fix: upgraded recorded future identity for msft defender

[ErikMangstenRecFut]

Required items, please complete

Change(s):

• Upgrading to Microsoft Defender Portal

Reason for Change(s):

• Microsoft moving users to Microsoft Defender Portal

[v-maheshbh]

Hi @ErikMangstenRecFut

Kindly review and address the failing validation error.

Thanks!

[ErikMangstenRecFut]

@v-maheshbh I have done some changes, but the workflows does not run, do you need to do something.

[ErikMangstenRecFut]

@v-maheshbh The error makes no sense, am I unable to reference a log analytics custom table that will be created by our Playbooks on runtime? Or is there somewhere where I can specify tables that will be used? Secondly, I created this YAML rule based on a working json rule (that I created in Microsoft Sentinel), but there is no official tool to actually generate a YAML rule, so this was made with the help of copilot, so I would like to know HOW I can verify that this rule will work and how to do proper JSON (which is the one exported by Microsoft Sentinel) to YAML conversion.

[v-maheshbh]

@v-maheshbh The error makes no sense, am I unable to reference a log analytics custom table that will be created by our Playbooks on runtime? Or is there somewhere where I can specify tables that will be used? Secondly, I created this YAML rule based on a working json rule (that I created in Microsoft Sentinel), but there is no official tool to actually generate a YAML rule, so this was made with the help of copilot, so I would like to know HOW I can verify that this rule will work and how to do proper JSON (which is the one exported by Microsoft Sentinel) to YAML conversion.

Kindly update your branch from the master branch

[v-maheshbh]

Hi @ErikMangstenRecFut

Kindly add the 'RecordedFutureIdentity_PlaybookAlertResults_CL' custom table schema under the below mentioned path to resolve the KQL validation error:

https://github.com/Azure/Azure-Sentinel/tree/master/.script/tests/KqlvalidationsTests/CustomTables

Thanks!

[ErikMangstenRecFut]

@v-maheshbh I have now done this.

[ErikMangstenRecFut]

@v-maheshbh I have now added the Microsoft Log Analytics default field of TimeGenerated to our Custom Logtable tests definition......

[v-maheshbh]

Hi @ErikMangstenRecFut

Kindly add the analytic rule in the appropriate data file and repackage the solution so the changes are reflected in the main template.

Thanks!

[ErikMangstenRecFut]

@v-maheshbh I have now updated the package

[v-maheshbh]

@v-maheshbh I have now updated the package

analytical rule not reflected in main template. kindly repackage using v3 tool.
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Thanks!

[ErikMangstenRecFut]

@v-maheshbh I was using v3, but seems like the module powershell-yaml wasn't installed. And since the packing tool is so verbose the error was very easy to miss. Also the tool gives the all clear even if that module is missed.

[v-maheshbh]

Hi @ErikMangstenRecFut

Please attach the testing screenshot of the analytical rule creation for reference.

Thanks!

[ErikMangstenRecFut]

@v-maheshbh Is there a specific provided yaml-to-json tool that I should use to ensure that the transformation is valid? Since it's not possible to deploy a .yaml file to Microsoft Sentinel.

[v-maheshbh]

@v-maheshbh Is there a specific provided yaml-to-json tool that I should use to ensure that the transformation is valid? Since it's not possible to deploy a .yaml file to Microsoft Sentinel.

We do not have any such tool available. Kindly consider using Copilot for assistance.

Thanks!

[ErikMangstenRecFut]

I'm not entirely sure exactly what screen shot you are requesting. Here is a screenshot of a successful deployment after I transformed the YAML to a JSON with CoPilot.

[ErikMangstenRecFut]

@v-maheshbh Is there something more that needs to be done?

[v-maheshbh]

I'm not entirely sure exactly what screen shot you are requesting. Here is a screenshot of a successful deployment after I transformed the YAML to a JSON with CoPilot.

Kindly verify analytic rule creation by deploying the solution, enabling the rule under Sentinel → Analytics, and attach a screenshot confirming successful creation.

Thanks!

[v-maheshbh]

Hi @ErikMangstenRecFut

Please note that any changes made must be followed by repackaging the solution, so that the updates are correctly reflected in the mainTemplate.json.

Thanks!

[ErikMangstenRecFut]

@v-maheshbh Yes, thanks for the information. Redoing some parts of the solution since to be able to enable the analytic rule the table and all columns need to exist, and since we are using azureloganalyticsdatacollector that creates the table on run, we'll need an initial check to verify that the table exists.