Skip to content

Solution: TacitRed CrowdStrike IOC Automation (Official)#13269

Merged
v-atulyadav merged 5 commits intoAzure:masterfrom
Data443:feature/tacitred-crowdstrike-ioc
Jan 27, 2026
Merged

Solution: TacitRed CrowdStrike IOC Automation (Official)#13269
v-atulyadav merged 5 commits intoAzure:masterfrom
Data443:feature/tacitred-crowdstrike-ioc

Conversation

@mazamizo21
Copy link
Copy Markdown
Contributor

@mazamizo21 mazamizo21 commented Dec 8, 2025

Official Data443 Submission

This is the official submission from the Data443 organization for the TacitRed CrowdStrike IOC Automation solution.

Changes

  • Standardized publisher information to 'Data443 Risk Mitigation, Inc.'.
  • Added comprehensive documentation.
  • Validated implementation.

This PR supersedes and replaces PR #13241.
Please close #13241 in favor of this one.

@mazamizo21 mazamizo21 requested review from a team as code owners December 8, 2025 19:24
@mazamizo21 mazamizo21 mentioned this pull request Dec 8, 2025
Closed
@mazamizo21 mazamizo21 requested a review from a team as a code owner December 8, 2025 20:11
@v-shukore v-shukore self-assigned this Dec 9, 2025
@v-shukore v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Dec 9, 2025
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 9, 2025

Hi @mazamizo21,

Please ensure that each solution includes the data connector folder and its relevant files, as well as the data file, releasenote file, solutionmetadata file, maintemplate, createui files, and a zip file with version 3.0.0. All these files are required.
You can package the solution using the V3 tool. Here is the readme file for creating a new solution: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…
If you have any questions, please feel free to connect with me and Mahesh on MS teams this is my email id: v-shukore@microsoft.com.
Thanks!

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-crowdstrike-ioc branch 3 times, most recently from 710dc5d to 87d5486 Compare December 10, 2025 00:49
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 10, 2025

Hi @v-shukore,

Thank you for the feedback! We've reviewed the Azure Sentinel Solutions repository and found 20+ approved production solutions that are playbook-only without data connector folders.

Examples of Approved Playbook-Only Solutions

Pure playbook solutions (no data connectors):

  • HYAS (v3.0.0) - 24 playbooks, no data connectors
  • Recorded Future (v3.2.17) - 14 playbooks + 8 workbooks + 4 analytics, no data connectors
  • Tanium - Playbooks + workbooks + analytics, no data connectors
  • Pure Storage - Playbooks + workbooks, no data connectors
  • SalemCyber, Farsight DNSDB, GoogleDirectory, Apache Log4j Vulnerability Detection, SAP, AWS Systems Manager, Group-IB, NCSC-NL NDN, Neustar IP GeoPoint, DNS Essentials, ShadowByte Aria, AWS_IAM, IronNet IronDefense, Intel471, Torq - All playbook-only, no data connectors

Our Solution Structure

TacitRed CrowdStrike IOC Automation follows the same pattern:

  • ✅ Playbook-only automation solution (no data ingestion)
  • ✅ Consumes existing threat intelligence from Sentinel
  • ✅ Prepares indicators for CrowdStrike ingestion
  • ✅ All V3 packaging files present:
    • mainTemplate.json, createUiDefinition.json, 3.0.0.zip
    • SolutionMetadata.json (with lastPublishDate)
    • ReleaseNotes.md, README.md

Question

Based on these 20+ approved playbook-only solutions in the repository, can you confirm that data connector folders are not required for automation-only solutions?

Our solution structure is identical to HYAS and other approved playbook-only solutions.

Thank you for your guidance!

Data443 Risk Mitigation, Inc.
support@data443.com

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 11, 2025

Hi @mazamizo21, the solution now appears well-organized with the appropriate files included. I will review it and inform you if any updates are required. Thank you.

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 11, 2025

@v-shukore can you please run the review on all 5 PR

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 11, 2025

@v-shukore Just a side note it seem like the V3 tool is reverting back old API version after I corrected it couple times in my repo. I corrected my V3 local version but you might need to check on your V3 to correct it as well

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-crowdstrike-ioc branch 5 times, most recently from 3f1c487 to e9d37b3 Compare December 15, 2025 11:22
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 30, 2025

Hi @mazamizo21,

Please add the solution logo to the following path:
https://github.com/Azure/Azure-Sentinel/tree/master/Logos

Also, remove the packagemetadata.json and deploymentParameters.json files from the package folder. If these files are necessary, please keep them outside the package folder.

