[johndoebui]

Change(s):

• New solution: HoneyForge Threat Detection v1.0.0 — CEF/Syslog data connector, NRT analytic rule, ASIM NetworkSession parser, 5 hunting queries, operational workbook

Reason for Change(s):

• New Content Hub solution from BUI for the HoneyForge hardware honeypot SaaS platform. Ingests deception sensor events via CEF syslog and provides out-of-the-box detection, hunting, and operational visibility content.

Version Updated:

• 1.0.0 (new solution, initial submission)

Testing Completed:

• Analytic rule KQL validated against CommonSecurityLog schema
• ASIM parser validated against NetworkSession schema v0.2.6
• ARM mainTemplate.json and createUiDefinition.json follow Content Hub V3 format
• All 13 files included: connector, analytic rule, parser, 5 hunting queries, workbook, logo, solution metadata, ARM package

Checked that the validations are passing and have addressed any issues that are present:

• Package structure follows Content Hub V3 conventions
• Publisher: BUI | Support: support@bui.co.za

[johndoebui]

@microsoft-github-policy-service agree company="BUI"

[johndoebui]

@microsoft-github-policy-service agree company="BUI" Sensitivity: Business - General From: microsoft-github-policy-service[bot] ***@***.***> Sent: Monday, 20 July 2026 14:20 To: Azure/Azure-Sentinel ***@***.***> Cc: j.doe ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Add HoneyForge Threat Detection solution v1.0.0 (PR #14715) [https://avatars.githubusercontent.com/in/95686?s=20&v=4]microsoft-github-policy-service[bot] left a comment (Azure/Azure-Sentinel#14715)<#14715 (comment)> @johndoebui<https://github.com/johndoebui> please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information. @microsoft-github-policy-service agree [company="{your company}"] Options: * (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer. @microsoft-github-policy-service agree * (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term "You" includes me and my employer. @microsoft-github-policy-service agree company="Microsoft" Contributor License Agreement Contribution License Agreement This Contribution License Agreement ("Agreement") is agreed to by the party signing below ("You"), and conveys certain license rights to Microsoft Corporation and its affiliates ("Microsoft") for Your contributions to Microsoft open source projects. This Agreement is effective as of the latest signature date below. 1. Definitions. "Code" means the computer software code, whether in human-readable or machine-executable form, that is delivered by You to Microsoft under this Agreement. "Project" means any of the projects owned or managed by Microsoft and offered under a license approved by the Open Source Initiative (www.opensource.org<http://www.opensource.org/>). "Submit" is the act of uploading, submitting, transmitting, or distributing code or other content to any Project, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing and improving that Project, but excluding communication that is conspicuously marked or otherwise designated in writing by You as "Not a Submission." "Submission" means the Code and any other copyrightable material Submitted by You, including any associated comments and documentation. 2. Your Submission. You must agree to the terms of this Agreement before making a Submission to any Project. This Agreement covers any and all Submissions that You, now or in the future (except as described in Section 4 below), Submit to any Project. 3. Originality of Work. You represent that each of Your Submissions is entirely Your original work. Should You wish to Submit materials that are not Your original work, You may Submit them separately to the Project if You (a) retain all copyright and license information that was in the materials as You received them, (b) in the description accompanying Your Submission, include the phrase "Submission containing materials of a third party:" followed by the names of the third party and any licenses or other restrictions of which You are aware, and (c) follow any other instructions in the Project's written guidelines concerning Submissions. 4. Your Employer. References to "employer" in this Agreement include Your employer or anyone else for whom You are acting in making Your Submission, e.g. as a contractor, vendor, or agent. If Your Submission is made in the course of Your work for an employer or Your employer has intellectual property rights in Your Submission by contract or applicable law, You must secure permission from Your employer to make the Submission before signing this Agreement. In that case, the term "You" in this Agreement will refer to You and the employer collectively. If You change employers in the future and desire to Submit additional Submissions for the new employer, then You agree to sign a new Agreement and secure permission from the new employer before Submitting those Submissions. 5. Licenses. * Copyright License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties. * Patent License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Your patent claims that are necessarily infringed by the Submission or the combination of the Submission with the Project to which it was Submitted to make, have made, use, offer to sell, sell and import or otherwise dispose of the Submission alone or with the Project. * Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise. 1. Representations and Warranties. You represent that You are legally entitled to grant the above licenses. You represent that each of Your Submissions is entirely Your original work (except as You may have disclosed under Section 3). You represent that You have secured permission from Your employer to make the Submission in cases where Your Submission is made in the course of Your work for Your employer or Your employer has intellectual property rights in Your Submission by contract or applicable law. If You are signing this Agreement on behalf of Your employer, You represent and warrant that You have the necessary authority to bind the listed employer to the obligations contained in this Agreement. You are not expected to provide support for Your Submission, unless You choose to do so. UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, AND EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN SECTIONS 3, 4, AND 6, THE SUBMISSION PROVIDED UNDER THIS AGREEMENT IS PROVIDED WITHOUT WARRANTY OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. 2. Notice to Microsoft. You agree to notify Microsoft in writing of any facts or circumstances of which You later become aware that would make Your representations in this Agreement inaccurate in any respect. 3. Information about Submissions. You agree that contributions to Projects and information about contributions may be maintained indefinitely and disclosed publicly, including Your name and other information that You submit with Your Submission. 4. Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and the parties consent to exclusive jurisdiction and venue in the federal courts sitting in King County, Washington, unless no federal subject matter jurisdiction exists, in which case the parties consent to exclusive jurisdiction and venue in the Superior Court of King County, Washington. The parties waive all defenses of lack of personal jurisdiction and forum non-conveniens. 5. Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and supersedes any and all prior agreements, understandings or communications, written or oral, between the parties relating to the subject matter hereof. This Agreement may be assigned by Microsoft. - Reply to this email directly, view it on GitHub<#14715?email_source=notifications&email_token=A75LLW472O4JJLW454NGO7T5FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5022146325>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A75LLW2M73FVBIN4MOLYLM35FYE7TAVCNFSNUABFKJSXA33TNF2G64TZHMYTINJRHAZTENZRHNEXG43VMU5TIOJSHA4DKOBZGA22C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/A75LLW7BSBBJYHAQUGOO3635FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android<https://github.com/notifications/mobile/android/A75LLW443AHM5NLWTIJFLLL5FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> BUI Disclaimer: This email and the information contained herein is BUI confidential and is protected by law. Use of this information or this email by any person for any purposes other than that for which it is intended is prohibited and may result in civil and/or criminal liability. This email is not to be shared with any 3rd parties not included within this email, without written consent of its Author

[johndoebui]

@microsoft-github-policy-service agree [company="BUI"] Sensitivity: Business - General From: microsoft-github-policy-service[bot] ***@***.***> Sent: Monday, 20 July 2026 14:20 To: Azure/Azure-Sentinel ***@***.***> Cc: j.doe ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Add HoneyForge Threat Detection solution v1.0.0 (PR #14715) [https://avatars.githubusercontent.com/in/95686?s=20&v=4]microsoft-github-policy-service[bot] left a comment (Azure/Azure-Sentinel#14715)<#14715 (comment)> @johndoebui<https://github.com/johndoebui> please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information. @microsoft-github-policy-service agree [company="{your company}"] Options: * (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer. @microsoft-github-policy-service agree * (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term "You" includes me and my employer. @microsoft-github-policy-service agree company="Microsoft" Contributor License Agreement Contribution License Agreement This Contribution License Agreement ("Agreement") is agreed to by the party signing below ("You"), and conveys certain license rights to Microsoft Corporation and its affiliates ("Microsoft") for Your contributions to Microsoft open source projects. This Agreement is effective as of the latest signature date below. 1. Definitions. "Code" means the computer software code, whether in human-readable or machine-executable form, that is delivered by You to Microsoft under this Agreement. "Project" means any of the projects owned or managed by Microsoft and offered under a license approved by the Open Source Initiative (www.opensource.org<http://www.opensource.org/>). "Submit" is the act of uploading, submitting, transmitting, or distributing code or other content to any Project, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing and improving that Project, but excluding communication that is conspicuously marked or otherwise designated in writing by You as "Not a Submission." "Submission" means the Code and any other copyrightable material Submitted by You, including any associated comments and documentation. 2. Your Submission. You must agree to the terms of this Agreement before making a Submission to any Project. This Agreement covers any and all Submissions that You, now or in the future (except as described in Section 4 below), Submit to any Project. 3. Originality of Work. You represent that each of Your Submissions is entirely Your original work. Should You wish to Submit materials that are not Your original work, You may Submit them separately to the Project if You (a) retain all copyright and license information that was in the materials as You received them, (b) in the description accompanying Your Submission, include the phrase "Submission containing materials of a third party:" followed by the names of the third party and any licenses or other restrictions of which You are aware, and (c) follow any other instructions in the Project's written guidelines concerning Submissions. 4. Your Employer. References to "employer" in this Agreement include Your employer or anyone else for whom You are acting in making Your Submission, e.g. as a contractor, vendor, or agent. If Your Submission is made in the course of Your work for an employer or Your employer has intellectual property rights in Your Submission by contract or applicable law, You must secure permission from Your employer to make the Submission before signing this Agreement. In that case, the term "You" in this Agreement will refer to You and the employer collectively. If You change employers in the future and desire to Submit additional Submissions for the new employer, then You agree to sign a new Agreement and secure permission from the new employer before Submitting those Submissions. 5. Licenses. * Copyright License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license in the Submission to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute the Submission and such derivative works, and to sublicense any or all of the foregoing rights to third parties. * Patent License. You grant Microsoft, and those who receive the Submission directly or indirectly from Microsoft, a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license under Your patent claims that are necessarily infringed by the Submission or the combination of the Submission with the Project to which it was Submitted to make, have made, use, offer to sell, sell and import or otherwise dispose of the Submission alone or with the Project. * Other Rights Reserved. Each party reserves all rights not expressly granted in this Agreement. No additional licenses or rights whatsoever (including, without limitation, any implied licenses) are granted by implication, exhaustion, estoppel or otherwise. 1. Representations and Warranties. You represent that You are legally entitled to grant the above licenses. You represent that each of Your Submissions is entirely Your original work (except as You may have disclosed under Section 3). You represent that You have secured permission from Your employer to make the Submission in cases where Your Submission is made in the course of Your work for Your employer or Your employer has intellectual property rights in Your Submission by contract or applicable law. If You are signing this Agreement on behalf of Your employer, You represent and warrant that You have the necessary authority to bind the listed employer to the obligations contained in this Agreement. You are not expected to provide support for Your Submission, unless You choose to do so. UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, AND EXCEPT FOR THE WARRANTIES EXPRESSLY STATED IN SECTIONS 3, 4, AND 6, THE SUBMISSION PROVIDED UNDER THIS AGREEMENT IS PROVIDED WITHOUT WARRANTY OF ANY KIND, INCLUDING, BUT NOT LIMITED TO, ANY WARRANTY OF NONINFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. 2. Notice to Microsoft. You agree to notify Microsoft in writing of any facts or circumstances of which You later become aware that would make Your representations in this Agreement inaccurate in any respect. 3. Information about Submissions. You agree that contributions to Projects and information about contributions may be maintained indefinitely and disclosed publicly, including Your name and other information that You submit with Your Submission. 4. Governing Law/Jurisdiction. This Agreement is governed by the laws of the State of Washington, and the parties consent to exclusive jurisdiction and venue in the federal courts sitting in King County, Washington, unless no federal subject matter jurisdiction exists, in which case the parties consent to exclusive jurisdiction and venue in the Superior Court of King County, Washington. The parties waive all defenses of lack of personal jurisdiction and forum non-conveniens. 5. Entire Agreement/Assignment. This Agreement is the entire agreement between the parties, and supersedes any and all prior agreements, understandings or communications, written or oral, between the parties relating to the subject matter hereof. This Agreement may be assigned by Microsoft. - Reply to this email directly, view it on GitHub<#14715?email_source=notifications&email_token=A75LLW472O4JJLW454NGO7T5FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5022146325>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A75LLW2M73FVBIN4MOLYLM35FYE7TAVCNFSNUABFKJSXA33TNF2G64TZHMYTINJRHAZTENZRHNEXG43VMU5TIOJSHA4DKOBZGA22C5QC>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/A75LLW7BSBBJYHAQUGOO3635FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android<https://github.com/notifications/mobile/android/A75LLW443AHM5NLWTIJFLLL5FYE7TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMBSGIYTINRTGI22M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> BUI Disclaimer: This email and the information contained herein is BUI confidential and is protected by law. Use of this information or this email by any person for any purposes other than that for which it is intended is prohibited and may result in civil and/or criminal liability. This email is not to be shared with any 3rd parties not included within this email, without written consent of its Author

[johndoebui]

@microsoft-github-policy-service agree company="BUI"

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Microsoft Sentinel Content Hub solution (“HoneyForge Threat Detection” v1.0.0) to ingest HoneyForge CEF/Syslog events and provide out-of-box detections, hunting, parsing, and operational visibility.

