Skip to content

Solution: TacitRed SentinelOne IOC Automation (Official)#13267

Merged
v-dvedak merged 7 commits intoAzure:masterfrom
Data443:feature/tacitred-sentinelone-v1
Jan 27, 2026
Merged

Solution: TacitRed SentinelOne IOC Automation (Official)#13267
v-dvedak merged 7 commits intoAzure:masterfrom
Data443:feature/tacitred-sentinelone-v1

Conversation

@mazamizo21
Copy link
Copy Markdown
Contributor

@mazamizo21 mazamizo21 commented Dec 8, 2025

Official Data443 Submission

This is the official submission from the Data443 organization for the TacitRed SentinelOne IOC Automation solution.

Changes

  • Standardized publisher information to 'Data443 Risk Mitigation, Inc.'.
  • Added comprehensive documentation.
  • Validated implementation.

This PR supersedes and replaces PR #13243.
Please close #13243 in favor of this one.

@mazamizo21 mazamizo21 requested review from a team as code owners December 8, 2025 19:24
@mazamizo21 mazamizo21 mentioned this pull request Dec 8, 2025
Closed
@mazamizo21 mazamizo21 requested a review from a team as a code owner December 8, 2025 20:11
@v-shukore v-shukore self-assigned this Dec 9, 2025
@v-shukore v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Dec 9, 2025
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 9, 2025 •
edited
Loading

Hi @mazamizo21,
Please ensure that each solution includes the data connector folder and its relevant files, as well as the data file, releasenote file, solutionmetadata file, maintemplate, createui files, and a zip file with version 3.0.0. All these files are required.
You can package the solution using the V3 tool. Here is the readme file for creating a new solution: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…
Also, you can refer any solution from our repo to get understanding of folder structure.
If you have any questions, please feel free to connect with me and Mahesh on MS teams this is my email id: v-shukore@microsoft.com.
Thanks!

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch 3 times, most recently from 9a78d60 to 4895423 Compare December 10, 2025 00:50
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 10, 2025

Hi @v-shukore,

Thank you for the feedback! We've reviewed the Azure Sentinel Solutions repository and found 20+ approved production solutions that are playbook-only without data connector folders.

Examples of Approved Playbook-Only Solutions

Pure playbook solutions (no data connectors):

  • HYAS (v3.0.0) - 24 playbooks, no data connectors
  • Recorded Future (v3.2.17) - 14 playbooks + 8 workbooks + 4 analytics, no data connectors
  • Tanium - Playbooks + workbooks + analytics, no data connectors
  • Pure Storage - Playbooks + workbooks, no data connectors
  • SalemCyber, Farsight DNSDB, GoogleDirectory, Apache Log4j Vulnerability Detection, SAP, AWS Systems Manager, Group-IB, NCSC-NL NDN, Neustar IP GeoPoint, DNS Essentials, ShadowByte Aria, AWS_IAM, IronNet IronDefense, Intel471, Torq - All playbook-only, no data connectors

Our Solution Structure

TacitRed SentinelOne IOC Automation follows the same pattern:

  • ✅ Playbook-only automation solution (no data ingestion)
  • ✅ Consumes existing threat intelligence from Sentinel
  • ✅ Prepares indicators for SentinelOne ingestion
  • ✅ All V3 packaging files present:
    • mainTemplate.json, createUiDefinition.json, 3.0.0.zip
    • SolutionMetadata.json (with lastPublishDate: 2025-12-10)
    • ReleaseNotes.md, README.md

Question

Based on these 20+ approved playbook-only solutions in the repository, can you confirm that data connector folders are not required for automation-only solutions?

Our solution structure is identical to HYAS and other approved playbook-only solutions.

Thank you for your guidance!

Data443 Risk Mitigation, Inc.
support@data443.com

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 11, 2025

Hi @mazamizo21, the solution now appears well-organized with the appropriate files included. I will review it and inform you if any updates are required. Thank you.

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch 5 times, most recently from 1f9e4b5 to 9cb6018 Compare December 15, 2025 11:22
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025
@mazamizo21
fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)
d4b7032
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025
@mazamizo21
fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)
8f92140
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025
@mazamizo21
fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)
06180eb
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025
@mazamizo21
fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)
06df6ea
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 30, 2025

Hi @mazamizo21,

Please remove the 1.0.2 zip package from the solution.

Also, remove the packagemetadata.json and deploymentParameters.json files from the package folder. If these files are necessary, please keep them outside the package folder.

Additionally, create a folder named Image inside the Playbook folder and add all running playbook images into it.

Please also correct the format of the releasenote.md file.

Thanks!

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 30, 2025

Update: All Requested Changes Applied

Hi Microsoft Team,

Thank you for your feedback. We have addressed all the requested changes:

✅ 1. Removed 1.0.2 zip package

  • Deleted Solutions/TacitRed-SentinelOne/Package/1.0.2.zip
  • Only 3.0.0.zip remains in the Package folder

✅ 2. Moved packageMetadata.json and deploymentParameters.json outside Package folder

  • Before: Solutions/TacitRed-SentinelOne/Package/packageMetadata.json
  • After: Solutions/TacitRed-SentinelOne/packageMetadata.json
  • Before: Solutions/TacitRed-SentinelOne/Package/deploymentParameters.json
  • After: Solutions/TacitRed-SentinelOne/deploymentParameters.json

✅ 3. Created Images folder in Playbooks with running playbook screenshots

  • Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneLight.png
  • Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneDark.png

✅ 4. Fixed ReleaseNotes.md format

  • Added proper # Release Notes heading
  • Aligned table columns correctly

Thank you!

