Repository navigation
Migrate 10 Sentinel solutions to Defender XDR in Qualification Mode (v3.2.2) - #15395
Open
idoshabi07 wants to merge 3 commits into
Open
idoshabi07 wants to merge 3 commits into
idoshabi07 wants to merge 3 commits into
Conversation
github-actions
Bot
added
1P Solution
idoshabi07
force-pushed
the
content/qual-batch-2-3-2-2
branch
from
October 22, 2026 13:28
db919c7 to
0f5a5a2
Compare
- Migrate 10 solutions to Defender XDR v3.2.2 with V3.1 packaging: - Cisco ISE - Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel - GDPR Compliance & Data Security - Google Cloud Platform Security Command Center - MaturityModelForEventLogManagementM2131 - NISTSP80053 - Oracle Cloud Infrastructure - VMWareESXi - VMware vCenter - Zinc Open Source - Keep all existing Sentinel Analytic Rules, Workbooks, and Data Connectors unchanged - Include sanitized Evidence/pr-qualification reports and summaries for all 10 solutions - Update .github/actions/entrypoint.ps1 for V3.1 XDR nested template ARM-TTK validation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ce1d21a4-1e05-48fd-bc25-8d15e6ec3765
idoshabi07
force-pushed
the
content/qual-batch-2-3-2-2
branch
from
October 22, 2026 14:16
0f5a5a2 to
f7cfdd3
Compare
v-sabiraj
reviewed
Oct 22, 2026
v-sabiraj
reviewed
Oct 22, 2026
v-sabiraj
reviewed
Oct 22, 2026
v-sabiraj
reviewed
Oct 22, 2026
v-sabiraj
reviewed
Oct 22, 2026
- Fix missing opening parenthesis in IP regex in VMWareESXi ESXiMultipleFailedSSHLogin.yaml - Fix description typos across Cisco ISE, MaturityModelForEventLogManagementM2131 (EL0-EL3), NISTSP80053, and VMWareESXi XDR Detections - Update corresponding V3.1 Package/mainTemplate.json and Package/3.2.2.zip artifacts Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ce1d21a4-1e05-48fd-bc25-8d15e6ec3765
v-sabiraj
reviewed
Oct 22, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ce1d21a4-1e05-48fd-bc25-8d15e6ec3765
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
One or more issues must be addressed before approval.
33 open issues
And 13 more that still need to be addressed.
What changed in this PR
Extends ten existing Microsoft Sentinel solutions with Defender XDR content references and release metadata for version 3.2.2, including new disabled Custom Detection definitions for V3.1 packaging.
Changes:
- Adds converted detections with source provenance, dependencies, schedules, and entity mappings.
- Registers XDR detections and workbooks alongside existing Sentinel content.
- Adds customer-usage tracking IDs and updates solution versions and release notes.
Review covers the supplied diffs. Generated Package/ files were excluded under repository review instructions; live qualification was not independently verified. Paths below are relative to Solutions/.
