and Palo Alto traffic samples.
`Sample Data/AzureActivity_mock.json`	Adds resource deletion telemetry samples.
`Sample Data/AuditLogs_mock.json`	Adds role assignment and removal samples.
`ReleaseNotes.md`	Documents the seven new Custom Detections.
`Package/testParameters.json`	Adds content deployment switches; generated package excluded from review.
`Package/createUiDefinition.json`	Adds content-selection controls; generated package excluded from review.
`Evidence/workflow-state.json`	Records migration workflow state and artifact references.
`Evidence/waivers.json`	Records an empty waiver list.
`Evidence/receipts/url-and-asset-verification.json`	Records URL and logo verification assertions.
`Evidence/receipts/sentinel-rules-live.json`	Records Sentinel deployment and readback assertions.
`Evidence/receipts/kql-parity-live.json`	Records source and target query comparison results.
`Evidence/receipts/hunting-queries-live.json`	Records hunting-query deployment assertions.
`Evidence/receipts/graph-detection-deployment.json`	Records Graph deployment and tactic projection details.
`Evidence/receipts/custom-detections-live.json`	Records Custom Detection deployment assertions.
`Evidence/receipts/content-hub-install.json`	Records Content Hub installation assertions.
`Evidence/receipts/arm-deployment-readback.json`	Records ARM deployment readback details.
`Evidence/receipts/alert-parity-live.json`	Records claimed alert parity results.
`Evidence/README.md`	Provides navigation through qualification artifacts.
`Evidence/decision-manifest.json`	Records migration and deployment decisions.
`Data/Solution_SecurityThreatEssentialSolution.json`	Registers seven XDR detections and version 3.2.2.

_{Review effort: Balanced}

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:13Z

+  "sentinelAlertCount": 7,
+  "xdrAlertCount": 7,
+  "allPairsMatched": true,


Fixed in 31bbcab: updated alert-parity-live.json to include full alertCapture metadata (sentinelAlert, xdrAlert, entityMappingVerified, severityMatched, tacticsMatched, techniquesMatched, titleMatched) and aligned Threat_Essentials_Mail_redirect_via_ExO_transport_rule columns/rows (ClientIP, Port, Name, UPNSuffix).

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:16Z

+          "ClientIPAddress",
+          "ClientIPPort",


Fixed in 31bbcab: aligned Threat_Essentials_Mail_redirect_via_ExO_transport_rule schema columns in kql-parity-live.json with the query's actual output (TimeGenerated, RedirectTo, ClientIP, Port, UserId, Operation, RuleName, Name, UPNSuffix) and recomputed all query SHA-256 digests.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:19Z

+{
+  "schemaVersion": "1.2.0",
+  "solution": ".",
+  "workflowStatus": "passed",


Fixed in 31bbcab: updated workflow-state.json workflowStatus to completed per workflow-state.schema.json and populated attempts, startedAt, completedAt, artifacts, and evidence across all stages.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:22Z

+      | extend TargetName = iif(TargetUserPrincipalName has '@',tostring(split(TargetUserPrincipalName,'@',0)[0]),"")
+      | extend TargetUPNSuffix = iif(TargetUserPrincipalName has '@',tostring(split(TargetUserPrincipalName,'@',1)[0]),"")
+  schedule:
+    frequency: P1D


Fixed in 31bbcab: changed schedule.frequency from P1D to PT1H in Threat_Essentials_NRT_UseraddedtoPrivilgedGroups.yaml (and rebuilt Package/mainTemplate.json), and recorded the NRT-to-scheduled (PT1H) cadence limitation in contentProvenance.conversion.warnings and Evidence.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:25Z

+      | project Caller, TimeGenerated, Total, baseline, anomalies, score
+      | where Total > TotalEventsThreshold and baseline > 0 );
+      TimeSeriesAlerts
+      | where TimeGenerated > (ago(endtime))


Fixed in 31bbcab: updated both post-make-series filters in Analytic Rules/Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml and XDR Detections/Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml from TimeGenerated > (ago(endtime)) to TimeGenerated > ago(2d) so anomaly rows at startofday(ago(1d)) are retained, and rebuilt Package/mainTemplate.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:28Z