Changes:

• Introduces HoneyForge solution metadata, ARM package, and createUiDefinition for Content Hub V3 deployment.
• Adds workbook content for operational visibility (overview/timeline/top sources/fleet health/severity/protocol/off-hours).
• Adds an ASIM NetworkSession parser plus an NRT analytic rule and five hunting queries based on CommonSecurityLog.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
Solutions/HoneyForge/Workbooks/HoneyForge.json	New operational workbook queries and visualizations for HoneyForge activity.
Solutions/HoneyForge/SolutionMetadata.json	Defines the solution’s marketplace metadata, support info, and publish dates.
Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml	Adds ASIM NetworkSession parser function HoneyForgeEvent.
Solutions/HoneyForge/Package/mainTemplate.json	ARM template to deploy solution metadata + connector + rule + parser + queries + workbook.
Solutions/HoneyForge/Package/createUiDefinition.json	Installer UX definition to select Log Analytics workspace for deployment.
Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml	Hunting query to identify top attacking source IPs.
Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml	Hunting query to find repeat probes separated into sessions.
Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml	Hunting query for off-hours sensor activity.
Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml	Hunting query for burst/high-frequency interactions.
Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml	Hunting query for per-sensor coverage/health.
Solutions/HoneyForge/Data Connectors/HoneyForge.json	Data connector definition + instructions to forward CEF syslog via Linux forwarder.
Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml	NRT analytic rule to alert on HoneyForge sensor interaction.

[v-shukore]

Hi johndoebui, please check copilot review comments and implement if required also resolve branch conflicts. Thanks!

[johndoebui]

Hi v-shukore, thanks for the review!

Copilot comments: All 9 comments are showing as "Outdated" — the specific lines they referenced were updated in subsequent commits (33feecf and c816951). No further changes are required as the underlying issues were addressed (ARM resource names, workbook TimeRange parameter, createUiDefinition providers, and parser filter logic).

Branch conflicts: Resolved — merged upstream master into the branch (commit 192875a). ValidConnectorIds.json has been updated with both the upstream additions and our HoneyForge entry.

CI is running on the latest commit. Thanks!

[v-shukore]

Hi johndoebui, I noticed you’ve created three new solutions. To keep things clear, please include only one solution in this PR and raise separate PRs for the other two. Also, when creating the new solutions, please create just one package with version 3.0.0 and commit the changes. Thanks!

[johndoebui]

Hi v-shukore, thanks for the feedback! I've addressed both points:

• The branch has been cleaned up — this PR now contains only the HoneyForge solution (13 files, single commit). The other two solutions that were accidentally included have been removed.
• The package version has been updated to 3.0.0 across SolutionMetadata.json and mainTemplate.json.

Please let me know if anything else needs adjusting. Thanks!

[v-shukore]

Hi johndoebui, please resolve branch conflicts. Thanks!

[johndoebui]

Hi v-shukore, branch conflicts resolved — merged latest upstream master into the branch. ValidConnectorIds.json now includes 340 entries (339 upstream + HoneyForge). No other conflicts. Please approve the workflow run when you get a chance. Thanks!

[v-shukore]

Hi johndoebui,

please use the V3 tool to package this new solution and create a new package at version 3.0.0.
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md.

Please let us know which type of connector you are using for this solution. We would also be happy to help migrate your solution to CCF. To review the available options, please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com. If this connector is needed, please obtain approval from the azure app assure team by email and share the screenshot with us so we can proceed.

Thanks!

[johndoebui]

ARM-TTK Validation Fixes

Addressed the 3 ARM-TTK failures from the "Arm-ttk Validations, Attempt #2" run:

1 & 2. IDs Should Be Derived From ResourceIDs (x2)

• Root cause: CustomerID and SensorID keys in customDetails end in "ID", which ARM-TTK flags as resource ID fields with literal string values
• Fix: Renamed keys to Customer and Sensor (values remain CustomerID/SensorID referencing the correct KQL columns)
• Updated groupByCustomDetails references accordingly
• Changed in both the analytic rule YAML source and mainTemplate.json

3. Template Should Not Contain Blanks

• Root cause: groupByAlertDetails: [] at line 632 in mainTemplate — empty arrays are flagged; the entrypoint.ps1 only exempts blanks on requiredDataConnectors lines
• Fix: Removed groupByAlertDetails: [] from both the YAML source and mainTemplate.json

Commits:

• 48472a19 — Fix analytic rule YAML (customDetails keys + remove groupByAlertDetails)
• 69794e8c — Fix mainTemplate.json (same changes)
• 25b96eb0 — Rebuild Package.zip with updated mainTemplate.json

All three source changes were made in the YAML source file as required; Package.zip was rebuilt accordingly.

