[oferInbar]

Required items, please complete

Change(s):

• Update CiscoASA solution metadata and all three XDR Custom Detections to version 3.1.3.
• Add authored contentProvenance.requiredWorkloads (sentinel, CommonSecurityLog) and requiredDataConnectors (CiscoAsaAma, CommonSecurityLog).
• Refresh the V3.1 hybrid package and add 3.1.3.zip. Installation and stored-installation records carry matching package/content identifiers and versions; Content Hub registration also carries the authored prerequisites.
• Add the 13-10-2026 release-notes entry. Preserve source Analytic Rules, canonical detection IDs, queries, authored tactics, reviewed mappings, and disabled status.
• Include CiscoASA release content only; exclude local evidence, runtime reports, toolkit implementation changes, and other solutions.

Reason for Change(s):

• Test the new content-provenance contract using a complete three-detection CiscoASA release.
• Draft: full solution validation is blocked by ARM-TTK. IDs Should Be Derived From ResourceIDs rejects literal provenance packageId values. No validator was waived and no implementation workaround was applied.
• GitHub also reports merge conflicts with master: this branch started from the target worktree's older base. Base reconciliation is still required; unrelated dirty worktree content has not been stashed or reset.

Version Updated:

• Yes: solution and all three XDR detection content versions are 3.1.3. Source Analytic Rule versions remain unchanged.

Testing Completed:

• Offline Authoring only. No live Sentinel or Advanced Hunting queries, deployments, ingestion, activation, or alert-parity tests were run. Live Graph/Content Hub acceptance remains unverified.

• XDR structural validation: passed, 3 valid and 0 invalid, including workload and connector prerequisite checks. Exact command:

  PYTHONPATH=/Users/oferinbar/Documents/Gits/Azure-Sentinel-autonamous-authoring/Tools/SentinelToXDRMigration /opt/anaconda3/bin/python3.12 -m sentinel_xdr_migration.cli validate --solution /Users/oferinbar/Documents/Gits/Azure-Sentinel-1/Solutions/CiscoASA --run-id 20261013T134530Z-0be50482ed3d4f07bdd9124c10fdf4ba

• Official full solution validation: failed, exit code 1; 13 validators passed, 1 failed, 10 skipped. ARM-TTK reported 48 tests passed and 3 failed. Detection Schema and Non-ASCII .NET checks were skipped because .NET Core 3.1 was unavailable; the .NET KQL check reported no executed tests. Skips are not passes. Exact command:

  pwsh /Users/oferinbar/Documents/Gits/Azure-Sentinel-autonamous-authoring/.script/local-validation/build-and-validate.ps1 \
    -SolutionName CiscoASA \
    -ContentRoot /Users/oferinbar/Documents/Gits/Azure-Sentinel-1 \
    -SkipPackaging \
    -VersionBump none \
    -ValidationSkip "" \
    -EvidenceDirectory .script/local-validation/Logs/cisco-provenance-validation

• Generated-artifact checks passed: 3 installations, 3 registrations, and 3 stored installations have matching provenance; full registration dependencies match YAML. ZIP contents match the generated templates, and all detections remain disabled.

• Whitespace check: passed. Exact command:

  git -C /Users/oferinbar/Documents/Gits/Azure-Sentinel-1 diff --check -- Solutions/CiscoASA

Checked that the validations are passing and have addressed any issues that are present:

• No / Need Help. Fresh XDR structural validation passes, but the final workflow is blocked by the ARM-TTK provenance-ID finding. A separate maintainer packaging/validator compatibility fix is needed before this draft can be considered release-ready.

[oferInbar]

Resolved the merge conflicts against the fork's master branch. The tested CiscoASA 3.1.3 release files are unchanged; the earlier 3.1.2 ZIP and all other solutions are retained. Fresh XDR structural validation passes for all three detections. The previously reported ARM-TTK provenance packageId finding remains unresolved; this merge does not establish release readiness or live Graph/Content Hub support.