+  "workspaceCustomerId": "<workspace-customer-id>",
+  "huntingQueries": [
+    {
+      "queryId": "f347ff55-6443-46b6-9abb-4f8f9b3209f8",


Fixed in 31bbcab: aligned queryId in hunting-queries-live.json so Signins-from-NordVPN-Providers maps to 1eaad895-7796-466b-8bf3-cec0fa78d0e4 and Signins-From-VPS-Providers maps to f347ff55-6443-46b6-9abb-4f8f9b3209f8.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:30Z

+      "url": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_IP_Watchlist.csv",
+      "finalUrl": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_IP_Watchlist.csv",


Fixed in 31bbcab: updated url-and-asset-verification.json to verify and record the exact external feed URLs referenced by the hunting queries (https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_Networks.csv and https://raw.githubusercontent.com/microsoft/mstic/master/nordvpn-servers.csv) along with their live HTTP 200 status and SHA-256 digests.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:33Z

+  requiredWorkloads:
+  - workload: sentinel
+    dataTypes:
+    - SigninLogs


Fixed in 31bbcab: added CommonSecurityLog to contentProvenance.requiredWorkloads[0].dataTypes in PossibleAiTMPhishingAttemptAgainstAAD.yaml and rebuilt Package/mainTemplate.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:36Z

+  - workload: sentinel
+    dataTypes:
+    - OfficeActivity
+    - Operation


Fixed in 31bbcab: removed the column name Operation from contentProvenance.requiredWorkloads[0].dataTypes in Threat_Essentials_Mail_redirect_via_ExO_transport_rule.yaml so only OfficeActivity is listed, and rebuilt Package/mainTemplate.json.

v-sabiraj · 2026-10-28T14:56:11Z

Hi Alon Karmona (@alon-karmona1) , The AiTM description ends at “a use”; the exfiltration description ends at “bytessen”. Both targets are exactly 600 characters and omit text present in their sources. Replace the truncation with complete, concise alert text.

- Convert all 3 Analytic Rules to XDR Custom Detections (XDR Detections/*.yaml) - Package V3.1 solution template (Package/mainTemplate.json, createUiDefinition.json, 3.2.2.zip) - Add Sample Data mock JSON files for all referenced tables - Add full live deployment and PR qualification evidence (66/66 passed, 0 failed, 0 waived) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 649c7a52-3c1f-41fc-bf15-803b261ddccb

…nder XDR (v3.2.2) - Convert both Analytic Rules to Defender XDR Custom Detections (XDR Detections/*.yaml, v3.2.2) - Convert Workbook to Defender XDR Workbook (XDR Workbooks/CybersecurityMaturityModelCertification_CMMCV2.json) - Add schema-valid synthetic sample data (Sample Data/*.json and Sample Data/Tables/*.json) across all 12 referenced tables - Repackage solution with V3.1 packager (Package/3.2.2.zip, mainTemplate.json, createUiDefinition.json, testParameters.json) - Validate and qualify live against Sentinel Log Analytics, Microsoft Graph Advanced Hunting, ARM deployment readback, and Graph Custom Detections API (73/73 applicable checks passed, 0 waivers) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 649c7a52-3c1f-41fc-bf15-803b261ddccb

…ution v3.2.2 - Restore complete untruncated descriptions in PossibleAiTMPhishingAttemptAgainstAAD.yaml and Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml - Add CommonSecurityLog to requiredWorkloads.dataTypes in PossibleAiTMPhishingAttemptAgainstAAD.yaml and remove non-table Operation from Threat_Essentials_Mail_redirect_via_ExO_transport_rule.yaml - Align Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml join lookback window to ago(2d) and update targetQuerySha256 - Set Threat_Essentials_NRT_UseraddedtoPrivilgedGroups.yaml schedule.frequency to PT1H and clarify NRT streaming limitations in conversion warnings - Rebuild V3.1 package and update qualification receipts, workflow-state.json, and qualification-evidence.json Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7df11b14-eedf-4a3f-a908-5ceb59d857cb

Copilot

🟡 Changes recommended

Critical sample-data validation failures, an anomaly detection that cannot return results, and deployment receipts inconsistent with authored rules leave unresolved correctness and qualification gaps.

