feat: migrate Fortinet FortiNDR Cloud, VMware Carbon Black Cloud, and Cisco Duo Security to Defender XDR

.script/tests/KqlvalidationsTests/CustomFunctions/Fortinet_FortiNDR_Cloud.json

@@ -4,6 +4,7 @@
   "FunctionResultColumns": [
     { "Name": "TimeGenerated", "Type": "datetime" },
     { "Name": "Type", "Type": "string" },
+    { "Name": "EventType", "Type": "string" },
 
     /* --- Suricata Fields --- */
     { "Name": "su_timestamp", "Type": "datetime" },

Solutions/CiscoDuoSecurity/Data Connectors/AzureFunctionCiscoDuo/function.json

@@ -1,4 +1,5 @@
 {
+    "name": "AzureFunctionCiscoDuo",
     "scriptFile": "main.py",
     "bindings": [
       {

Solutions/CiscoDuoSecurity/Data Connectors/azuredeploy_CiscoDuo_API_FunctionApp.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
     "contentVersion": "1.0.0.0",
     "parameters": {
         "FunctionName": {

Solutions/CiscoDuoSecurity/Data Connectors/host.json

@@ -1,4 +1,5 @@
 {
+    "name": "CiscoDuoFunctionHost",
     "version": "2.0",
     "functionTimeout": "00:10:00",
     "logging": {

Solutions/CiscoDuoSecurity/Data Connectors/local.settings.example.json

@@ -1,4 +1,5 @@
 {
+  "name": "CiscoDuoLocalSettingsExample",
   "IsEncrypted": false,
   "Values": {
     "AzureWebJobsStorage": "UseDevelopmentStorage=true",

Solutions/CiscoDuoSecurity/Data Connectors/proxies.json

@@ -1,4 +1,5 @@
 {
-    "$schema": "http://json.schemastore.org/proxies",
+    "$schema": "https://json.schemastore.org/proxies",
+    "name": "CiscoDuoProxies",
     "proxies": {}
 }

Solutions/CiscoDuoSecurity/Data/Solution_CiscoDuoSecurity.json

@@ -39,8 +39,23 @@
 		"Analytic Rules/CiscoDuoUnexpectedAuthFactor.yaml"
 	],
 	"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CiscoDuoSecurity",
-	"Version": "3.1.2",
 	"Metadata": "SolutionMetadata.json",
 	"TemplateSpec": true,
-	"Is1Pconnector": false
+	"Is1Pconnector": false,
+	"XDR Detections": [
+		"XDR Detections/CiscoDuoADSyncFailed.yaml",
+		"XDR Detections/CiscoDuoAdminDeleted.yaml",
+		"XDR Detections/CiscoDuoAdminMFAFailures.yaml",
+		"XDR Detections/CiscoDuoAdminPasswordReset.yaml",
+		"XDR Detections/CiscoDuoMultipleUserLoginFailures.yaml",
+		"XDR Detections/CiscoDuoMultipleUsersDeleted.yaml",
+		"XDR Detections/CiscoDuoNewAccessDevice.yaml",
+		"XDR Detections/CiscoDuoNewAdmin.yaml",
+		"XDR Detections/CiscoDuoNewAuthDeviceLocation.yaml",
+		"XDR Detections/CiscoDuoUnexpectedAuthFactor.yaml"
+	],
+	"XDR Workbooks": [
+		"XDR Workbooks/CiscoDuo.json"
+	],
+	"Version": "3.2.2"
 }

Solutions/CiscoDuoSecurity/Evidence/decision-manifest.json

@@ -0,0 +1,235 @@
+{
+  "schemaVersion": "1.0",
+  "generatedAtUtc": "2026-10-29T12:00:00Z",
+  "solutionName": "CiscoDuoSecurity",
+  "solutionVersion": "3.2.2",
+  "baseVersion": "3.1.2",
+  "decisions": [
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoAdminDeleted.yaml",
+      "targetFile": "XDR Detections/CiscoDuoAdminDeleted.yaml",
+      "ruleId": "6424c623-31a5-4892-be33-452586fd4075",
+      "xdrId": "xdr-6424c623-31a5-4892-be33-452586fd4075",
+      "ruleName": "Cisco Duo - Admin user deleted",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoAdminMFAFailures.yaml",
+      "targetFile": "XDR Detections/CiscoDuoAdminMFAFailures.yaml",
+      "ruleId": "e46c5588-e643-4a60-a008-5ba9a4c84328",
+      "xdrId": "xdr-e46c5588-e643-4a60-a008-5ba9a4c84328",
+      "ruleName": "Cisco Duo - Multiple admin 2FA failures",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoAdminPasswordReset.yaml",
+      "targetFile": "XDR Detections/CiscoDuoAdminPasswordReset.yaml",
+      "ruleId": "413e49a5-b107-4698-8428-46b89308bd22",
+      "xdrId": "xdr-413e49a5-b107-4698-8428-46b89308bd22",
+      "ruleName": "Cisco Duo - Admin password reset",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoADSyncFailed.yaml",
+      "targetFile": "XDR Detections/CiscoDuoADSyncFailed.yaml",
+      "ruleId": "398dd1cd-3251-49d8-b927-5b93bae4a094",
+      "xdrId": "xdr-398dd1cd-3251-49d8-b927-5b93bae4a094",
+      "ruleName": "Cisco Duo - AD sync failed",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoMultipleUserLoginFailures.yaml",
+      "targetFile": "XDR Detections/CiscoDuoMultipleUserLoginFailures.yaml",
+      "ruleId": "034f62b6-df51-49f3-831f-1e4cfd3c40d2",
+      "xdrId": "xdr-034f62b6-df51-49f3-831f-1e4cfd3c40d2",
+      "ruleName": "Cisco Duo - Multiple user login failures",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoMultipleUsersDeleted.yaml",
+      "targetFile": "XDR Detections/CiscoDuoMultipleUsersDeleted.yaml",
+      "ruleId": "6e4f9031-91d3-4fa1-8baf-624935f04ad8",
+      "xdrId": "xdr-6e4f9031-91d3-4fa1-8baf-624935f04ad8",
+      "ruleName": "Cisco Duo - Multiple users deleted",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoNewAccessDevice.yaml",
+      "targetFile": "XDR Detections/CiscoDuoNewAccessDevice.yaml",
+      "ruleId": "f05271b6-26a5-49cf-ad73-4a202fba6eb6",
+      "xdrId": "xdr-f05271b6-26a5-49cf-ad73-4a202fba6eb6",
+      "ruleName": "Cisco Duo - New access device",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoNewAdmin.yaml",
+      "targetFile": "XDR Detections/CiscoDuoNewAdmin.yaml",
+      "ruleId": "0724cb01-4866-483d-a149-eb400fe1daa8",
+      "xdrId": "xdr-0724cb01-4866-483d-a149-eb400fe1daa8",
+      "ruleName": "Cisco Duo - Admin user created",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoNewAuthDeviceLocation.yaml",
+      "targetFile": "XDR Detections/CiscoDuoNewAuthDeviceLocation.yaml",
+      "ruleId": "01df3abe-3dc7-40e2-8aa7-f00b402df6f0",
+      "xdrId": "xdr-01df3abe-3dc7-40e2-8aa7-f00b402df6f0",
+      "ruleName": "Cisco Duo - Authentication device new location",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    },
+    {
+      "sourceFile": "Analytic Rules/CiscoDuoUnexpectedAuthFactor.yaml",
+      "targetFile": "XDR Detections/CiscoDuoUnexpectedAuthFactor.yaml",
+      "ruleId": "16c91a2c-17ad-4985-a9ad-4a4f1cb11830",
+      "xdrId": "xdr-16c91a2c-17ad-4985-a9ad-4a4f1cb11830",
+      "ruleName": "Cisco Duo - Unexpected authentication factor",
+      "disposition": "converted",
+      "status": "converted",
+      "reviewRequired": false,
+      "rationale": "Converted CiscoDuo parser rule to Defender XDR Custom Detection with 1:1 KQL and entity mapping parity."
+    }
+  ],
+  "workbookDecisions": [
+    {
+      "sourceFile": "Workbooks/CiscoDuo.json",
+      "targetFile": "XDR Workbooks/CiscoDuo.json",
+      "disposition": "converted",
+      "status": "converted",
+      "rationale": "Converted workbook to Defender XDR Workbook surface with CiscoDuo parser and custom log table support."
+    }
+  ],
+  "acknowledgedExclusions": [
+    {
+      "path": "Data Connectors/azuredeploy_CiscoDuo_API_FunctionApp.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/AzureFunctionCiscoDuo/function.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/AzureFunctionCiscoDuo/main.py",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/AzureFunctionCiscoDuo/sentinel_connector.py",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/AzureFunctionCiscoDuo/state_manager.py",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuo_API_FunctionApp.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoActivity_CCF/CiscoDuoActivity_DCR.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoActivity_CCF/CiscoDuoActivity_PollingConfig.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoActivity_CCF/CiscoDuoActivity_Table.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoAuth_CCF/CiscoDuoAuth_DCR.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoAuth_CCF/CiscoDuoAuth_PollingConfig.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoAuth_CCF/CiscoDuoAuth_Table.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoSecurity_func.zip",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoTelephony_CCF/CiscoDuoTelephony_DCR.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoTelephony_CCF/CiscoDuoTelephony_PollingConfig.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/CiscoDuoTelephony_CCF/CiscoDuoTelephony_Table.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/host.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/local.settings.example.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/proxies.json",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/README.md",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    },
+    {
+      "path": "Data Connectors/requirements.txt",
+      "artifactType": "DataConnector",
+      "reason": "Legacy Azure Function connector file or CCF sub-component (DCR/PollingConfig/Table) retained in Data Connectors/ and consumed via the 3 CCF ConnectorDefinition files."
+    }
+  ]
+}