Repository navigation
[Buganizer ID: 576928773] Migrate Batch 11: MicrosoftAzureSentinel - #1403
Merged
Merged
Conversation
Contributor
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request migrates the MicrosoftAzureSentinel integration to the open content-hub repository. The refactor introduces a modular directory structure to improve maintainability and standardizes packaging for Chronicle SOAR. Additionally, it updates dependency management and enhances the test suite to ensure robust integration performance. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: CreateCustomHuntingRule, ListIncidents, UpdateIncidentDetails, ListAlertRules, ListCustomHuntingRules, AddCommentToIncident, CreateAlertRule, UpdateIncidentLabelsV2, UpdateAlertRule, GetAlertRuleDetails, UpdateIncidentLabels, UpdateIncidentDetailsV2, RunKQLQuery, GetIncidentStatistics, GetCustomHuntingRuleDetails, RunCustomHuntingRuleQuery, UpdateCustomHuntingRule | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
1 similar comment
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: CreateCustomHuntingRule, ListIncidents, UpdateIncidentDetails, ListAlertRules, ListCustomHuntingRules, AddCommentToIncident, CreateAlertRule, UpdateIncidentLabelsV2, UpdateAlertRule, GetAlertRuleDetails, UpdateIncidentLabels, UpdateIncidentDetailsV2, RunKQLQuery, GetIncidentStatistics, GetCustomHuntingRuleDetails, RunCustomHuntingRuleQuery, UpdateCustomHuntingRule | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces a comprehensive integration for Microsoft Azure Sentinel, adding various actions for incident and alert rule management, connectors for incident tracking, and synchronization jobs. The review feedback highlights several critical improvements: 1) Adhering to the repository style guide by avoiding bare except: clauses in MicrosoftAzureSentinelManager.py. 2) Standardizing success and failure messages for the Ping action, and setting the default value of Verify SSL to True in definition.yaml to comply with the Content Design Guide. 3) Handling missing incidents gracefully by raising and catching MicrosoftAzureSentinelIncidentNotFoundError in the UpdateIncidentDetails, UpdateIncidentDetailsV2, UpdateIncidentLabels, and UpdateIncidentLabelsV2 actions, rather than allowing unhandled AttributeErrors or failing playbooks. 4) Correctly managing the result_value success flag in enrichment actions like GetAlertRuleDetails and GetCustomHuntingRuleDetails when no results are found.
Sahithya1357
changed the title
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: CreateCustomHuntingRule, RunCustomHuntingRuleQuery, UpdateIncidentLabelsV2, GetCustomHuntingRuleDetails, UpdateIncidentLabels, RunKQLQuery, UpdateIncidentDetails, AddCommentToIncident, UpdateIncidentDetailsV2, UpdateAlertRule, GetIncidentStatistics, CreateAlertRule, GetAlertRuleDetails, ListAlertRules, ListCustomHuntingRules, UpdateCustomHuntingRule, ListIncidents | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: CreateCustomHuntingRule, ListIncidents, UpdateIncidentDetails, ListAlertRules, ListCustomHuntingRules, AddCommentToIncident, CreateAlertRule, UpdateIncidentLabelsV2, UpdateAlertRule, GetAlertRuleDetails, UpdateIncidentLabels, UpdateIncidentDetailsV2, RunKQLQuery, GetIncidentStatistics, GetCustomHuntingRuleDetails, RunCustomHuntingRuleQuery, UpdateCustomHuntingRule | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
Sahithya1357
changed the title
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
1 similar comment
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
Arabindaksha-Mishra
previously approved these changes
Oct 26, 2026
Arabindaksha-Mishra
left a comment
Arabindaksha-Mishra
left a comment
Contributor
There was a problem hiding this comment.
Peer Migration PR Review: APPROVE (+1 LGTM) — MicrosoftAzureSentinel (microsoft_azure_sentinel)
| Review Gate | Status | Evidence |
|---|---|---|
1. Version & Metadata (N+1.0) |
PASS | v65.0 -> v66.0, Python >=3.11,<3.12, release_notes.yaml (114 -> 115 entries) |
2. Dependencies & uv.lock |
PASS | environmentcommon, tipcommon, httpx, isodate, python-dateutil, pytz (+1 more) mapped; soar-sdk in dev; uv.lock present |
3. Code & Import Audit (tools/migration) |
PASS | 0 blocking issues; relative ..core imports & core/__init__.py verified |
4. Unit Tests (pytest) |
PASS | 34 passed, 1 warning in 0.66s |
5. Rebuilt vs. Legacy Parity (compare_rebuilt_to_original) |
PASS | 97/97 runtime artifacts, 45 JSON definitions, 35 Python scripts (0 unexpected AST/schema diffs) |
| 6. CI Pre-Push Gates (Parity-Aware) | PASS | mp validate (Validation completed; Ping Message Format Validation, SSL Connectors Validation, Fields Validation, JSON Result Example Validation, Release Notes Date Validation omitted for parity) + mp check (ruff.toml parity exclusion) |
All 6 review pillars (definition.yaml, uv.lock, AST parity, unit tests, compare_rebuilt_to_original, and parity-aware CI gates) passed with 0 regressions.