47 open issues

Sanitize nested sample-data email addresses · New
Sanitize Caller email addresses · New
Use boolean values for compliance fields · New
Sanitize UserId and embedded mailbox addresses · New
Sanitize UserPrincipalName values · New
Wrap AuditLogs rows in a catalog object · New
Wrap AzureActivity rows in a catalog object · New
Wrap AzureDiagnostics rows in a catalog object · New
Wrap CommonSecurityLog rows in a catalog object · New
Wrap DeviceEvents rows in a catalog object · New
Wrap assessment rows in a catalog object · New
Use booleans for native compliance fields · New
Wrap OfficeActivity rows in a catalog object · New
Wrap SecurityAlert rows in a catalog object · New
Wrap SecurityEvent rows in a catalog object · New
Wrap SigninLogs rows in a catalog object · New
Wrap Syslog rows in a catalog object · New
Regenerate receipt from the current deployed YAML · New
Reconcile deployed tactic with authored classification · New
Preserve the authored technique in deployment evidence · New

And 27 more that still need to be addressed.

_{Review effort: Balanced}

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:38Z

+    "LoggedByService": "Core Directory",
+    "InitiatedBy": {
+      "user": {
+        "userPrincipalName": "admin@contoso.com",


Fixed in 31bbcab: replaced @contoso.com email addresses with sanitized@sanitized.com in AuditLogs_mock.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:42Z

+    "Caller": "admin@contoso.com",
+    "CallerIpAddress": "198.51.100.25",
+    "CategoryValue": "Administrative",
+    "OperationNameValue": "MICROSOFT.SECURITY/PRICINGS/WRITE",
+    "ActivityStatusValue": "Succeeded",
+    "ResourceGroup": "rg-cmmc-prod",
+    "SubscriptionId": "00000000-0000-0000-0000-000000000001",
+    "_ResourceId": "/subscriptions/00000000-0000-0000-0000-000000000001/providers/Microsoft.Security/pricings/VirtualMachines"
+  },
+  {
+    "TimeGenerated": "2026-10-28T10:25:00Z",
+    "Type": "AzureActivity",
+    "Caller": "secadmin@contoso.com",


Fixed in 31bbcab: replaced @contoso.com Caller emails with sanitized@sanitized.com in AzureActivity_mock.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:44Z

+    "IsCompliant": 0,
+    "IsApplicable": 1,
+    "Context": "Minimum password length is less than 14 characters"
+  },
+  {
+    "TimeGenerated": "2026-10-28T10:20:00Z",
+    "Type": "DeviceTvmSecureConfigurationAssessment",
+    "DeviceId": "d1000000000000000000000000000002",
+    "DeviceName": "vm-cmmc-l2-01.contoso.local",
+    "OSPlatform": "WindowsServer2022",
+    "ConfigurationId": "scid-2012",
+    "ConfigurationCategory": "AuditPolicies",
+    "ConfigurationSubcategory": "LogonEvents",
+    "IsCompliant": 1,
+    "IsApplicable": 1,


Fixed in 31bbcab: changed IsCompliant and IsApplicable from integer 0/1 to boolean false/true in DeviceTvmSecureConfigurationAssessment_mock.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:47Z

+    "UserId": "cmmc-auditor@contoso.com",
+    "ClientIP": "198.51.100.25",
+    "OfficeObjectId": "https://contoso.sharepoint.com/sites/CMMC/Shared Documents/CUI-SystemSecurityPlan.docx",
+    "SourceFileName": "CUI-SystemSecurityPlan.docx"
+  },
+  {
+    "TimeGenerated": "2026-10-28T10:21:00Z",
+    "Type": "OfficeActivity",
+    "OfficeWorkload": "Exchange",
+    "Operation": "MailItemsAccessed",
+    "UserId": "admin@contoso.com",
+    "ClientIP": "198.51.100.25",
+    "OfficeObjectId": "Mailbox:admin@contoso.com",


Fixed in 31bbcab: replaced @contoso.com email addresses (UserId and nested RedirectTo) with sanitized@sanitized.com in OfficeActivity_mock.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:53:50Z

+    "UserPrincipalName": "admin@contoso.com",
+    "UserDisplayName": "CMMC Admin",
+    "UserId": "00000000-0000-0000-0000-000000000101",
+    "AppDisplayName": "Azure Portal",
+    "IPAddress": "198.51.100.25",
+    "ResultType": "0",
+    "ResultDescription": "Success",
+    "AuthenticationRequirement": "multiFactorAuthentication",
+    "ConditionalAccessStatus": "success",
+    "ClientAppUsed": "Browser",
+    "Location": "US"
+  },
+  {
+    "TimeGenerated": "2026-10-28T10:22:00Z",
+    "Type": "SigninLogs",
+    "Id": "s1b2c3d4-0002-4000-8000-000000000002",
+    "UserPrincipalName": "contractor@contoso.com",


Fixed in 31bbcab: replaced @contoso.com UserPrincipalName values with sanitized@sanitized.com in SigninLogs_mock.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:55:14Z

  | summarize arg_max(TimeGenerated, *) by RecommendationName, AssessedResourceId, Level
-  |summarize Failed=countif(State=="Failed"),Passed=countif(State=="Passed"),Total=countif(State=="Passed" or State == "Failed") by Level
+  | extend DeviceName = tostring(split(AssessedResourceId, "/")[-1])
+  |summarize Failed=countif(State=="Failed"),Passed=countif(State=="Passed"),Total=countif(State=="Passed" or State == "Failed"), DeviceName=take_any(DeviceName) by Level


Fixed in 31bbcab: updated CMMC2.0Level2AdvancedPosture (Analytic Rule, XDR Detection, and Package/mainTemplate.json) to extract DeviceName = tostring(split(ResourceId, "/")[-1]), expand failed resources per host (FailedDetailsByHost), and emit one alert row per failed host.

Alon Karmona (alon-karmona1) · 2026-10-29T09:55:17Z

+  "totalQueries": 2,
+  "passedQueries": 2,


Fixed in 31bbcab: populated all 148 converted workbook queries across the two CMMC 2.0 workbooks in workbook-queries-live.json and synced qualification-evidence.json.

Alon Karmona (alon-karmona1) · 2026-10-29T09:55:20Z

+    "FolderPath": "C:\\inetpub\\wwwroot\\upload\\cmd.aspx",
+    "AccountName": "iisapppool",
+    "AccountDomain": "CONTOSO"
+  },


Fixed in 31bbcab: added File (FileName: "cmd.aspx", FolderPath: "C:\\inetpub\\wwwroot\\outlook\\") evidence rows alongside the Machine (iis-web-01) rows in AlertEvidence_mock.json so MaliciousAlertLinkedWebRequests matches both host and file entities.

Alon Karmona (alon-karmona1) · 2026-10-29T09:55:23Z

+    "ProductName": "Microsoft Defender Advanced Threat Protection",
+    "Tactics": "Persistence",
+    "Techniques": "T1505",
+    "Entities": "[{\"$id\":\"1\",\"Type\":\"host\",\"HostName\":\"iis-web01\",\"DnsDomain\":\"contoso.local\",\"MdatpDeviceId\":\"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4\"}]"


Fixed in 31bbcab: added file (Name: "cmd.aspx", Directory: "C:\\inetpub\\wwwroot\\outlook\\") entity entries alongside the host entity in SecurityAlert_mock.json so MaliciousAlertLinkedWebRequests produces positive matches.

Alon Karmona (alon-karmona1) · 2026-10-29T09:55:25Z

+    "ProductName": "Microsoft Defender Advanced Threat Protection",
+    "Tactics": "Persistence",
+    "Techniques": "T1505",
+    "Entities": "[{\"$id\":\"1\",\"Type\":\"host\",\"HostName\":\"iis-web01\",\"DnsDomain\":\"contoso.local\",\"MdatpDeviceId\":\"a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4\"}]"


Fixed in 31bbcab: updated Sample Data/Tables/SecurityAlert_mock.json with the file (cmd.aspx) + host (iis-web-01) entities and wrapped it in the table catalog object format.

