[SOLUTION] Update Halcyon Solution by kwest-halcyon · Pull Request #13928 · Azure/Azure-Sentinel

kwest-halcyon · 2026-03-26T18:58:06Z

Required items, please complete

Change(s):

Update Data Connector's DCR to handle a different set of fields and write to a new custom table
Create new custom table: HalcyonEvents_CL
Delete existing custom tables
Update existing ASIM parsers to read from new HalcyonEvents_CL table

Reason for Change(s):

Changing the schema of the data push to Sentinel to OCSF and then providing parsers to transform to ASIM. Previously we were sending data in ASIM schema directly

Version Updated:

Updated Solution to 3.1.0

Testing Completed:

Yes: Deployed mainTemplate.json to a clean Sentinel instance and confirmed data ingest and parsers worked as expected

Checked that the validations are passing and have addressed any issues that are present:

Need Help. Developing with Mac

Copilot

Pull request overview

Updates the Halcyon Sentinel solution to ingest OCSF-shaped events into a new unified custom table (HalcyonEvents_CL) and adjusts solution metadata, release notes, and ASIM parsers accordingly.

Changes:

Bumps solution version and updates release notes/metadata dates for the new release.
Updates ASIM parsers to query the new HalcyonEvents_CL table and map OCSF fields into ASIM.
Reworks connector assets to use a single events table instead of multiple per-schema custom tables.

Reviewed changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
Solutions/Halcyon/SolutionMetadata.json	Updates publish metadata date for the new release.
Solutions/Halcyon/ReleaseNotes.md	Adds 3.1.0 entry describing the schema/connector update.
Solutions/Halcyon/Parsers/ASimProcessEventHalcyon.yaml	Parser now reads from `HalcyonEvents_CL` and maps process fields.
Solutions/Halcyon/Parsers/ASimNetworkSessionHalcyon.yaml	Parser now reads from `HalcyonEvents_CL` and maps network session fields.
Solutions/Halcyon/Parsers/ASimFileEventHalcyon.yaml	Parser now reads from `HalcyonEvents_CL` and maps file activity fields.
Solutions/Halcyon/Parsers/ASimDnsHalcyon.yaml	Parser now reads from `HalcyonEvents_CL` and maps DNS fields.
Solutions/Halcyon/Parsers/ASimAuthenticationHalcyon.yaml	Parser now reads from `HalcyonEvents_CL` and maps authentication fields.
Solutions/Halcyon/Package/createUiDefinition.json	Updates solution install description text (file in ignored path for review).
Solutions/Halcyon/Data/Solution_Halcyon.json	Updates solution description/version and maintains packaging metadata.
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_events.json	Adds new unified custom table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_ProcessEvent.json	Removes old per-schema table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_NetworkSession.json	Removes old per-schema table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_FileActivity.json	Removes old per-schema table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_DnsActivity.json	Removes old per-schema table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_table_AuthenticationEvent.json	Removes old per-schema table definition (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_connectorDefinition.json	Updates connector definition to reference unified events table (file in ignored path for review).
Solutions/Halcyon/Data Connectors/Halcyon_ccp/Halcyon_DCR.json	Updates DCR columns/transform for OCSF-like payload and new table (file in ignored path for review).

Copilot · 2026-03-27T09:10:13Z

Solutions/Halcyon/ReleaseNotes.md

 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                          |
 |-------------|--------------------------------|---------------------------------------------|
-|3.0.0        | 12-09-2025                     | Initial Solution release
+|3.1.0        | 24-03-2026                     | Update Connector to recieve events with OCSF schemas | 


Correct spelling in release notes: change 'recieve' to 'receive'.

Suggested change

|3.1.0 | 24-03-2026 | Update Connector to recieve events with OCSF schemas |

|3.1.0 | 24-03-2026 | Update Connector to receive events with OCSF schemas |

Copilot · 2026-03-27T09:10:14Z

Solutions/Halcyon/Data/Solution_Halcyon.json

@@ -2,7 +2,7 @@
  "Name": "Halcyon",
  "Author": "Halcyon",


In Solution_*.json, Author must include a contact email in the format {Organization} - {email} (e.g., Halcyon - support@halcyon.ai) to meet solution packaging requirements.

