[v-kasghosh]

Changes

Analytic Rule – RareProcessAsService.yaml

• Rewrote the KQL query for performance: replaced the monolithic multi-join
  pattern with a pre-aggregation strategy using materialize() and
  hint.strategy=shuffle, reducing query cost on large tenants.
• Replaced pack_array() with dynamic([]) for the process whitelist.
• Changed contains to the case-insensitive exact-match operator (=~) when
  filtering on services.exe to avoid false positives from partial name matches.
• Capped make_set() limits from 100 000 to 1 000 to prevent excessive memory
  use during aggregation.
• Each enrichment source (DeviceNetworkEvents, DeviceFileEvents,
  DeviceImageLoadEvents) now summarises independently before the final
  leftouter join, eliminating redundant scans.

Solution Package

• Bumped solution version from 3.2.2 → 3.2.3 in Solution_Microsoft Defender XDR.json.
• Added the rebuilt 3.2.3.zip package.

ARM Template Cleanup (createUiDefinition / mainTemplate / testParameters)

• Removed the per-content-kind deployment-selection parameters
  (DeployAnalyticsRule, DeployWorkbook, DeployDefenderWorkbook,
  DeployDataConnector, DeployHuntingQuery) and their UI checkboxes, output
  bindings, and test-parameter definitions.
• Removed the embedded Defender workbook deployment resources and their
  conditional logic from the main ARM template.

Reason for Changes

• Close issue Unable to create Rare Process as a Service Analytic Rule #15194
• Detection quality: the original query could time out or produce inflated
  result sets; the rewrite materially reduces compute and memory pressure.
• Package hygiene: the content-selection toggles and standalone Defender
  workbook deployment paths added install-time complexity without a supported
  production scenario; removing them simplifies the ARM template and aligns with
  standard Content Hub packaging conventions.

Version Updated

• Yes — solution version incremented to 3.2.3.

Testing Completed

• Yes — KQL syntax validated; package rebuilt and included.

[contentautomationbot]

Hello how are you I am GitHub bot
😀😀
I see that you changed templates under the detections/analytic rules folder. Did you remember to update the version of the templates you changed?
If not, and if you want customers to be aware that a new version of this template is available, please update the version property of the template you changed.