Repository navigation
New solution: PolySwarm for Microsoft Sentinel (3.0.0) - #15388
Open
Erick Ingleby (erickingleby-polyswarm) wants to merge 1 commit into
Open
Erick Ingleby (erickingleby-polyswarm) wants to merge 1 commit into
Erick Ingleby (erickingleby-polyswarm) wants to merge 1 commit into
Conversation
Erick Ingleby (erickingleby-polyswarm)
requested review from
a team
as code owners
October 21, 2026 17:23
Author
|
@microsoft-github-policy-service agree company="Swarm Technologies Inc" |
v-atulyadav
added
Codeless Connector Framework (CCF) Connector
New Solution
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved query correctness, entity mapping, workbook reporting, and validation issues block approval.
7 open issues
What changed in this PR
Introduces the PolySwarm 3.0.0 solution for Microsoft Sentinel, integrating threat intelligence, incident enrichment, sandbox detonation, and workspace monitoring.
Changes:
- Adds two codeless connectors, three disabled analytics rules, and four hunting queries.
- Adds fifteen playbooks with deployment, permissions, and migration documentation.
- Adds status workbooks, solution metadata, branding, and connector-ID registrations.
| File | Description and review findings |
|---|---|
Workbooks/WorkbooksMetadata.json |
Registers the workbook. Moderate: Referenced logo is missing from Workbooks/Images/Logos, causing metadata validation to fail. |
Workbooks/PolySwarmStatus.json |
Adds the gallery dashboard. Moderate: Exact-name filtering excludes dynamically named malicious-file alerts. |
Solutions/PolySwarm/Workbooks/PolySwarmStatus.json |
Adds the packaged dashboard. Moderate: The alert tile likewise excludes dynamically named malicious-file alerts. |
Solutions/PolySwarm/SolutionMetadata.json |
Defines publisher, support, and categories. |
Solutions/PolySwarm/ReleaseNotes.md |
Records the initial release. |
Solutions/PolySwarm/Playbooks/PolySwarm-Sandbox-Url/readme.md |
Documents URL detonation and safeguards. |
Solutions/PolySwarm/Playbooks/PolySwarm-Sandbox-StorageBlob/readme.md |
Documents blob detonation and storage access. |
Solutions/PolySwarm/Playbooks/PolySwarm-Sandbox-OutlookAttachment/readme.md |
Documents preview attachment detonation. |
Solutions/PolySwarm/Playbooks/PolySwarm-Enrich-Url/readme.md |
Documents URL enrichment. |
Solutions/PolySwarm/Playbooks/PolySwarm-Enrich-Ip/readme.md |
Documents IP enrichment and result interpretation. |
Solutions/PolySwarm/Playbooks/PolySwarm-Enrich-FileHash/readme.md |
Documents hash enrichment and authentication. |
Solutions/PolySwarm/Playbooks/PolySwarm-Enrich-Domain/readme.md |
Documents domain enrichment. |
Solutions/PolySwarm/Playbooks/PolySwarm-CheckQuota/readme.md |
Documents quota checks and thresholds. |
Solutions/PolySwarm/Package/testParameters.json |
Listed generated-package path; excluded from review. |
Solutions/PolySwarm/Hunting Queries/PolySwarmThreatHuntUrl.yaml |
Correlates URLs with web sessions. Moderate: Whole-URL lowercasing conflates case-sensitive resources and changes the observed URL. Moderate: Metadata extraction reads event AdditionalFields, not indicator AdditionalFields1. |
Solutions/PolySwarm/Hunting Queries/PolySwarmThreatHuntIp.yaml |
Correlates IP indicators with network sessions. Moderate: Metadata extraction reads event fields instead of the indicator’s malware family and report link. |
Solutions/PolySwarm/Hunting Queries/PolySwarmThreatHuntHash.yaml |
Correlates hashes with file events. Moderate: Algorithm and Value must share one FileHash entity mapping. Moderate: Metadata extraction reads event fields rather than indicator metadata. |
Solutions/PolySwarm/Hunting Queries/PolySwarmThreatHuntDomain.yaml |
Correlates domains with DNS activity. Moderate: Metadata extraction reads DNS-event fields rather than indicator metadata. |
Solutions/PolySwarm/docs/upgrading.md |
Explains migration from earlier playbooks. |
Solutions/PolySwarm/docs/permissions.md |
Documents Azure and API permissions. Nit: Distinguish RBAC-only role assignments from the secret Get access policy needed for access-policy vaults. |
Solutions/PolySwarm/Data/Solution_PolySwarm.json |
Defines solution packaging inputs. Moderate: Descriptions on lines 5 and 44 exceed the required 1,000-character limit. |
Solutions/PolySwarm/Data Connectors/PolySwarmSandboxResults/readme.md |
Listed connector documentation; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmHunting_CCF/readme.md |
Listed hunting-connector documentation; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmHunting_CCF/PolySwarmHunting_CCF_PollerConfig.json |
Listed hunting poller configuration; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmHunting_CCF/PolySwarmHunting_CCF_DataConnectorDefinition.json |
Listed hunting connector definition; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmFeed_CCF/readme.md |
Listed feed-connector documentation; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmFeed_CCF/PolySwarmFeed_CCF_PollerConfig.json |
Listed feed poller configuration; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmFeed_CCF/PolySwarmFeed_CCF_DCR.json |
Listed feed data-collection rule; excluded from review. |
Solutions/PolySwarm/Data Connectors/PolySwarmFeed_CCF/PolySwarmFeed_CCF_DataConnectorDefinition.json |
Listed feed connector definition; excluded from review. |
Solutions/PolySwarm/Analytic Rules/PolySwarm_SandboxDetonationMalicious.yaml |
Detects malicious sandbox results. |
Solutions/PolySwarm/Analytic Rules/PolySwarm_MaliciousFileObserved.yaml |