Data443 Risk Mitigation, Inc.

@mazamizo21 mazamizo21 mentioned this pull request Dec 30, 2025
Merged
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 31, 2025

Hi @mazamizo21, could you please grant me the branch access so I can make the necessary changes and commit them. Thanks!!

@mazamizo21 mazamizo21 mentioned this pull request Dec 31, 2025
Merged
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 31, 2025 via email

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 31, 2025

Verified: This solution does not contain any broken tacitred.com or cyren.com documentation URLs. The only TacitRed references are API endpoints (app.tacitred.com) which are functional and required for the connector to work.

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 6, 2026

Hi @mazamizo21, we deployed the maintemplate in our Microsoft Sentinel workspace and checked, but the playbook isn't showing or loading, so we're unable to test it. Could you check in your workspace and share a screenshot here? Thanks!
image

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 6, 2026

Hi @v-shukore,

Thank you for testing the solution! I've identified and fixed the issue with the playbook not showing/loading.

Root Cause

The playbookContentId1 in the mainTemplate was set to a generic string "Playbooks" instead of a unique identifier. This prevented Content Hub from properly registering and displaying the playbook after deployment.

Fix Applied (commit 02582c3)

  1. Changed playbookContentId1 from "Playbooks" → "TacitRedToSentinelOne"
  2. Updated displayName from "Playbooks" → "TacitRed to SentinelOne IOC Automation"
  3. Fixed dependency contentId reference to use the correct variable
  4. Removed unused variables for ARM-TTK compliance

The playbook should now properly appear in Content Hub after deployment. Please redeploy and let me know if you can see and test the playbook now.

Thanks!

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch 3 times, most recently from 59a4da3 to abf9afd Compare January 14, 2026 01:35
@mazamizo21 mazamizo21 mentioned this pull request Jan 15, 2026
Merged
@mazamizo21 mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch from aec9a39 to 831026f Compare January 19, 2026 10:43
@mazamizo21
Solution: TacitRed SentinelOne IOC Automation (Official) - Clean branch
9cd6f8b 
- Dynamic 7-day lookback matching CCF polling window for cost reduction
- Uses date_from=@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}
- Clean branch with only TacitRed-SentinelOne solution files
@mazamizo21 mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch from 8381800 to 9cd6f8b Compare January 19, 2026 12:50
@mazamizo21
chore: Re-trigger CI (GitHub API rate limit timeout)
e6b09ac
@mazamizo21
fix(TacitRed-SentinelOne): Fix playbookContentId for Content Hub loading
40ab9cd 
- Changed playbookContentId1 from generic 'Playbooks' to unique 'TacitRedToSentinelOne'
- Updated displayName to 'TacitRed to SentinelOne IOC Automation'
- Fixed dependencies contentId to use correct variable reference
- Regenerated 3.0.0.zip

This fixes the 'One or more playbook templates failed to load' error
in Content Hub after deployment.
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 21, 2026

image

@mazamizo21
fix(TacitRed-SentinelOne): Remove orphaned Playbooks variable
592d8f9 
- Removed unused 'Playbooks' and '_Playbooks' variables from mainTemplate.json
- These orphaned variables may have been causing duplicate playbook entries in Content Hub
- Regenerated 3.0.0.zip

Note: Reviewer should delete existing solution and reinstall on a clean workspace
to avoid seeing duplicate entries from previous deployment.
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 21, 2026

Fix Applied: Playbook Content Hub Loading Issue

Root Cause

The playbookContentId1 variable was set to a generic value "Playbooks" instead of a unique identifier. This caused Content Hub to fail when trying to register and display the playbook template.

Changes Made (commit 592d8f9)

  1. Changed playbookContentId1 from "Playbooks" to "TacitRedToSentinelOne"
  2. Updated displayName from "Playbooks" to "TacitRed to SentinelOne IOC Automation"
  3. Removed orphaned "Playbooks" variables that may have been causing duplicate entries
  4. Regenerated 3.0.0.zip

Reference Solution Comparison

I've compared our solution structure with the HYAS partner solution (Solutions/HYAS/), which is also:

  • Partner-supported
  • Playbook-only (25 playbooks)
  • Threat Intelligence category
  • Same folder structure and metadata pattern

The structure matches correctly. The only differences are newer API versions (2025-09-01 vs 2023-04-01-preview).

Testing Instructions

The duplicate playbook entries you're seeing are from previous deployments. To test the fix:

  1. DELETE the existing TacitRed-SentinelOne solution from Content Hub
  2. DELETE any orphaned playbook templates from the workspace
  3. REINSTALL the solution from a fresh deployment

The new template has unique playbookContentId and proper displayName.

