Solution: TacitRed SentinelOne IOC Automation (Official) #13267

mazamizo21 · 2025-12-08T19:24:11Z

Official Data443 Submission

This is the official submission from the Data443 organization for the TacitRed SentinelOne IOC Automation solution.

Changes

Standardized publisher information to 'Data443 Risk Mitigation, Inc.'.
Added comprehensive documentation.
Validated implementation.

This PR supersedes and replaces PR #13243.
Please close #13243 in favor of this one.

- Cyren: IP Reputation and Malware URLs CCF data connectors - TacitRed: Compromised Credentials CCF data connector - Both solutions include workbooks, analytics rules, and custom tables - All templates pass arm-ttk validation (102/102 tests)

- CCF data connector - Workbooks and analytics rules - All templates pass arm-ttk validation

…back

…d, and regenerate packages

…d cost warnings TacitRed: - Changed queryWindowInMin from 5 to 60 minutes (12x reduction in API calls) - Added cost warning in connector instructions Cyren: - Changed queryWindowInMin from 240 to 1440 minutes (6x reduction - daily polling) - Reduced rateLimitQps from 10 to 2 - Added risk_d >= 50 filter in DCR to filter out low-risk indicators - Added cost warning in connector instructions These changes reduce ingestion costs significantly while maintaining detection quality.

- Playbook to sync TacitRed compromised credentials to CrowdStrike IOCs - V3 packaging: Name matches folder, BasePath correct, Version 3.0.0 - Includes packageMetadata.json and 3.0.0.zip - Runs every 6 hours (reasonable for playbook-based automation)

TacitRed-LogicApp-Ingestion: - Logic App with managed identity for TacitRed API polling - Ingests to Sentinel via Logs Ingestion API (DCE/DCR) - Configurable polling interval Cyren-LogicApp-Ingestion: - Two Logic Apps for IP Reputation and Malware URLs feeds - Managed identity authentication to Azure Monitor - Ingests to Sentinel via Logs Ingestion API (DCE/DCR) Both solutions: - V3 packaging compliant - 3.0.0.zip with all required files - arm-ttk validated

- TacitRed Logic App: Replace hardcoded dates with dynamic utcNow() expressions - Regenerate all 3.0.0.zip files for all 5 solutions - All CCF and Logic App solutions now use proper placeholders for secrets

TacitRed CCF + Logic App: - TacitRed - Repeat Compromise Detection.yaml - TacitRed - High Confidence Compromise.yaml Cyren CCF + Logic App: - Cyren - High Risk IP Detection.yaml - Cyren - Malware URL Detected.yaml Updated Solution_*.json to reference analytics rules. Regenerated all V3 packages with analytics included.

- CCF data connector - Workbooks and analytics rules - All templates pass arm-ttk validation

…tRed analytic rules - Remove duplicate Cyren solutions (Cyren-CCFThreatIntelligence, Cyren-LogicApp-Ingestion) - Remove duplicate TacitRed solutions (TacitRed-LogicApp-Ingestion, Tacitred-CCF-Hub-v2ThreatIntelligence) - Keep canonical CyrenThreatIntelligence and TacitRedThreatIntelligence folders - Add TacitRed analytic rules with proper MITRE tactics (includes Reconnaissance for T1589) - Update Solution_TacitRed.json to reference analytic rules

…k JSON

…elligence

…k/detectionTemplateSchemaValidation

This reverts commit 82bd62c.

…ccf-hub-v2threatintelligence

…alidConnectorIds.json)

…letions)

…ranches)

v-shukore · 2025-12-30T07:02:00Z

Hi @mazamizo21,

Please remove the 1.0.2 zip package from the solution.

Also, remove the packagemetadata.json and deploymentParameters.json files from the package folder. If these files are necessary, please keep them outside the package folder.

Additionally, create a folder named Image inside the Playbook folder and add all running playbook images into it.

Please also correct the format of the releasenote.md file.

Thanks!

…ata/deploymentParameters outside Package, fix ReleaseNotes.md format

mazamizo21 · 2025-12-30T14:09:43Z

Update: All Requested Changes Applied

Hi Microsoft Team,

Thank you for your feedback. We have addressed all the requested changes:

✅ 1. Removed 1.0.2 zip package

Deleted Solutions/TacitRed-SentinelOne/Package/1.0.2.zip
Only 3.0.0.zip remains in the Package folder

✅ 2. Moved packageMetadata.json and deploymentParameters.json outside Package folder

Before: Solutions/TacitRed-SentinelOne/Package/packageMetadata.json
After: Solutions/TacitRed-SentinelOne/packageMetadata.json
Before: Solutions/TacitRed-SentinelOne/Package/deploymentParameters.json
After: Solutions/TacitRed-SentinelOne/deploymentParameters.json

✅ 3. Created Images folder in Playbooks with running playbook screenshots

Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneLight.png
Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneDark.png

✅ 4. Fixed ReleaseNotes.md format

Added proper # Release Notes heading
Aligned table columns correctly

Thank you!

