SecOps - 41203 - Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connector

[Manoj Kesana (Manoj-Kesana)]

No description provided.

[Copilot]

Pull request overview

Adds a new SecOps assessment (Test ID 41203) to evaluate whether Microsoft Sentinel workspaces have at least one customer-/partner-authored codeless (custom) data connector configured, and provides the accompanying markdown description for reporting/remediation context.

Changes:

• Introduces Test-Assessment-41203 PowerShell test to enumerate Sentinel workspaces, query data connectors/definitions, classify “custom” connectors by publisher, and emit a summarized markdown table.
• Adds Test-Assessment.41203.md narrative/remediation content for the new assessment.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/powershell/tests/Test-Assessment.41203.ps1	New assessment implementation that queries Sentinel workspaces and evaluates presence of custom codeless connectors.
src/powershell/tests/Test-Assessment.41203.md	New assessment documentation/remediation text and results placeholder.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Aleksandar Nikolić (alexandair)]

Manoj Kesana (@Manoj-Kesana) Please, address my feedback.

Suggestion: Include inaccessible or unresolved workspace rows in the report. The current table is built only from confirmed onboarded workspaces, so an Investigate result does not show every workspace that caused it.

[Aleksandar Nikolić (alexandair)]

LGTM