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
1 similar comment
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
Signed-off-by: Arabindaksha Mishra <109797459+Arabindaksha-Mishra@users.noreply.github.com>
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
aketki
requested changes
Oct 27, 2026
aketki
left a comment
aketki
left a comment
There was a problem hiding this comment.
GoB has WidgetsScripts/WidgetsElements/{RunKQLQuery,RunCustomHuntingRuleQuery}/widget_*_config.yaml (widget-generator config), and these aren't in the migrated integration, so I think the GoB sync CL would delete them. Are they still needed? If so, should we keep them?
Contributor
Author
|
Regarding the comment #1403 (review), Those widget_*_config.yaml files are only build-time inputs for GoB's widget-generation scripts (WidgetTemplateScript/CreateWidgets) that render the flat .html widgets. They aren't used at runtime, and the rendered HTMLs are already migrated (identical to GoB apart from the license header). mp doesn't carry WidgetsElements/ over, and compare_rebuilt_to_original explicitly ignores them as a source-only diff, so it's expected that the GoB sync CL deletes them. |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
Signed-off-by: Sahithya1357 <marthasahithya@google.com>
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
Error happened while executing a command: uv lock --check: Using CPython 3.11.17 interpreter at: /opt/hostedtoolcache/Python/3.11.17/x64/bin/python Resolved 59 packages in 199ms error: The lockfile at uv.lock needs to be updated, but --check was provided. hint: To update the lockfile, run uv lock. |
|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
Error happened while executing a command: uv lock --check: Using CPython 3.11.17 interpreter at: /opt/hostedtoolcache/Python/3.11.17/x64/bin/python Resolved 59 packages in 298ms error: The lockfile at uv.lock needs to be updated, but --check was provided. hint: To update the lockfile, run uv lock. |
|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
…softAzureSentinel
|
❌ Integration Tests Failed Click to view the full report🧩 microsoft_azure_sentinel
❌ Failed TestsTest Execution Failure |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| Package 'aiohappyeyeballs' has an unsupported dependency provider from registry: http://airlock-proxy.uplink.goog:999/python/artifact-foundry-prod/python-3p-limited-internal-use/simple/. Only registries containing one of ['pypi'] are allowed. Please add the following to the integration's pyproject.toml file: [[tool.uv.index]] url = 'https://pypi.org/simple' default = true | |
Error happened while executing a command: uv lock --check: Using CPython 3.11.17 interpreter at: /opt/hostedtoolcache/Python/3.11.17/x64/bin/python Resolved 59 packages in 182ms error: The lockfile at uv.lock needs to be updated, but --check was provided. hint: To update the lockfile, run uv lock. |
|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| Package 'aiohappyeyeballs' has an unsupported dependency provider from registry: http://airlock-proxy.uplink.goog:999/python/artifact-foundry-prod/python-3p-limited-internal-use/simple/. Only registries containing one of ['pypi'] are allowed. Please add the following to the integration's pyproject.toml file: [[tool.uv.index]] url = 'https://pypi.org/simple' default = true | |
Error happened while executing a command: uv lock --check: Using CPython 3.11.17 interpreter at: /opt/hostedtoolcache/Python/3.11.17/x64/bin/python Resolved 59 packages in 222ms error: The lockfile at uv.lock needs to be updated, but --check was provided. hint: To update the lockfile, run uv lock. |
|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
1 similar comment
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| New integration project.toml and release_note.yaml version must be initialize to 1.0 | |
| microsoft_azure_sentinel: Ping success message must contain: 'Successfully connected to the'; Ping failure message must contain: 'Failed to connect to the' | |