[johndoebui]

Hi v-maheshbh (@v-maheshbh),

All CI checks on the latest commit (25b96eb0) are now passing:

• ✅ ARM-TTK - HoneyForge — passed (the 3 failures have been resolved)
• ✅ SolutionValidations — passed
• ✅ YamlFileValidation, ContentValidations, JsonFileValidation — all passed
• ✅ All other checks — passed, neutral, or skipped

The ARM-TTK fixes (renaming CustomerID/SensorID customDetails keys and removing the empty groupByAlertDetails) were applied to both the source YAML and mainTemplate.json, with Package.zip rebuilt accordingly.

The PR is ready for your review and merge. Could you please proceed when you get a chance? Thank you!

[v-maheshbh (v-maheshbh)]

Hi johndoebui

This mapping is not correct
Kindly update the MITRE ATT&CK mapping by replacing LateralMovement with InitialAccess, as T1190 maps to InitialAccess.

Kindly add the missing Reconnaissance tactic.

Thanks!

[johndoebui]

Hi v-maheshbh (@v-maheshbh), thank you for the review!

Both issues have been addressed:

1. LateralMovement → InitialAccess: Replaced LateralMovement with InitialAccess in the tactics mapping for T1190 (Exploit Public-Facing Application) across both the analytic rule YAML and the package's mainTemplate.json.
2. Reconnaissance tactic: Already present in the YAML; confirmed it is now correctly reflected in mainTemplate.json as well.

The package has been rebuilt and pushed. Please let me know if there is anything else to address.

[v-maheshbh (v-maheshbh)]

Hi johndoebui

As mentioned in the earlier review comments, changes to the main template are not recommended. Kindly make the required changes in the respective source files and repackage the solution accordingly.

Thanks!

[johndoebui]

Hi v-maheshbh (@v-maheshbh), apologies for the earlier direct template edit — I've corrected the approach.

All MITRE ATT&CK fixes have been made in the respective source YAML files:

• HoneyForge_DeceptionSensorInteraction.yaml (analytic rule) — tactics: Reconnaissance, InitialAccess (T1190 correctly mapped)
• HoneyForge_HighFrequency.yaml — removed incorrect LateralMovement, now Reconnaissance only (T1595, T1590)
• HoneyForge_OffHoursActivity.yaml — removed incorrect LateralMovement, now Reconnaissance only (T1595)
• HoneyForge_FleetCoverage.yaml — added missing Reconnaissance tactic (was empty)

The solution has been repackaged accordingly. Please let me know if anything else needs attention.

[v-maheshbh (v-maheshbh)]

Hi johndoebui

I have repackaged the solution with version 3.0.0. Kindly custom deploy the main template and provide the connector testing screenshots for validation.

Kindly ensure that the WorkbookMetadata changes are relevant to this solution only and remove any unrelated changes.
Thanks!

[johndoebui]

v-maheshbh (@v-maheshbh) Hi, here is the custom deployment validation as requested.

Deployment Validation

The HoneyForge ARM template (mainTemplate.json) was deployed successfully to the Microsoft Sentinel workspace using Azure Cloud Shell:

Deployment details:

• Subscription: <subscription-name> ()
• • Resource Group: <resource-group>
• • Workspace: <workspace-name>
• • Region: West Europe
• • Template: mainTemplate.json v3.0.3
    Command used:

az deployment group create \
  --resource-group <resource-group> \
  --template-uri "https://raw.githubusercontent.com/johndoebui/Azure-Sentinel/add-honeyforge-solution/Solutions/HoneyForge/Package/mainTemplate.json" \
  --parameters workspace=<workspace-name> workspace-location=westeurope workbook1-name=HoneyForge

Result: provisioningState: "Succeeded" at 2026-10-19T10:53:48Z

Screenshot 1 — ARM Deployment Succeeded

(image: deployment-succeeded.jpg - see attached)

Screenshot 2 — HoneyForge Connector Listed in Data Connectors

(image: data-connector-listed.jpg - see attached)

Screenshot 3 — Connector Details Panel

(image: connector-details.jpg - see attached)

Screenshot 4 — Full Connector Configuration Page

(image: connector-page.jpg - see attached)

---

Connector validation confirmed:

• Provider: BUI
• • Version: 1.0.0
• • Status: Visible in Data Connectors blade for workspace <workspace-name>
• • Content source: HoneyForge
• • Data connector type: GenericUI (DeviceVendor = "BUI", DeviceProduct = "HoneyForge")
    Please let me know if any additional validation is needed.

Originally posted by johndoebui in #14715 (comment)