[vah_13 (vah13)]

Change(s)

Adds the first preview of RedRays SAP Security Findings to Content Hub:

• A data connector for scheduled exports through the Azure Monitor Logs Ingestion API.
• Six analytics rule templates with descriptive filenames. Missing export heartbeats are monitored in the workbook as operational health, rather than an ATT&CK detection.
• A workbook for findings, scan coverage and export health.
• Deployment templates for eight custom tables, a direct-ingestion DCR and its scoped ingestion role assignment.
• Solution metadata, the build package, setup documentation, logo, workbook registry entry and custom table schemas for KQL validation.

The supported modules are SAP Vulnerability Assessment, ABAP Code Security, BTP Security, Segregation of Duties, SAP Profile Parameters and Password Security. RedRays runs in the customer's existing on-premises or cloud environment and sends data at a configurable interval.

Reason for Change(s)

Give RedRays customers a Content Hub entry with reusable security content and setup instructions, so they can review SAP assessment findings alongside their other Sentinel data.

This release covers assessment findings. It does not collect SAP Security Audit Log events, populate ABAPAuditLog or activate Microsoft's built-in SAP audit detections. It uses the Logs Ingestion API, not the legacy HTTP Data Collector API. Installing the solution does not enable analytics rules automatically.

Version Updated

• New solution: 3.0.0 (initial preview).
• Analytics rule templates and workbook metadata: 1.0.2 during preview review.

Testing Completed

• Installed a test build in an existing Microsoft Sentinel workspace and inspected it in the Defender portal.
• Confirmed that the connector reports Connected and shows received data for all eight table types.
• Ran the workbook's findings, export health and scan coverage queries against ingested data.
• The earlier test deployment exposed seven analytics templates. The revised package contains six finding templates and keeps heartbeat monitoring in the workbook. Active rule execution and incident creation have not yet been validated.
• Passed all 27 local RedRays packaging tests, including comparison of the generated assets with the Liquibase changesets executed in a disposable PostgreSQL container.
• Checked JSON/YAML parsing, package contents, table/schema consistency, connector logos and ZIP/template consistency.

The portal screenshots below show the test deployment before the final wording and package metadata cleanup. They demonstrate installation, ingestion and workbook results; they do not establish a clean-workspace installation or end-to-end incident testing.

Review updates and remaining questions

• Renamed all six finding YAML files to descriptive rule names and updated package references.
• Added the SVG source under the solution Data Connectors folder and both light/dark previews under the solution Workbooks/Images/Preview folder.
• Set the initial solution release to 3.0.0, updated Release Notes and regenerated the package.
• Mapped authorized password recovery to CredentialAccess / T1110. The five broad VA, ABAP, BTP, SoD and profile-assessment rules span different weaknesses; they retain empty mappings pending Microsoft guidance, rather than attributing every finding to an unsupported attack technique. Would assessment findings be accepted without mappings, or should these broad templates be replaced with technique-specific checks?
• Removed the missing-heartbeat analytics template and kept stale-export monitoring in the workbook. A missing heartbeat is operational health, without evidence of an ATT&CK technique.
• Clarified the architecture: the customer-controlled RedRays backend pushes records directly through the Azure Monitor Logs Ingestion API and DCR. No Azure Function is deployed or used. Guidance on the appropriate connector classification or CCF path for this push model would be appreciated.

Validation Status

Ran the repository's official build-and-validate.ps1 workflow. Final validation-only run on the committed changes: 15 validators passed, one failed and two skipped. Detection schema (24 tests), KQL (13 tests), JSON/YAML, connector, logo, workbook and the CI-compatible ARM-TTK runner (48 checks) passed.

Hyperlink validation fails because the new logo URL in upstream master is not available before merge; it also reports timeout warnings for the documented redrays.example placeholder. ID-change validation was skipped by the local runner, and TruffleHog was unavailable.

The V3 packager generated matching ZIP/JSON artifacts, but its unfiltered ARM-TTK step still reports 49/50 checks: IDs Should Be Derived From ResourceIDs flags generated content IDs and custom-detail column identifiers. The separate repository runner applies its standard exclusions and passes. No generated template fields or validator exclusions were manually changed to suppress this result.

Clean-workspace installation, upgrade scenarios and incident-generation tests remain to be completed. The screenshots below are from the earlier seven-template preview and do not validate the revised package end to end.

Screenshots

Analytics rule templates

Earlier preview: seven templates were available. The revised package removes the operational heartbeat template, leaving five High severity finding rules and the Medium severity profile parameter rule. No active rules are shown in this historical capture.