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges | |
| Actions with JSON results missing example files in resources/: UpdateCustomHuntingRule, UpdateIncidentLabelsV2, GetAlertRuleDetails, GetCustomHuntingRuleDetails, RunKQLQuery, UpdateAlertRule, ListIncidents, CreateAlertRule, RunCustomHuntingRuleQuery, UpdateIncidentDetails, CreateCustomHuntingRule, GetIncidentStatistics, ListCustomHuntingRules, UpdateIncidentDetailsV2, AddCommentToIncident, ListAlertRules, UpdateIncidentLabels | |
| Release notes have invalid publish_time values (expected YYYY-MM-DD): v1: '', v3: '', v4: '', v5: '', v5: '' |
aketki
approved these changes
Oct 27, 2026
adarshtwy
approved these changes
Oct 28, 2026
|
❌ Marketplace Validation Failed Click to view the full reportValidation Report
|
| Validation Name | Details |
|---|---|
| - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector v2 must be a boolean true - The default value of the 'Verify SSL' param in Microsoft Azure Sentinel Incident Connector must be a boolean true | |
| Connector Parameter name: Incident Creation Time Filter (days) does not match the regex: ^[a-zA-Z0-9-'\s]+$|Verify SSL Ceritifcate?|Git Password/Token/SSH Key|EML/MSG Base64 String|Country(For multiple countries, provide comma-separated values)|Entity Identifier(s)|logzio_security_token|logzio_region|minimum_score|api_token|eyeglass_ip|API_Key|Alert_ID|Queue_State|logzio_operations_token|logzio_custom_endpoint|api_key|fields_to_search|severity_threshold|Entity Identifier(s) Type|Target Entity Identifier(s)|IOC_Enrichment|SLA (in minutes)|raw_json|alert_event_id|Additional_Data|page_size|sort_by|Data_Range|Incident_Key|Team_IDS|User_IDS|Service_IDS|Entity_State|Incidents_Statuses|from_time|to_time|Incident_ID|from_date|logzio_token|search_term|Ingest\ only\ alerts\ that\ have\ “is_security”\ attribute\ set\ to\ True?|Ingest\ only\ alerts\ that\ have\ “is_incident”\ attribute\ set\ to\ True?|Fetch\ Backwards\ Time\ Interval\ (minutes)|Events\ Padding\ Period\ (hours)|Is\ Exchange\ On-Prem?|Is\ Office365\ (Exchange\ Online)?|Extract\ urls\ from\ HTML\ email\ part?|Create\ a\ Separate\ Siemplify\ Alert\ per\ Attached\ Mail\ File?|Email\ Padding\ Period\ (minutes)|Tenant\ (Directory)\ ID|Should\ ingest\ only\ starred\ threats?|Should\ ingest\ threats\ related\ to\ incidents?|Use\ the\ same\ approach\ with\ event\ creation\ for\ all\ alert\ types?|Enable\ Fallback\ Logic\ Debug?|Create\ Chronicle\ SOAR\ Alerts\ for\ Sentinel\ incidents\ that\ do\ not\ have\ entities?|Incidents\ Padding\ Period\ (minutes)|Wait\ For\ Scheduled/NRT\ Alert\ Object|Api_Key|Fetch\ Private\ Notes?|Offenses\ Creation\ Timer\ (minutes)|What\ Value\ to\ use\ for\ the\ Name\ Field\ of\ Siemplify\ Alert?|What\ Value\ to\ use\ for\ the\ Rule\ Generator\ Field\ of\ Siemplify\ Alert?|Mask\ findings?|Events\ Padding\ Period\ (minutes)|Track\ New\ Events\ Threshold\ (hours)|Token\ Timeout\ (in\ Seconds)|Script\ Timeout\ (Seconds)|IPs/Ranges |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Migrate the MicrosoftAzureSentinel integration from the legacy GoB repository (tip-marketplace) to the open GitHub repository (content-hub).
Deconstruction: Migrated source code into modular
actions/,jobs/,connectors/,core/,resources/, andwidgets/structure with standardized relative imports for Chronicle SOAR packaging.Dependencies: Configured
pyproject.tomlanduv.lockwith required runtime and development dependencies (tipcommon,environmentcommon,soar-sdk, andintegration-testing).Tests: Configured test suite with
integration_testingfixtures inconftest.py, modernized mock paths, and mock session fixtures.Validation: Verified with
mp check,mp validate,mp test, andmp build.Tracking:
Buganizer ID: 576928773
Batch: Batch 11
Checklist:
Please ensure you have completed the following items before submitting your PR. This helps us review your contribution faster and more efficiently.
General Checks:
Open-Source Specific Checks:
For Google Team Members and Reviewers Only: