[oferInbar]

DO NOT MERGE. This is a review-only draft. None of the five ARM templates has been qualified for PR approval, merge, or production deployment.

Local/offline checks are not live Qualification. Azure Activity additionally has a known, reproduced ARM-TTK failure; its generated template and ZIP are failed-attempt artifacts, not accepted release evidence.

Required items, please complete

Change(s):

• Add migrated Defender XDR Custom Detection YAML alongside the existing Microsoft Sentinel content for exactly five solutions: CiscoASA, Azure Activity, Windows Security Events, Syslog, and Endpoint Threat Protection Essentials.
• Include the current V3.1 hybrid package JSON files, createUiDefinition.json, testParameters.json, and Package/3.1.2.zip for each solution, plus the corresponding solution-data selections, metadata, release notes, and approved source-content corrections.
• The selected inventory contains 60 Custom Detections: CiscoASA 3, Azure Activity 14, Windows Security Events 21, Syslog 7, and Endpoint Threat Protection Essentials 15. The generated Custom Detections remain disabled.
• Preserve approved reference corrections and the Azure Activity hunting-query version quoting correction. Syslog's two SFTP Custom Detections no longer emit unsupported filename-only File entity mappings; Host/IP mappings and file/directory sample custom details remain. No synthetic filename/list hash is represented as a file-content hash.
• No toolkit, agent, skill, workflow implementation, private environment, local logs, or diagnostic/evidence directories are part of this PR. Historical packages are retained; intermediate untracked Cisco 3.1.0/3.1.1 ZIPs are not added.

Reason for Change(s):

• Provide a single, bounded draft for reviewing the five migrated solutions and their hybrid Sentinel/XDR packaging, without mixing in migration-toolkit implementation changes.
• The new migration process separates Authoring from optional Qualification. Authoring follows Discovery -> Conversion -> Validation -> Packaging -> Report: inventory the complete source-rule selection, perform deterministic conversion, resolve uncertain mappings through explicit source/query-hash-bound reviews, validate generated YAML and current offline evidence, package through the V3.1 route, and retain artifact hashes and an honest consolidated report.
• The process is resumable through workflow-state.json. Package evidence must match current inputs; changed content requires an explicitly approved release action or a guarded same-version rebuild rather than silently reusing old package evidence. Review acceptance does not prove runtime correctness or alert parity.
• Qualification is a separate, explicitly selected workflow with exact target/query scope and fresh approval before environment writes. Deployment, mock ingestion, runtime/schema verification, and alert parity were not performed by this authoring workflow. This draft does not authorize them.
• Known timing difference: the Sentinel rule NRT Creation of expensive computes in Azure is kind: NRT, but its generated XDR counterpart is scheduled at PT1H (hourly). Its inherited "NRT" display name does not make it an XDR NRT detection. The conversion warning records that source NRT timing is not preserved.

Version Updated:

• All five solution/package versions are 3.1.2, with approved release-note entries dated 12-10-2026.
• Individual source-rule and Custom Detection versions remain independent of the solution/package version. Unchanged items are not globally bumped; the version changes for approved content corrections are retained.

Testing Completed:

• Local/offline only; live Qualification not completed. The table records the existing validation runs against the current source snapshots, not a claim that this isolated draft branch has been live-tested.

Solution	Selected ARs / CDs	Local validation summary	PowerShell ARM-TTK	Authoring result
CiscoASA	3 / 3	14 passed, 0 failed, 10 skipped	48 passed	Completed offline
Azure Activity	14 / 14	13 passed, 1 failed, 10 skipped	18 passed, 1 failed	Blocked at Packaging
Windows Security Events	21 / 21	13 passed, 0 failed, 11 skipped	48 passed	Completed offline
Syslog	7 / 7	14 passed, 0 failed, 10 skipped	48 passed	Completed offline after SFTP mapping repair
Endpoint Threat Protection Essentials	15 / 15	13 passed, 0 failed, 11 skipped	48 passed	Completed offline

The recorded cross-checkout validation-only invocations are shown below with absolute checkout paths abbreviated as $ToolkitRoot and $ContentRoot. Evidence-directory arguments identify the original runs. No packaging or version bump was requested by these validation invocations.