Connected data connector

The RedRays connector reports Connected, displays the product logo and lists received data for all eight custom table types.

Workbook results

The workbook displays ingested findings grouped by module, severity and source status, plus export health with no queued or pending records in this capture.

[vah_13 (vah13)]

@microsoft-github-policy-service agree company="RedRays, Inc."

[Copilot]

Copilot review overview

🟡 Changes recommended

Analytics validation blockers, incomplete workbook registration and incorrect multi-instance heartbeat grouping remain unresolved.

Review effort: Balanced
Findings: 9 · 3

Open (12)

• Add required fields and preview status to RedRays templates · New
• Register RedRaysSAPSecurityFindings connector ID · New
• Set TemplateSpec false for version 3.x · New
• Declare connector as non-first-party · New
• Add workbook template ID and schema · New
• Correct workbook registry provider and subtitle fields · New
• Add workbook at the registered root location · New
• Add missing RedRays workbook logo · New
• Add light and dark workbook preview images · New
• Configure alert grouping per result · New
• Use repository-hosted SVG for solution logo · New
• Add shared time-range parameter to workbook panels · New

What changed in this PR

Adds the first RedRays SAP Security Findings preview to Microsoft Sentinel Content Hub, covering assessment findings rather than SAP audit events.

Changes:

• Adds seven analytics templates and a findings, coverage and export-health workbook.
• Supplies solution metadata, deployment documentation and branding.
• Adds eight custom-table schemas for repository KQL validation.

File	Description
Workbooks/​WorkbooksMetadata.json	Registers the RedRays workbook.
Solutions/​RedRays SAP Security Findings/​Workbooks/​RedRaysSAPSecurityFindings.json	Displays findings, coverage and export health.
Solutions/​RedRays SAP Security Findings/​SolutionMetadata.json	Defines publisher and support metadata.
Solutions/​RedRays SAP Security Findings/​ReleaseNotes.md	Records the initial preview release.
Solutions/​RedRays SAP Security Findings/​README.md	Documents setup, behavior and limitations.
Solutions/​RedRays SAP Security Findings/​Package/​testParameters.json	Supplies package parameters; excluded from review.
Solutions/​RedRays SAP Security Findings/​Package/​createUiDefinition.json	Supplies installation UI; excluded from review.
Solutions/​RedRays SAP Security Findings/​Deployment/​setup.json	Describes setup steps and limitations.
Solutions/​RedRays SAP Security Findings/​Deployment/​schema.json	Defines eight ingestion table schemas.
Solutions/​RedRays SAP Security Findings/​Data/​Solution_RedRays SAP Security Findings.json	Lists solution content and packaging settings.
Solutions/​RedRays SAP Security Findings/​Data Connectors/​RedRaysSAPSecurityFindings.json	Defines the connector; excluded from review.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays07.yaml	Detects missing export heartbeats.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays06.yaml	Alerts on password security findings.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays05.yaml	Alerts on vulnerable profile parameters.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays04.yaml	Alerts on segregation-of-duties findings.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays03.yaml	Alerts on BTP security findings.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays02.yaml	Alerts on ABAP code findings.
Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays01.yaml	Alerts on SAP vulnerability findings.
Logos/​RedRays.svg	Adds shared vendor branding.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysVulnerabilities_CL.json	Defines vulnerability query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysSoDFindings_CL.json	Defines segregation-of-duties query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysScanRuns_CL.json	Defines scan-coverage query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysProfileChecks_CL.json	Defines profile-check query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysPasswordFindings_CL.json	Defines password-finding query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysExportHealth_CL.json	Defines export-health query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysCloudFindings_CL.json	Defines cloud-finding query-validation schema.
.script/​tests/​KqlvalidationsTests/​CustomTables/​RedRaysAbapFindings_CL.json	Defines ABAP-finding query-validation schema.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Clean-workspace installation, upstream KQL validation and incident-generation testing remain pending, requiring final human review.

Review effort: Balanced
Findings: 1

Open (1)

• Add entity mappings to detection finding templates · New

Resolved since last review (12)

• Add light and dark workbook preview images
• Add missing RedRays workbook logo
• Add workbook at the registered root location
• Correct workbook registry provider and subtitle fields
• Add workbook template ID and schema
• Declare connector as non-first-party
• Set TemplateSpec false for version 3.x
• Register RedRaysSAPSecurityFindings connector ID
• Add required fields and preview status to RedRays templates
• Add shared time-range parameter to workbook panels
• Use repository-hosted SVG for solution logo
• Configure alert grouping per result

[Copilot]

Copilot review overview

🔵 Needs a closer look

Upstream validation, clean-workspace installation, upgrades and end-to-end incident generation remain pending and require maintainer review.