Suggested change

"Author": "Halcyon",

"Author": "Halcyon - support@halcyon.ai",

Copilot · 2026-03-27T09:10:14Z

Solutions/Halcyon/Data/Solution_Halcyon.json

-  "Version": "3.0.0",
+  "Version": "3.1.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,


For solution data files, Version 3.*.* must have TemplateSpec set to false. With Version: 3.1.0, TemplateSpec: true will fail validation—set it to false.

Suggested change

"TemplateSpec": true,

"TemplateSpec": false,

Copilot · 2026-03-27T09:10:14Z

Solutions/Halcyon/Data/Solution_Halcyon.json

  "Author": "Halcyon",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/halcyon.svg\" width=\"75px\" height=\"75px\">",
-  "Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.",
+  "Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\nInstalling this solution automatically provisions a Data Collection Endpoint (DCE) and Data Collection Rule (DCR) in your Azure environment. These resources are updated automatically with each solution upgrade. To complete the connector setup, use the **Deploy** button on the Halcyon connector page to create the required Entra app registration and link it to the DCR.",


Solution Description should include the standard Underlying Microsoft Technologies used: section (and preview/cost disclaimer if applicable). This helps meet solution description standards and sets expectations for DCR/DCE-related dependencies and costs.

Suggested change

"Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\nInstalling this solution automatically provisions a Data Collection Endpoint (DCE) and Data Collection Rule (DCR) in your Azure environment. These resources are updated automatically with each solution upgrade. To complete the connector setup, use the **Deploy** button on the Halcyon connector page to create the required Entra app registration and link it to the DCR.",

"Description": "The [Halcyon](https://www.halcyon.ai) solution for Microsoft Sentinel enables you to ingest Halcyon Events and Alerts into Microsoft Sentinel using the Microsoft Sentinel Analytics Workspace.\n\nInstalling this solution automatically provisions a Data Collection Endpoint (DCE) and Data Collection Rule (DCR) in your Azure environment. These resources are updated automatically with each solution upgrade. To complete the connector setup, use the **Deploy** button on the Halcyon connector page to create the required Entra app registration and link it to the DCR.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following Microsoft technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional data ingestion or operational costs:\n\na. [Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/)\n\nb. [Azure Monitor Data Collection Rules (DCR)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview)\n\nc. [Azure Monitor Data Collection Endpoints (DCE)](https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-endpoint-overview)\n\nd. [Azure Log Analytics workspaces](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-workspace-overview)",

Copilot · 2026-03-27T09:10:15Z

Solutions/Halcyon/Data/Solution_Halcyon.json

@@ -18,8 +18,8 @@
  "Hunting Queries": [],
  "Playbooks": [],
  "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Halcyon",


The preferred BasePath format in this repo uses C:\\GitHub\\... (capital H) for consistency (even though other formats may still work). Consider updating to C:\\GitHub\\Azure-Sentinel\\Solutions\\Halcyon.

Suggested change

"BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Halcyon",

"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Halcyon",

Copilot · 2026-03-27T09:10:15Z

Solutions/Halcyon/Parsers/ASimNetworkSessionHalcyon.yaml

+          Dst                    = DstIpAddr,
+          IpAddr                 = SrcIpAddr,
+          Dvc                    = DvcHostname
+      | project-away _ResourceId


The parser currently leaves the original OCSF fields (including potentially large dynamic columns like metadata, actor, device, src_endpoint, dst_endpoint, raw_data, etc.) in the output. This can bloat results and slow downstream queries. Prefer project (or project-away) to keep only the ASIM output columns (plus any intentionally surfaced raw fields). This same pattern appears across the other updated parsers.

Suggested change

| project-away _ResourceId

| project

TimeGenerated,

EventVendor,

EventProduct,

EventProductVersion,

EventSchema,

EventSchemaVersion,

EventCount,

EventStartTime,

EventEndTime,

EventType,

EventResult,

EventOriginalType,

EventOriginalSeverity,

EventSeverity,

EventMessage,

DvcAction,

SrcIpAddr,

SrcPortNumber,

SrcHostname,

SrcDomain,

SrcMacAddr,

DstIpAddr,

DstPortNumber,

DstHostname,

DstDomain,

DstMacAddr,

DvcHostname,

DvcIpAddr,

DvcId,

Src,

Dst,

IpAddr,

Dvc

Copilot · 2026-03-27T09:10:15Z

Solutions/Halcyon/Data/Solution_Halcyon.json

  "Playbooks": [],
  "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Halcyon",
-  "Version": "3.0.0",
+  "Version": "3.1.0",