# CiscoASA: exit 0; 14 passed, 0 failed, 10 skipped.
pwsh "$ToolkitRoot/.script/local-validation/build-and-validate.ps1" -SolutionName "CiscoASA" -ContentRoot "$ContentRoot" -SkipPackaging -VersionBump none -ValidationSkip "" -EvidenceDirectory ".script/local-validation/Logs/CiscoASA-20261012T132047Z-533b2d5bff354accac4823c28409a8f7-notes-refresh"

# Windows Security Events: exit 0; 13 passed, 0 failed, 11 skipped.
pwsh "$ToolkitRoot/.script/local-validation/build-and-validate.ps1" -SolutionName "Windows Security Events" -ContentRoot "$ContentRoot" -SkipPackaging -VersionBump none -ValidationSkip "" -EvidenceDirectory ".script/local-validation/Logs/windows-same-version-20261012T142536Z-ade72d7ac18a4796a1d5c2b601e09d9d-2b29e0b3-a6be-4425-95e7-c64f42aba86f"

# Syslog: exit 0; 14 passed, 0 failed, 10 skipped.
pwsh "$ToolkitRoot/.script/local-validation/build-and-validate.ps1" -SolutionName "Syslog" -ContentRoot "$ContentRoot" -SkipPackaging -VersionBump none -ValidationSkip "" -EvidenceDirectory ".script/local-validation/Logs/syslog-same-version-c17f6a40-20261012T163133Z"

# Endpoint Threat Protection Essentials: exit 0; 13 passed, 0 failed, 11 skipped.
pwsh "$ToolkitRoot/.script/local-validation/build-and-validate.ps1" -SolutionName "Endpoint Threat Protection Essentials" -ContentRoot "$ContentRoot" -SkipPackaging -VersionBump none -ValidationSkip "" -EvidenceDirectory ".script/local-validation/Logs/endpoint-f608cc4f-cc30-4c64-b79c-9270ef743854"

# Azure Activity reproduction: exit 1; 13 passed, 1 failed, 10 skipped.
pwsh "$ToolkitRoot/.script/local-validation/build-and-validate.ps1" -SolutionName "Azure Activity" -ContentRoot "$ContentRoot" -SkipPackaging -VersionBump none -ValidationSkip "" -EvidenceDirectory ".script/local-validation/Logs/azure-arm-ttk-reproduction"

• Skipped does not mean passed. .NET Core 3.1 detection-schema/non-ASCII checks were unavailable; the .NET KQL runner reported no executed test results. Additional applicability/scoping skips are retained, including repository-history secret scanning, which the solution-scoped runner cannot perform.
• No current Sentinel or XDR runtime-query/schema results, alert-parity evidence, or live acceptance of the generated XDR installation/registration resources are asserted. Syslog's repaired SFTP mappings have not been live-redeployed by this workflow.

Checked that the validations are passing and have addressed any issues that are present:

• No / Need Help. Do not merge. Four solutions passed the available local checks with the skips above; Azure Activity still fails PowerShell ARM-TTK. None of the five ARM templates is PR-qualified.
• Azure Activity's root template contains 64 resources. Its 14 selected nested detection deployment templates are nonempty, but ARM-TTK's raw-text extraction fails to resolve them and passes empty TemplateText into expansion. The failure was reproduced without modifying the generated template or the validation implementation. The precise resolver branch/minimal upstream fixture remains unisolated; no layout workaround is claimed.
• The tested ARM-TTK checkout matched upstream at commit 0ec9a41a4503e970a0ec8efb0cd08415cc172175 (module 0.27). Simply updating to a newer available upstream version was not a demonstrated remedy.
• This PR intentionally retains the failed Azure Activity candidate for review rather than hiding the failure, weakening gates, or marking it release-ready. Toolkit remediation and live Qualification must remain separate, explicitly authorized work.