Review effort: Balanced
Findings: 1

Open (1)

• Add preview status and required technology links to Content Hub description · New

Resolved since last review (1)

• Add entity mappings to detection finding templates

[Copilot]

Copilot review overview

🔵 Needs a closer look

Clean-workspace deployment, upgrades, incident generation and upstream validation remain pending and require maintainer review.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Add preview status and required technology links to Content Hub description

Previously missed (1)

In code that hasn't changed since last review

RedRays rule descriptions use noncompliant opening wording

Solutions/​RedRays SAP Security Findings/​Analytic Rules/​RedRays01.yaml:3

All seven RedRays rule descriptions start with “Alerts on” or “Alerts when”, rather than the required “Identifies” or “This query searches for”. In RedRays01–RedRays06, replace “Alerts on” with “Identifies”. For RedRays07, use “Identifies previously connected RedRays instances that stop sending export heartbeats.” This is a description-format correction; the queries do not need to change.

[vah_13 (vah13)]

v-atulyadav v-maheshbh (@v-maheshbh) all issues have been fixed

[v-maheshbh (v-maheshbh)]

Hi vah_13 (@vah13)

Tactics and relevant techniques are mandatory. Please add the appropriate ATT&CK mappings and rename the files to use meaningful rule names instead of numbered filenames (e.g., RedRays01.yaml, RedRays02.yaml, etc.) to align with repository naming conventions.

data connector:
For the Data Connector, please add a logo in SVG format.
solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com to discuss available options.

Kindly add both black‑and‑white preview images inside solution the workbook preview images folder as well.

Since this is a new solution, the solution version should be 3.0.0. Kindly update the version accordingly and ensure the Release Notes are updated to reflect version 3.0.0 with the changes introduced in this release.

Thanks!

[vah_13 (vah13)]

Hi v-maheshbh (@v-maheshbh), thanks for reviewing this.

I’ve updated the PR with descriptive rule filenames, an SVG logo in the solution’s Data Connectors folder, and both light and dark previews in the solution’s workbook preview folder. The solution version and release notes now reflect the initial 3.0.0 release.

For ATT&CK, I added CredentialAccess / T1110 to the password recovery rule. I also removed the missing-heartbeat analytics rule and kept that monitoring in the workbook, since an export failure alone doesn’t indicate an attack.

Both previews are now included under Solutions/RedRays SAP Security Findings/Workbooks/Images/Preview/:

• RedRaysSAPSecurityFindingsBlack.png
• RedRaysSAPSecurityFindingsWhite.png

The remaining five rules cover broad security assessment findings. Assigning one technique to every finding could be misleading. Would you prefer these to remain assessment rules without mappings, or should we replace them with narrower, technique-specific rules?

One clarification about the connector, it doesn’t use Azure Functions. The RedRays backend sends data directly through the Azure Monitor Logs Ingestion API and a DCR. Could you advise whether CCF is required for this push-based integration?

Thanks again for your guidance.

[vah_13 (vah13)]

The content validation CI failed due to a rate limit error.

[v-maheshbh (v-maheshbh)]

Hi vah_13 (@vah13)

For the Data Connector, please add a logo in SVG format.

Robert Moriarty (@robertmoriarty12) RedRays backend sends data directly through the Azure Monitor Logs Ingestion API and a DCR. Could you advise whether CCF is required for this push-based integration?

Thanks!

[vah_13 (vah13)]

v-maheshbh (@v-maheshbh), logo has been fixed.

[vah_13 (vah13)]

Hello v-maheshbh (@v-maheshbh), is there anything else that I can add in the PR?

Thank you.

[v-maheshbh (v-maheshbh)]

Hi vah_13 (@vah13)

As mentioned earlier, we are awaiting confirmation on whether CCF is required for this solution.

Thanks!

[v-maheshbh (v-maheshbh)]

Hi vah_13 (@vah13)

Kindly resolve the branch conflict.

please reach out to the Microsoft Sentinel Partners team at AzureSentinelPartner@microsoft.com to discuss the available options for CCF. Once you receive a response, please let me know so we can proceed with the next steps.

Thanks!