PR description says Version Updated: N/A, but this change bumps the solution version to 3.1.0. Please update the PR description (or adjust the versioning) so they match.

kwest-halcyon · 2026-04-06T16:52:05Z

@v-maheshbh I addressed all the copilot comments and fixed the failing KQL test last week. I would really appreciate a review. Thank you!

v-atulyadav · 2026-04-09T11:38:26Z

Hi @kwest-halcyon,

I noticed that ASIM files have been added to the solution folder, which doesn’t align with our standards. Please remove these files from the current PR and create a new PR for them, ensuring each file is placed in the appropriate folder as per the path provided below. Thanks

https://github.com/Azure/Azure-Sentinel/tree/master/Parsers

kwest-halcyon · 2026-04-09T17:20:01Z

Hi @v-atulyadav

The ASIM parsers were already in the solution. I have removed them anyways and will open up a new PR following this one that moves them into the correct Parsers directory

kwest-halcyon requested review from a team as code owners March 26, 2026 18:58

v-shukore assigned v-maheshbh Mar 27, 2026

v-shukore added the Solution Solution specialty review needed label Mar 27, 2026

v-maheshbh requested a review from Copilot March 27, 2026 09:08

Copilot AI reviewed Mar 27, 2026

View reviewed changes

v-sabiraj assigned v-atulyadav and unassigned v-atulyadav Mar 27, 2026

kwest-halcyon requested a review from a team as a code owner March 31, 2026 13:27

kwest-halcyon force-pushed the master branch from 57c7566 to 4dcb144 Compare April 3, 2026 16:16

v-maheshbh added the ASIM label Apr 8, 2026

v-maheshbh assigned v-atulyadav and unassigned v-maheshbh Apr 8, 2026

v-atulyadav added the SafeToRun This is used only for ASim parsers Fork PR Pipeline run. label Apr 9, 2026

v-atulyadav assigned v-maheshbh Apr 9, 2026

v-atulyadav removed the SafeToRun This is used only for ASim parsers Fork PR Pipeline run. label Apr 9, 2026

Kyle West added 3 commits April 9, 2026 11:02

update solution to handle events with ocsf schemas

b7b7e2c

pr feedback

a408f62

update halcyon custom tables in ksql tests tool

1a11c90

kwest-halcyon force-pushed the master branch from 4dcb144 to 1a11c90 Compare April 9, 2026 17:03

remove parsers, add sample query

c05c4bc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SOLUTION] Update Halcyon Solution#13928

[SOLUTION] Update Halcyon Solution#13928
kwest-halcyon wants to merge 4 commits intoAzure:masterfrom
Halcyon-Sentinel-Integration:master

kwest-halcyon commented Mar 26, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

kwest-halcyon commented Apr 6, 2026

Uh oh!

v-atulyadav commented Apr 9, 2026

Uh oh!

kwest-halcyon commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	\|3.1.0 \| 24-03-2026 \| Update Connector to recieve events with OCSF schemas \|
	\|3.1.0 \| 24-03-2026 \| Update Connector to receive events with OCSF schemas \|

	"Author": "Halcyon",
	"Author": "Halcyon - support@halcyon.ai",

	"BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Halcyon",
	"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Halcyon",

-      | project-away _ResourceId
+      | project
+          TimeGenerated,
+          EventVendor,
+          EventProduct,
+          EventProductVersion,
+          EventSchema,
+          EventSchemaVersion,
+          EventCount,
+          EventStartTime,
+          EventEndTime,
+          EventType,
+          EventResult,
+          EventOriginalType,
+          EventOriginalSeverity,
+          EventSeverity,
+          EventMessage,
+          DvcAction,
+          SrcIpAddr,
+          SrcPortNumber,
+          SrcHostname,
+          SrcDomain,
+          SrcMacAddr,
+          DstIpAddr,
+          DstPortNumber,
+          DstHostname,
+          DstDomain,
+          DstMacAddr,
+          DvcHostname,
+          DvcIpAddr,
+          DvcId,
+          Src,
+          Dst,
+          IpAddr,
+          Dvc

Conversation

kwest-halcyon commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

kwest-halcyon commented Apr 6, 2026

Uh oh!

v-atulyadav commented Apr 9, 2026

Uh oh!

kwest-halcyon commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kwest-halcyon commented Mar 26, 2026 •

edited

Loading