@mazamizo21
fix(TacitRed-SentinelOne): Add playbook metadata for Content Hub
c4e1baf 
Added metadata section to playbook as required by Content Hub:
- title: TacitRed to SentinelOne IOC Automation
- description: Playbook functionality description
- prerequisites: API keys and URLs required
- postDeployment: Configuration steps after deployment
- support: Partner tier with Data443 contact info
- author: Data443 Risk Mitigation, Inc.
- tags: ThreatIntelligence, IOC, SentinelOne, TacitRed

Reference: Solutions/Microsoft Defender XDR/Playbooks/AttackSimulatorTrainingNonReporters/azuredeploy.json
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 22, 2026

Fix Applied: Added Playbook Metadata for Content Hub

Issue

Microsoft reviewer noted that the playbook metadata was missing, which is required for Content Hub to properly load and display the playbook template.

Changes Made (commit c4e1baf)

Added metadata section to both the playbook JSON and mainTemplate.json following the Microsoft Defender XDR playbook pattern:

  • title: TacitRed to SentinelOne IOC Automation
  • description: Playbook functionality description
  • prerequisites: API keys and URLs required
  • postDeployment: Configuration steps after deployment
  • support: Partner tier with Data443 contact info
  • author: Data443 Risk Mitigation, Inc.
  • tags: ThreatIntelligence, IOC, SentinelOne, TacitRed

Reference Solution

Used as reference: Solutions/Microsoft Defender XDR/Playbooks/AttackSimulatorTrainingNonReporters/azuredeploy.json

Testing Instructions

  1. Delete any existing TacitRed-SentinelOne solution from Content Hub
  2. Redeploy the solution from the updated mainTemplate
  3. Verify the playbook template loads correctly with metadata displayed

Thanks for the feedback!

mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 23, 2026
@mazamizo21
fix(TacitRed-IOC-CrowdStrike): Apply reviewer's playbook metadata pat…
a5a4bf0 
…tern

Applied same changes as Microsoft reviewer made to PR Azure#13267:
- Renamed logicAppName parameter to PlaybookName
- Moved metadata to END of nested mainTemplate (after resources array)
- Updated metadata format: prerequisites as array, simplified support
- Added releaseNotes section
- Updated description and displayName to use playbook name

Reference: PR Azure#13267 (TacitRed-SentinelOne) reviewer changes
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 23, 2026
@mazamizo21
fix(TacitRed-Defender-ThreatIntelligence): Update metadata to match r…
23c89ad 
…eviewer pattern

Applied same changes as Microsoft reviewer made to PR Azure#13267:
- Updated support.tier to lowercase 'partner'
- Updated lastUpdateTime to 2026-01-22
- Metadata already at END of nested mainTemplates (correct pattern)

Reference: PR Azure#13267 (TacitRed-SentinelOne) reviewer changes
@v-dvedak v-dvedak merged commit 015e58d into Azure:master Jan 27, 2026
33 checks passed
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 27, 2026
@mazamizo21
fix(TacitRed-Defender-ThreatIntelligence): Mirror SentinelOne playboo…
5fe1493 
…k metadata pattern

Per Microsoft reviewer feedback (playbook not visible in Content Hub):
- Changed metadata resource apiVersion from 2025-09-01 to 2022-01-01-preview
- Fixed first metadata resource name to use single brackets + parameters('workspace')
- Updated displayName to use pb- prefix pattern: pb-tacitred-to-defender-ti
- Updated description to match displayName pattern
- Updated support.tier to lowercase 'partner'

Reference: PR Azure#13267 (TacitRed-SentinelOne) which is working correctly
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 27, 2026
@mazamizo21
fix(TacitRed-Defender-ThreatIntelligence): Fix parentId bracket syntax
a067b88 
Per Azure MCP Server verification and SentinelOne deep dive:
- Changed parentId from double brackets [[variables(...)] to single brackets [variables(...)]
- This matches the working SentinelOne pattern exactly
- API version 2022-01-01-preview confirmed correct for nested metadata resources

Reference: PR Azure#13267 (TacitRed-SentinelOne) working pattern
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 27, 2026
@mazamizo21
fix(TacitRed-Defender-TI): Change API versions to match working Senti…
296a219 
…nelOne pattern

Changed API versions from 2025-09-01 to 2023-04-01-preview for:
- contentTemplates (Function App and Playbook)
- contentPackages

This matches the working SentinelOne and CrowdStrike solutions that
are successfully loading playbooks in Content Hub.

Reference: PR Azure#13267 (SentinelOne) and PR Azure#13269 (CrowdStrike)
as requested by Microsoft reviewer
@mazamizo21 mazamizo21 mentioned this pull request Feb 19, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@v-dvedak v-dvedak v-dvedak approved these changes

@v-atulyadav v-atulyadav v-atulyadav approved these changes

@v-shukore v-shukore v-shukore approved these changes

Assignees

@v-shukore v-shukore

Labels

auto-package New Solution For new Solutions which are new to Microsoft Sentinel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mazamizo21 @v-shukore @v-dvedak @v-atulyadav