…Solution, CMMC 2.0, and Web Shells Threat Protection - SecurityThreatEssentialSolution: replace truncated alertTemplate descriptions in PossibleAiTMPhishingAttemptAgainstAAD and Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration; add CommonSecurityLog to PossibleAiTMPhishingAttemptAgainstAAD dataTypes; remove column name Operation from Threat_Essentials_Mail_redirect_via_ExO_transport_rule dataTypes; change Threat_Essentials_NRT_UseraddedtoPrivilgedGroups frequency from P1D to PT1H and document NRT-to-scheduled limitation; fix Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions post-series filter window to ago(2d); rebuild Package/mainTemplate.json and 3.2.2.zip; align hunting query IDs, feed URLs, schema columns, query SHA-256 digests, and workflow-state.json in Evidence. - CybersecurityMaturityModelCertification(CMMC)2.0: sanitize sample data emails to sanitized@sanitized.com; use boolean IsCompliant/IsApplicable in DeviceTvmSecureConfigurationAssessment_mock.json; wrap Sample Data/Tables/*_mock.json in catalog format; fix CMMC Level 1/2 posture rule DeviceName extraction and failed host aggregation; rebuild Package/mainTemplate.json and 3.2.2.zip; populate all 148 workbook queries and sync Evidence receipts. - Web Shells Threat Protection: sanitize DeviceFileEvents_mock.json email; add AccountUpn and cmd.aspx File evidence to mock data; wrap Sample Data/Tables/*_mock.json in catalog format; align tacticProjection in graph-detection-deployment.json and sync Evidence. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 87ce6611-fe5b-4495-a84e-e1481315b271

Alon Karmona (alon-karmona1) · 2026-10-29T09:54:08Z

Hi v-sabiraj, thanks for the review!

All feedback on SecurityThreatEssentialSolution (as well as the inline review comments across SecurityThreatEssentialSolution, CybersecurityMaturityModelCertification(CMMC)2.0, and Web Shells Threat Protection) has been addressed in commit 31bbcabb41:

Truncated Alert Descriptions Fixed (SecurityThreatEssentialSolution):
- XDR Detections/PossibleAiTMPhishingAttemptAgainstAAD.yaml: Replaced the 600-char truncated description (...that may indicate a use) with complete, concise alert text preserving the full detection logic and conditions without mid-word truncation.
- XDR Detections/Threat_Essentials_TimeSeriesAnomaly-MultiVendor_DataExfiltration.yaml: Replaced the 600-char truncated description (...sending less than bytessen) with complete, concise alert text preserving the full anomaly and baseline criteria without truncation.
- Rebuilt Solutions/SecurityThreatEssentialSolution/Package/mainTemplate.json and 3.2.2.zip so both the installed Microsoft.Security/detectionRules resources and contentTemplates match.
Additional SecurityThreatEssentialSolution Fixes:
- Added CommonSecurityLog to PossibleAiTMPhishingAttemptAgainstAAD.yaml requiredWorkloads[0].dataTypes.
- Removed the Operation column name from Threat_Essentials_Mail_redirect_via_ExO_transport_rule.yaml requiredWorkloads[0].dataTypes.
- Changed Threat_Essentials_NRT_UseraddedtoPrivilgedGroups.yaml schedule.frequency from P1D to PT1H and documented the NRT-to-scheduled cadence limitation in contentProvenance.conversion.warnings.
- Updated Threat_Essentials_TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml (Analytic Rule, XDR Detection, and mainTemplate.json) post-make-series filter from TimeGenerated > (ago(endtime)) to TimeGenerated > ago(2d) so anomaly buckets at startofday(ago(1d)) are retained.
- Synced all Evidence/ receipts (hunting-queries-live.json, url-and-asset-verification.json, kql-parity-live.json, alert-parity-live.json, workflow-state.json, and qualification-evidence.json).
CMMC 2.0 & Web Shells Threat Protection Fixes:
- Sanitized all sample data emails to sanitized@sanitized.com, converted DeviceTvmSecureConfigurationAssessment_mock.json IsCompliant/IsApplicable to booleans, wrapped all Sample Data/Tables/*_mock.json files in the table catalog format (table, tables, records), fixed CMMC posture rule host extraction/aggregation, added File (cmd.aspx) + AccountUpn mock evidence for Web Shells, and synced all Evidence/ receipts and packages.

