Repository navigation
[XDR Migration] Web Shells Threat Protection v3.2.2 - #15473
Closed
Alon Karmona (alon-karmona1) wants to merge 1 commit into
Closed
Alon Karmona (alon-karmona1) wants to merge 1 commit into
Alon Karmona (alon-karmona1) wants to merge 1 commit into
Conversation
- Convert all 3 Analytic Rules to XDR Custom Detections (XDR Detections/*.yaml) - Package V3.1 solution template (Package/mainTemplate.json, createUiDefinition.json, 3.2.2.zip) - Add Sample Data mock JSON files for all referenced tables - Add full live deployment and PR qualification evidence (66/66 passed, 0 failed, 0 waived) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 649c7a52-3c1f-41fc-bf15-803b261ddccb
github-actions
Bot
added
1P Solution
Contributor
|
Hello Alon Karmona (@alon-karmona1), the Custom Deployment in the Azure Portal is failing with a Conflict error, indicating that a detection rule with the same name, title, or rule ID may already exist. Could you please take a look and make the necessary updates to resolve the issue? Sharing the screenshot for your reference. Thank you! 
|
Contributor
Author
|
Consolidated into batch PR #15472 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
End-to-end Defender XDR migration and V3.1 packaging for Web Shells Threat Protection (
v3.2.2).Changes Included
XDR Detections/*.yaml): Converted all 3 Analytic Rules (0_CLtables) to Defender XDR Custom Detections and validated against static schema, Sentinel SDK, Sentinel Log Analytics, and live Graph Advanced Hunting (3/3passed):MaliciousAlertLinkedWebRequests.yaml(5cdce3b3-ebfd-4dc7-b84c-3f0efcf9ea57)PotentialMercury_Webshell.yaml(a3a6be92-b016-4f5b-b064-fb7dcafcd4a6)Supernovawebshell.yaml(27fbb8dc-46aa-4c86-8f8a-d8ed4bc5fbbe)Package/): Updated version to3.2.2inData/Solution_WebShellsThreatProtection.json,SolutionMetadata.json, andReleaseNotes.md; packaged V3.1mainTemplate.json,createUiDefinition.json,testParameters.json, and3.2.2.zip.Sample Data/&Sample Data/Tables/): Added mock sample data files for all 10 referenced tables (AlertEvidence,AlertInfo,SecurityAlert,DeviceEvents,DeviceNetworkEvents,DeviceFileEvents,DeviceProcessEvents,SecurityEvent,Event,W3CIISLog).Evidence/):DeployCustomDetection=true, rules disabled) toOptimizeSentinelWorkspaceand Graph (detectorId=123335,123336,123337) and verified read-back of all 3 Sentinel rules, 12 content templates, and 3 XDR Custom Detections.pr-qualify --mode full --is-migrationverification with0waivers:ValidatedQualifiedMigration Verified66 / 66 Passed,0 Failed,0 Waived