| File | Description |
|---|---|
| Solutions/Zinc Open Source/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/Zinc Open Source/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/Zinc Open Source/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/Zinc Open Source/Package/createUiDefinition.json | Updated as part of this pull request. |
| Solutions/Zinc Open Source/Data/Solution_ZINC.json | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiUnexpectedDiskImage.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiSSHEnableOnHost.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiSharedOrStolenRootAccount.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiRootPasswordChange.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiRootLogin.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/XDR Detections/ESXiMultipleFailedSSHLogin.yaml | Updated as part of this pull request. |
| Solutions/VMWareESXi/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/VMWareESXi/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/VMWareESXi/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/VMWareESXi/Package/createUiDefinition.json | Updated as part of this pull request. |
| Solutions/VMWareESXi/Data/Solution_VMWareESXi.json | Updated as part of this pull request. |
| Solutions/VMware vCenter/XDR Detections/vCenterRootLogin.yaml | Updated as part of this pull request. |
| Solutions/VMware vCenter/XDR Detections/vCenter-Root impersonation.yaml | Updated as part of this pull request. |
| Solutions/VMware vCenter/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/VMware vCenter/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/VMware vCenter/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/VMware vCenter/Package/createUiDefinition.json | Updated as part of this pull request. |
| Solutions/VMware vCenter/Data/Solution_vcenter.json | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIUnexpectedUserAgent.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCISSHScan.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIMultipleRejects.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIMultipleInstancesTerminated.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIMultipleInstancesLaunched.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIMetadataEndpointIpAccess.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIInsecureMetadataEndpoint.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIInboundSSHConnection.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/XDR Detections/OCIEventRuleDeleted.yaml | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/Oracle Cloud Infrastructure/Data/Solution_OCILogs.json | Updated as part of this pull request. |
| Solutions/NISTSP80053/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/NISTSP80053/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/NISTSP80053/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/NISTSP80053/data/Solution_NISTSP80053.json | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131LogRetentionLessThan1Year.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131EventLogManagementPostureChangedEL3.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131EventLogManagementPostureChangedEL2.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131EventLogManagementPostureChangedEL1.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131EventLogManagementPostureChangedEL0.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131DataConnectorAddedChangedRemoved.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/XDR Detections/M2131AssetStoppedLogging.yaml | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/MaturityModelForEventLogManagementM2131/data/Solution_MaturityModelForEventLogManagementM2131.json | Updated as part of this pull request. |
| Solutions/Google Cloud Platform Security Command Center/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/Google Cloud Platform Security Command Center/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/Google Cloud Platform Security Command Center/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/Google Cloud Platform Security Command Center/Package/createUiDefinition.json | Updated as part of this pull request. |
| Solutions/Google Cloud Platform Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json | Updated as part of this pull request. |
| Solutions/GDPR Compliance & Data Security/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/GDPR Compliance & Data Security/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/GDPR Compliance & Data Security/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/GDPR Compliance & Data Security/Package/createUiDefinition.json | Updated as part of this pull request. |
| Solutions/GDPR Compliance & Data Security/Data/Solution_GDPR Compliance And Data Security.json | Updated as part of this pull request. |
| Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/XDR Detections/Fortiweb - WAF Allowed threat.yaml | Updated as part of this pull request. |
| Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Data/Solution_FortiWebCloud.json | Updated as part of this pull request. |
| Solutions/Cisco ISE/XDR Detections/CiscoISELogCollectorSuspended.yaml | Updated as part of this pull request. |
| Solutions/Cisco ISE/XDR Detections/CiscoISEDevicePostureStatusChanged.yaml | Updated as part of this pull request. |
| Solutions/Cisco ISE/XDR Detections/CiscoISECmdExecutionWithHighestPrivilegesNewIP.yaml | Updated as part of this pull request. |
| Solutions/Cisco ISE/XDR Detections/CiscoISEAdminPasswordReset.yaml | Updated as part of this pull request. |
| Solutions/Cisco ISE/SolutionMetadata.json | Updated as part of this pull request. |
| Solutions/Cisco ISE/ReleaseNotes.md | Updated as part of this pull request. |
| Solutions/Cisco ISE/Package/testParameters.json | Updated as part of this pull request. |
| Solutions/Cisco ISE/Data/Solution_CiscoISE.json | Updated as part of this pull request. |
Review effort: Balanced
| entityMappings: | ||
| accounts: | ||
| - id: account1 | ||
| upnColumn: user |
Comment on lines
+36
to
+37
| reviewRequired: false | ||
| reviewReasons: [] |
Comment on lines
+36
to
+37
| reviewRequired: false | ||
| reviewReasons: [] |
Comment on lines
+36
to
+37
| reviewRequired: false | ||
| reviewReasons: [] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates 10 Microsoft Sentinel solutions to Defender XDR (�3.2.2, V3.1 packaging) in Qualification Mode (8/8 stages passed,