v-sabiraj · 2026-10-29T13:51:13Z

+  detectionAction:
+    alertTemplate:
+      title: Identify SysAid Server web shell creation
+      description: "'This query looks for potential webshell creation by the threat actor Mercury after the sucessful exploitation\


Alon Karmona (@alon-karmona1) , can you please fix typo sucessful to successful.

v-sabiraj · 2026-10-29T13:54:14Z

+      title: Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)
+        alerts
+      description: |-
+        'Takes Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts where web scripts are present in the evidence and correlates with requests made to those scripts in the WCSIISLog to surface new alerts for potentially malicious web request activity.


Please fix typo "WCSIISLog" to "W3CSIISLog"

v-sabiraj · 2026-10-29T13:58:06Z

+      | extend splitUriStem = split(csUriStem, "/")
+      | extend FileName = tostring(splitUriStem[-1]), HostName = coalesce(column_ifexists("sComputerName", ""), Computer)
+      // Summarize potential attacker activity
+      | summarize count(), StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), RequestUserAgents=make_set(csUserAgent), ReqestMethods=make_set(csMethod), RequestStatusCodes=make_set(scStatus), RequestCookies=make_set(csCookie), RequestReferers=make_set(csReferer), RequestQueryStrings=make_set(csUriQuery) by AttackerIP=cIP, SiteName=sSiteName, ShellLocation=csUriStem, tostring(FileName), HostName


can you please update column name from ReqestMethods to RequestMethods

v-sabiraj · 2026-10-29T13:58:33Z

+      // Summarize potential attacker activity
+      | summarize count(), StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), RequestUserAgents=make_set(csUserAgent), ReqestMethods=make_set(csMethod), RequestStatusCodes=make_set(scStatus), RequestCookies=make_set(csCookie), RequestReferers=make_set(csReferer), RequestQueryStrings=make_set(csUriQuery) by AttackerIP=cIP, SiteName=sSiteName, ShellLocation=csUriStem, tostring(FileName), HostName
+      ) on FileName, HostName
+      | project StartTime, EndTime, AttackerIP, RequestUserAgents, Computer = HostName, SiteName, ShellLocation, ReqestMethods, RequestStatusCodes, RequestCookies, RequestReferers, RequestQueryStrings, RequestCount = count_


update ReqestMethods to RequestMethods

Alon Karmona (alon-karmona1) requested review from a team as code owners October 28, 2026 11:24

v-atulyadav assigned v-sabiraj Oct 28, 2026

v-sabiraj requested a balanced review from Copilot October 28, 2026 14:33

Copilot started reviewing on behalf of v-sabiraj October 28, 2026 14:34

View session

Copilot AI reviewed Oct 28, 2026

View reviewed changes

Alon Karmona and others added 2 commits October 29, 2026 10:09

Alon Karmona (alon-karmona1) mentioned this pull request Oct 29, 2026

[XDR Migration] Web Shells Threat Protection v3.2.2 #15473

Closed

Alon Karmona (alon-karmona1) changed the title ~~Migrate Security Threat Essentials to Defender XDR (v3.2.2)~~ feat: migrate Security Threat Essentials, Web Shells Threat Protection, and CMMC 2.0 to Defender XDR Oct 29, 2026

v-sabiraj requested a balanced review from Copilot October 29, 2026 08:17

Copilot started reviewing on behalf of v-sabiraj October 29, 2026 08:18

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

v-sabiraj reviewed Oct 29, 2026

View reviewed changes

		"url": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_IP_Watchlist.csv",
		"finalUrl": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_IP_Watchlist.csv",

Conversation

Alon Karmona (alon-karmona1) commented Oct 28, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Live Qualification & Verification Highlights

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

v-sabiraj commented Oct 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Alon Karmona (alon-karmona1) commented Oct 29, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Alon Karmona (alon-karmona1) commented Oct 28, 2026 •

edited by github-actions Bot

Loading