Additionally, create a folder named Image inside the Playbook folder and add all running playbook images into it.

Please also correct the format of the releasenote.md file.

Thanks!

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 30, 2025

Update: All Requested Changes Applied

Hi Microsoft Team,

Thank you for your feedback. We have addressed all the requested changes:

✅ 1. Added solution logo to Logos folder

  • Added Logos/tacitred_logo.svg

✅ 2. Moved packageMetadata.json and deploymentParameters.json outside Package folder

  • Before: Solutions/TacitRed-IOC-CrowdStrike/Package/packageMetadata.json
  • After: Solutions/TacitRed-IOC-CrowdStrike/packageMetadata.json
  • Before: Solutions/TacitRed-IOC-CrowdStrike/Package/deploymentParameters.json
  • After: Solutions/TacitRed-IOC-CrowdStrike/deploymentParameters.json

✅ 3. Created Images folder in Playbooks with running playbook screenshots

  • Solutions/TacitRed-IOC-CrowdStrike/Playbooks/Images/TacitRedToCrowdStrikeLight.png
  • Solutions/TacitRed-IOC-CrowdStrike/Playbooks/Images/TacitRedToCrowdStrikeDark.png

✅ 4. Fixed ReleaseNotes.md format

  • Converted to standard table format with Version, Date Modified, and Change History columns

Thank you!

Data443 Risk Mitigation, Inc.

@mazamizo21 mazamizo21 mentioned this pull request Dec 30, 2025
Merged
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Dec 31, 2025

Hi @mazamizo21, could you please grant me the branch access so I can make the necessary changes and commit them. Thanks!!

This was referenced Dec 31, 2025
Merged
Merged
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Dec 31, 2025

Verified: This solution does not contain any broken tacitred.com or cyren.com documentation URLs. The only TacitRed references are API endpoints (app.tacitred.com) which are functional and required for the connector to work.

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 6, 2026

Hi @mazamizo21, we deployed the maintemplate in our Microsoft Sentinel workspace and checked, but the playbook isn't showing or loading, so we're unable to test it. Could you check in your workspace and share a screenshot here? Thanks!
image

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 6, 2026

Hi @v-shukore,

Thank you for testing the solution! I've identified and fixed the issue with the playbook not showing/loading.

Root Cause

The playbookContentId1 in the mainTemplate was set to a generic string "Playbooks" instead of a unique identifier. This prevented Content Hub from properly registering and displaying the playbook after deployment.

Fix Applied (commits f8fe527, 3fb2e86)

  1. Changed playbookContentId1 from "Playbooks" → "TacitRedToCrowdStrike"
  2. Updated displayName from "Playbooks" → "TacitRed to CrowdStrike IOC Automation"
  3. Fixed dependency contentId reference to use the correct variable
  4. Removed unused variables to pass ARM-TTK validation

The playbook should now properly appear in Content Hub after deployment. Please redeploy and let me know if you can see and test the playbook now.

Thanks!

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 7, 2026

Hi @mazamizo21, I tested again with the updated template, but the playbook still isn't loading in the content hub. Could you please check this? Also, there are now two playbooks appearing in the list, as shown in the screenshot.
image
image
Thanks!!

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 7, 2026

Hi @v-shukore,

Thank you for testing again. I've deployed the solution to a fresh test environment and confirmed the template is working correctly.

✅ Test Results (Fresh Deployment)

Test Result
Content Templates 1 entry only - TacitRedToCrowdStrike
Display Name TacitRed to CrowdStrike IOC Automation
Playbook Instantiation ✅ Success - Logic App created
Sentinel Metadata ✅ Correctly registered

Why You're Seeing Two Playbooks

The two entries ("Playbooks" + "TacitRed to CrowdStrike IOC Automation") are residual data from a previous deployment that used the old generic contentId: "Playbooks". Content Hub cached the old entry when testing the earlier version.

