AbnormalSecurity: Add CCF Push connector with multi-table routing (v3.0.0)

[anoopabsec]

Summary

This PR adds a new CCF Push-based data connector to the Abnormal Security solution, bumping the solution to v3.0.0 as requested. The legacy Azure Functions connector is retained for backward compatibility.

New connector: Abnormal Security (Push)

• Kind: `Push` (Codeless Connector Framework)
• Authentication: OAuth 2.0 client credentials via Azure Monitor Ingestion API
• Routing: 9-stream DCR routing events by event type to dedicated per-table outputs
• Setup UX: `DeployPushConnectorButton` — one click creates DCE, DCR, Entra app, client secret, and role assignment

Tables (9)

Table	Event Type
`ABNORMAL_SECURITY_THREAT_LOG_CL`	THREAT_LOG
`ABNORMAL_SECURITY_CASE_CL`	CASE
`ABNORMAL_SECURITY_AUDIT_LOG_CL`	AUDIT_LOG
`ABNORMAL_SECURITY_ABUSE_MAILBOX_CL`	ABUSE_MAILBOX
`ABNORMAL_SECURITY_POSTURE_CHANGE_CL`	POSTURE_CHANGE
`ABNORMAL_SECURITY_ATO_CASE_CL`	ATO_CASE
`ABNORMAL_SECURITY_REMEDIATION_CL`	REMEDIATION
`ABNORMAL_SECURITY_VENDOR_CASE_CL`	VENDOR_CASE
`AbnormalSecurityLogs_CL`	fallback (unknown event types)

Files changed

• New: `Data Connectors/AbnormalSecurity_CCF/` — connectorDefinition, dataConnector, DCR, 9 table schemas, 9 sample data files
• Updated: `Data/Solution_AbnormalSecurity.json` — version 3.0.0, added CCF connector path
• Updated: `Package/` — mainTemplate.json, createUiDefinition.json, testParameters.json, 3.0.0.zip regenerated by V3 packaging tool
• Updated: `SolutionMetadata.json` — lastPublishDate
• Updated: `ReleaseNotes.md` — v3.0.0 entry at top

arm-ttk results

48/49 tests passed. The one failure (`IDs Should Be Derived From ResourceIDs` on `contentProductId`) is generated by the packaging tool itself and is a known accepted failure across CCF connector submissions in this repo.

---

Connector Verification

The CCF Push connector was deployed to a test Microsoft Sentinel workspace (`abnormal-test-ccf`) by deploying the `mainTemplate.json` directly. The screenshot below shows the Abnormal Security (Push) connector in the Connected state with data being received.

---

Test plan

• mainTemplate.json deployed successfully to test Sentinel workspace
• Abnormal Security (Push) connector appears in Data Connectors view
• Connector shows Connected status with data received
• Both connectors (CCF Push + legacy Azure Functions) present in solution
• Solution packaged at v3.0.0 using V3 packaging tool
• "Deploy Abnormal Security Push Connector" button creates DCE, DCR, Entra app, and role assignment
• CopyableLabel fields populate with Tenant ID, App ID, Secret, DCE endpoint, DCR ID

[v-maheshbh]

Hi @anoopabsec

Please accept the CLA so we can proceed with the PR review.

Thanks!

[anoopabsec]

@microsoft-github-policy-service agree company="Abnormal AI"

[anoopabsec]

@v-maheshbh I have accepted the CLA

[v-maheshbh]

Hi @anoopabsec

Kindly refer below ccf push type connector and rename file names and folder structure accordingly
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/OneTrust

and
Kindly note that version 4.0.0 is not allowed. Please package the solution using the V3 tool, ensuring the version is set to next incremented version to 3.0.1 or 3.1.0.
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Thanks!!

[anoopabsec]

@v-maheshbh All feedback has been addressed:

1. Folder/file naming — Renamed to match OneTrust CCF convention:

   • Folder: AbnormalSecurity_CCF/
   • Files: AbnormalSecurity_connectorDefinition.json, AbnormalSecurity_dataConnector.json, AbnormalSecurity_DCR.json, AbnormalSecurity_table_*.json (×9)

2. Version — Changed from 4.0.0 → 3.1.0 (minor bump for new CCF connector feature, incremented from the previous 3.0.0)

3. Packaging — Repackaged using V3 tool with version 3.1.0; 3.1.0.zip added to Package/ folder

4. Branding — Fixed all table descriptions to use "Microsoft Sentinel" instead of "Sentinel"

5. arm-ttk — 48/49 pass; the one failure (IDs Should Be Derived From ResourceIDs on contentProductId) is generated by the packaging tool and is a known accepted failure seen across other CCF connector submissions

Re: CI failures — The DetectionTemplateSchemaValidation failures in the CI run are pre-existing failures in unrelated solutions (VMware SD-WAN, Cisco Umbrella, Valence, NetBackup) and are not caused by this PR.

Thanks for the detailed feedback!

[anoopabsec]

@v-maheshbh Following up on this PR — all the feedback from your March 3 review has been addressed (folder/file naming, version 3.1.0, V3 packaging, branding fixes). Could you take another look when you get a chance? Happy to make any further changes needed to get this merged.

Thanks!

[v-maheshbh]

Hi @anoopabsec

Kindly update the release notes by adding the latest version details at the top.
and attached testing screenshot ccf data connector in connected state for reference.

Thanks!

[anoopabsec]

@v-maheshbh Quick update — release notes have been updated with the latest version (3.1.0) now at the top of the table.

One question: to provide a testing screenshot of the CCF data connector in a Connected state, we would need to deploy and test it in a Sentinel workspace first. However, since the solution hasn't been approved/published yet, we're unsure how to proceed with this testing step.

Could you advise on the expected process — is there a way to manually deploy and test the connector before the PR is merged, or is this something that gets validated post-approval?

Thanks!

[v-maheshbh]

@v-maheshbh Quick update — release notes have been updated with the latest version (3.1.0) now at the top of the table.

One question: to provide a testing screenshot of the CCF data connector in a Connected state, we would need to deploy and test it in a Sentinel workspace first. However, since the solution hasn't been approved/published yet, we're unsure how to proceed with this testing step.

Could you advise on the expected process — is there a way to manually deploy and test the connector before the PR is merged, or is this something that gets validated post-approval?

Thanks!

You can custom‑deploy the main template to your test workspace and verify the connector deployment from Content Hub. Once deployed, please confirm the connector is in the Connected state and attach the testing screenshots, so we can proceed with the merge.

Thanks!

[anoopabsec]

@v-maheshbh Sharing the connector verification screenshot as requested. The Abnormal Security (Push) connector was deployed to a test Microsoft Sentinel workspace (abnormal-test-ccf) by deploying the mainTemplate.json directly, and is confirmed in the Connected state with data being received.

Please let us know if any additional verification is needed. Thanks!

[anoopabsec]

@v-maheshbh All feedback has been addressed and the connector verification screenshot has been shared showing the Abnormal Security (Push) connector in a Connected state. Could you please review and approve the PR so we can proceed with the merge?

Thank you!

[v-maheshbh]

Hi @anoopabsec

Version 3.0.0 is not live on Content Hub, whereas the solution has been packaged with version 3.1.0. Kindly ensure that the packaged version is incremented based on the current live version in Content Hub.

Thanks!

[anoopabsec]

@v-maheshbh Updated the solution version to v2.1.0, correctly incremented from the live Content Hub version v2.0.1. The previous 3.1.0 versioning was inherited from a repo commit that was never published to Content Hub. All package files have been regenerated accordingly and the incorrect zip has been removed.

[v-maheshbh]

@v-maheshbh Updated the solution version to v2.1.0, correctly incremented from the live Content Hub version v2.0.1. The previous 3.1.0 versioning was inherited from a repo commit that was never published to Content Hub. All package files have been regenerated accordingly and the incorrect zip has been removed.

Kindly package the solution with version 3.0.0.
Thanks!

[anoopabsec]

@v-maheshbh Done — solution has been repackaged at v3.0.0 using the V3 packaging tool. The mainTemplate.json, createUiDefinition.json, testParameters.json, and 3.0.0.zip have all been regenerated and pushed. ReleaseNotes updated accordingly.

[anoopabsec]

@v-maheshbh Just checking in — could you please review the latest changes and let us know if anything else is needed to move forward with the merge? Thanks!

[anoopabsec]

@v-maheshbh Following up again — all requested changes have been addressed including the version repackage at v3.0.0. Could you please take a look and approve when you get a chance? Happy to make any further adjustments. Thanks!