Correlates hashes with security telemetry. Moderate: Strict unions fail when source tables are absent. Moderate: innerunique arbitrarily drops indicators sharing a hash; use inner to preserve their evidence. |
Solutions/PolySwarm/Analytic Rules/PolySwarm_HighConfidenceHuntHit.yaml |
Detects high-confidence hunt indicators. Moderate: Filtering before selecting the latest row per Id can alert on obsolete active/high-confidence states. |
Logos/PolySwarm.svg |
Adds solution branding. |
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json |
Registers both PolySwarm connector IDs. |
Review effort: Balanced
| "Name": "PolySwarm", | ||
| "Author": "PolySwarm - support@polyswarm.io", | ||
| "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/PolySwarm.svg\" width=\"75px\" height=\"75px\">", | ||
| "Description": "[PolySwarm](https://polyswarm.io) is a threat intelligence platform built on a marketplace of competing detection engines. Files, URLs, IP addresses and domains are analyzed by multiple engines in parallel, their consensus is scored as a single PolyScore, PolyUnite identifies the malware family, and sandbox detonation adds behavioral analysis. This solution enriches Microsoft Sentinel incident entities (file hashes, URLs, IP addresses and domains) with PolySwarm's multi-engine malware verdicts, naming every engine that agreed, and lets an analyst detonate a URL, an email attachment, an Azure Storage blob, or a file retrieved directly from a device through Microsoft Defender for Endpoint, in the PolySwarm sandbox, returning a score-derived verdict, malware family, MITRE ATT&CK techniques and a report link on the incident. Data connectors bring PolySwarm threat intelligence, from an organization's own PolySwarm hunt results and from the PolySwarm curated feed, into Microsoft Sentinel's native threat intelligence table, so Microsoft's built-in indicator matching runs against PolySwarm data alongside the analytics rules and hunting queries this solution provides.\n\nCoverage by indicator type: MD5, SHA-1, SHA-256, URL, domain and IP are answered. Email addresses are not supported, because PolySwarm has no endpoint for them. A small PolySwarm status workbook shows what has arrived from each connector, reading only your own workspace.\n\nUnderlying Microsoft Technologies used:\nThis solution depends on underlying Microsoft technologies. Some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n* [Logic Apps](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-pricing)\n* [Microsoft Sentinel Codeless Connector Framework](https://learn.microsoft.com/en-us/azure/sentinel/create-codeless-connector)\n* [Threat Indicators](https://learn.microsoft.com/en-us/azure/sentinel/upload-indicators-api)\n* [Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/pricing)", |
Comment on lines
+48
to
+51
| - entityType: FileHash | ||
| fieldMappings: | ||
| - identifier: Algorithm | ||
| columnName: HashType |
| query: | | ||
| _Im_WebSession | ||
| | where isnotempty(Url) | ||
| | extend Url = tolower(Url) |
| "type": 3, | ||
| "content": { | ||
| "version": "KqlItem/1.0", | ||
| "query": "union isfuzzy=true SecurityAlert, (datatable(TimeGenerated:datetime, AlertName:string, AlertSeverity:string, Status:string)[])\n| where TimeGenerated {TimeRange}\n| where AlertName in~ ('PolySwarm high-confidence hunt hit', 'PolySwarm malicious file observed', 'PolySwarm sandbox detonation malicious')\n| summarize Alerts = count(), ['Last alert'] = max(TimeGenerated) by AlertName, AlertSeverity", |
| "type": 3, | ||
| "content": { | ||
| "version": "KqlItem/1.0", | ||
| "query": "union isfuzzy=true SecurityAlert, (datatable(TimeGenerated:datetime, AlertName:string, AlertSeverity:string, Status:string)[])\n| where TimeGenerated {TimeRange}\n| where AlertName in~ ('PolySwarm high-confidence hunt hit', 'PolySwarm malicious file observed', 'PolySwarm sandbox detonation malicious')\n| summarize Alerts = count(), ['Last alert'] = max(TimeGenerated) by AlertName, AlertSeverity", |
| }, | ||
| { | ||
| "workbookKey": "PolySwarmStatusWorkbook", | ||
| "logoFileName": "PolySwarm.svg", |
| | Component | Role | Scope | Why this role and not a broader one | | ||
| | --- | --- | --- | --- | | ||
| | Every enrichment playbook (file hash, URL, IP, domain; both incident and entity trigger) | Microsoft Sentinel Responder | Resource group or Sentinel workspace | Lets the playbook read incident entities and add comments. Does not grant it the ability to change analytics rules, automation rules or workspace configuration, which **Microsoft Sentinel Contributor** would. | | ||
| | Every playbook that reads the PolySwarm API key from Key Vault | Key Vault Secrets User | The Key Vault, or the individual secret if the vault uses access-policy scoping | Read-only access to secret values. Does not grant the ability to create, delete or manage secrets, keys or certificates, which **Key Vault Administrator** or **Key Vault Secrets Officer** would. | |
Contributor
|
Hi Erick Ingleby (@erickingleby-polyswarm) Kindly check the Copilot comments. If the feedback has been addressed, please mark the corresponding comments as resolved. Kindly add both black‑and‑white preview images inside solution workbook preview images folder, and also add the images and logo under the following path as well Kindly attach a screenshot showing the CCF connector in a connected state for validation and review purposes Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present:
Branch: polyswarm-solution, from a fork at polyswarm/Azure-Sentinel, into Azure/Azure-Sentinel master.