Steps to Resolve

  1. Completely uninstall the TacitRed-IOC-CrowdStrike solution from Content Hub (click Delete)
  2. Go to Resource Groups → find the test resource group → delete any orphaned Logic Apps named pb-tacitred-to-crowdstrike
  3. Reinstall the solution fresh from Content Hub

After a clean reinstall, you should see only one playbook: "TacitRed to CrowdStrike IOC Automation"

Latest Commit

I also pushed commit 38ec4d675c improving the description for clarity.

Could you please try the uninstall/reinstall steps and let me know if it resolves the duplicate issue?

Thanks!

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 9, 2026

Hi @mazamizo21, I tested again in a new workspace and now I can see only one playbook. However, that playbook still isn't loading in the content hub. If it's loading for you, could you please share a screenshot of the running playbook? Thanks!
image

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 9, 2026

Hi @v-gokulm,

Thank you for testing again! I've pushed a fix that should resolve the playbook template loading issue.

Root Cause

The playbookContentId1 was set to a generic string "Playbooks" instead of a unique identifier. This caused Content Hub to fail to properly register and display the playbook template.

Fix Applied (commit 08bf4b2)

  1. Changed playbookContentId1 from "Playbooks" to "TacitRedToCrowdStrike"
  2. Updated displayName from "Playbooks" to "TacitRed to CrowdStrike IOC Automation"
  3. Fixed dependencies contentId reference to use the unique playbook identifier
  4. Regenerated the package zip with the fixed mainTemplate.json

Could you please re-run the validation and test the playbook loading again?

Meeting Request

We've been working on 5 PRs over the past month and the feedback cycle has been challenging due to timezone differences. Could we schedule a 30-minute session next week to discuss these PRs together?

I'm available in EST (Eastern Standard Time) and flexible on timing. A brief call would help us:

  • Quickly resolve any remaining issues across all 5 PRs
  • Get immediate feedback instead of waiting for the next day
  • Ensure we address all requirements correctly

Please let me know if this would be possible. Thank you!

@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 12, 2026

Hi @mazamizo21, we can connect for 30 minutes to discuss all the PR issues. Please schedule the call, let us know the meeting time, and include v-maheshbh@microsoft.com in the invite. Thanks!!

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 12, 2026 via email

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 12, 2026 via email

@mazamizo21 mazamizo21 force-pushed the feature/tacitred-crowdstrike-ioc branch from 9e32d06 to d16e952 Compare January 13, 2026 14:21
@mazamizo21
Solution: TacitRed IOC CrowdStrike Automation (Official) - Clean branch
f269cd7 
Fixed branch contamination - removed unrelated solutions.
This PR contains only TacitRed-IOC-CrowdStrike solution files.
@mazamizo21 mazamizo21 force-pushed the feature/tacitred-crowdstrike-ioc branch from d16e952 to f269cd7 Compare January 14, 2026 14:28
@v-shukore
Copy link
Copy Markdown
Contributor

v-shukore commented Jan 15, 2026

Hi @mazamizo21, could you please resolve the arm-ttk failures
image

@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 15, 2026 via email

@mazamizo21
fix(TacitRed-IOC-CrowdStrike): resolve ARM-TTK failures
2364e81 
- Fix metadata.author to use Data443 company name
- Remove unused Playbooks and _Playbooks variables (ARM-TTK: Variables Must Be Referenced)
- Add support contact to packageMetadata.json
- Clean up old 3.0.4.zip (keep only 3.0.0.zip matching solution version)
- Regenerate 3.0.0.zip with fixed mainTemplate.json
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 15, 2026 via email

@mazamizo21
fix(TacitRed-IOC-CrowdStrike): Add playbook metadata for Content Hub
b64c1ae 
Added metadata section to playbook as required by Content Hub:
- title: TacitRed to CrowdStrike IOC Automation
- description: Playbook functionality description
- prerequisites: API keys required (TacitRed + CrowdStrike OAuth2)
- postDeployment: Configuration steps after deployment
- support: Partner tier with Data443 contact info
- author: Data443 Risk Mitigation, Inc.
- tags: ThreatIntelligence, IOC, CrowdStrike, TacitRed

Reference: Solutions/Microsoft Defender XDR/Playbooks/AttackSimulatorTrainingNonReporters/azuredeploy.json
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 22, 2026

Fix Applied: Added Playbook Metadata for Content Hub

Issue

Microsoft reviewer noted that the playbook metadata was missing, which is required for Content Hub to properly load and display the playbook template.

Changes Made (commit b64c1ae)

Added metadata section to both the playbook JSON and mainTemplate.json following the Microsoft Defender XDR playbook pattern:

  • title: TacitRed to CrowdStrike IOC Automation
  • description: Playbook functionality description
  • prerequisites: API keys required (TacitRed + CrowdStrike OAuth2)
  • postDeployment: Configuration steps after deployment
  • support: Partner tier with Data443 contact info
  • author: Data443 Risk Mitigation, Inc.
  • tags: ThreatIntelligence, IOC, CrowdStrike, TacitRed

Reference Solution

Used as reference: Solutions/Microsoft Defender XDR/Playbooks/AttackSimulatorTrainingNonReporters/azuredeploy.json

Testing Instructions

  1. Delete any existing TacitRed-IOC-CrowdStrike solution from Content Hub
  2. Redeploy the solution from the updated mainTemplate
  3. Verify the playbook template loads correctly with metadata displayed

Thanks for the feedback!

@mazamizo21
fix(TacitRed-IOC-CrowdStrike): Apply reviewer's playbook metadata pat…
a5a4bf0 
…tern

Applied same changes as Microsoft reviewer made to PR Azure#13267:
- Renamed logicAppName parameter to PlaybookName
- Moved metadata to END of nested mainTemplate (after resources array)
- Updated metadata format: prerequisites as array, simplified support
- Added releaseNotes section
- Updated description and displayName to use playbook name

Reference: PR Azure#13267 (TacitRed-SentinelOne) reviewer changes
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 23, 2026

Fix Applied: Updated Playbook Metadata Pattern

Applied the same changes as Microsoft reviewer made to PR #13267 (TacitRed-SentinelOne):

Changes Made (commit a5a4bf0)

  • Renamed logicAppName parameter to PlaybookName
  • Moved metadata to END of nested mainTemplate (after resources array)
  • Updated metadata format: prerequisites as array, simplified support
  • Added releaseNotes section
  • Updated description and displayName to use playbook name
  • Updated lastUpdateTime to 2026-01-22

Reference

PR #13267 (TacitRed-SentinelOne) reviewer changes by @v-maheshbh

Testing Instructions

  1. Delete any existing TacitRed-IOC-CrowdStrike solution from Content Hub
  2. Redeploy the solution from the updated mainTemplate
  3. Verify the playbook template loads correctly in Content Hub

Thanks!

@mazamizo21
fix(TacitRed-IOC-CrowdStrike): Update release notes format per review…
7f2e92d 
…er request

- Remove header line to match standard format
- Update date to current (23-01-2026)
- Simplify description to match other solutions
@mazamizo21
Copy link
Copy Markdown
Contributor Author

mazamizo21 commented Jan 23, 2026

Hi @v-shukore,

I have updated the release notes as requested (commit 7f2e92d):

  • Removed the header line to match standard format
  • Updated date to current (23-01-2026)
  • Simplified description to match other solutions

Thanks!

@v-atulyadav v-atulyadav merged commit ba569a2 into Azure:master Jan 27, 2026
33 checks passed
mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Jan 27, 2026
@mazamizo21
fix(TacitRed-Defender-TI): Change API versions to match working Senti…
296a219 
…nelOne pattern

Changed API versions from 2025-09-01 to 2023-04-01-preview for:
- contentTemplates (Function App and Playbook)
- contentPackages

This matches the working SentinelOne and CrowdStrike solutions that
are successfully loading playbooks in Content Hub.

Reference: PR Azure#13267 (SentinelOne) and PR Azure#13269 (CrowdStrike)
as requested by Microsoft reviewer
@mazamizo21 mazamizo21 mentioned this pull request Feb 19, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@v-atulyadav v-atulyadav v-atulyadav approved these changes

@v-shukore v-shukore v-shukore approved these changes

Assignees

@v-shukore v-shukore

Labels

auto-package New Solution For new Solutions which are new to Microsoft Sentinel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mazamizo21 @v-shukore @v-atulyadav