Data443 Risk Mitigation, Inc.

v-shukore · 2025-12-31T05:26:44Z

Hi @mazamizo21, could you please grant me the branch access so I can make the necessary changes and commit them. Thanks!!

mazamizo21 · 2025-12-31T11:47:39Z

Hi, I granted you access. Please accept the invitation here: https://github.com/Data443/Azure-Sentinel/invitations Thanks for your support, I really appreciate it. I’m hoping we can get the five PRs released soon. I also granted you access to all five PRs for Data443. The 5 Active PRs PR Solution Source Branch #13266 TacitRed Defender TI Data443:feature/tacitred-defender-ti #13267 TacitRed SentinelOne Data443:feature/tacitred-sentinelone-v1 #13268 TacitRed CCF Data443:feature/tacitred-ccf-hub-v2 #13269 TacitRed CrowdStrike Data443:feature/tacitred-crowdstrike-ioc #13278 Cyren TI Data443:feature/cyren-threat-intelligence Thanks Taz Jack

…

________________________________ From: v-shukore ***@***.***> Sent: Tuesday, December 30, 2025 7:27 PM To: Azure/Azure-Sentinel ***@***.***> Cc: mazamizo21 ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] Solution: TacitRed SentinelOne IOC Automation (Official) (PR #13267) [https://avatars.githubusercontent.com/u/159111145?s=20&v=4]v-shukore left a comment (Azure/Azure-Sentinel#13267)<#13267 (comment)> Hi @mazamizo21<https://github.com/mazamizo21>, could you please grant me the branch access so I can make the necessary changes and commit them. Thanks!! — Reply to this email directly, view it on GitHub<#13267 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A45BJJV2BNM67RSKFA37GPT4ENNC5AVCNFSM6AAAAACONE6L46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTOMBRGQ3TKOJVGI>. You are receiving this because you were mentioned.Message ID: ***@***.***>

mazamizo21 · 2025-12-31T11:54:51Z

Verified: This solution does not contain any broken tacitred.com or cyren.com documentation URLs. The only TacitRed references are API endpoints (app.tacitred.com) which are functional and required for the connector to work.

v-shukore · 2026-01-06T05:11:01Z

Hi @mazamizo21, we deployed the maintemplate in our Microsoft Sentinel workspace and checked, but the playbook isn't showing or loading, so we're unable to test it. Could you check in your workspace and share a screenshot here? Thanks!

Update TacitRed Platform link from generic data443.com to specific: https://data443.com/tacitred-attack-surface-intelligence/ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>

mazamizo21 · 2026-01-06T13:28:35Z

Hi @v-shukore,

Thank you for testing the solution! I've identified and fixed the issue with the playbook not showing/loading.

Root Cause

The playbookContentId1 in the mainTemplate was set to a generic string "Playbooks" instead of a unique identifier. This prevented Content Hub from properly registering and displaying the playbook after deployment.

Fix Applied (commit `02582c3`)

Changed playbookContentId1 from "Playbooks" → "TacitRedToSentinelOne"
Updated displayName from "Playbooks" → "TacitRed to SentinelOne IOC Automation"
Fixed dependency contentId reference to use the correct variable
Removed unused variables for ARM-TTK compliance

The playbook should now properly appear in Content Hub after deployment. Please redeploy and let me know if you can see and test the playbook now.

Thanks!

- Add tacitred_logo.svg to top-level Logos/ directory - Update Solution_TacitRedSentinelOneAutomation.json Logo field path from Workbooks/Images/Logos/ to Logos/ - Remove spaces between img tag attributes (svg"width= not svg" width=) - Remove packageMetadata.json (not needed for this solution type) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

- TacitRed-SentinelOne solution has no workbooks - Revert accidental WorkbooksMetadata.json modifications - Branch contamination from earlier operations Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

mazamizo21 and others added 30 commits November 26, 2025 17:28

Add Cyren-CCFThreatIntelligence Sentinel solution

11f7907

- CCF data connector - Workbooks and analytics rules - All templates pass arm-ttk validation

Add Tacitred-CCF-Hub-v2ThreatIntelligence Sentinel solution

f95d86a

- CCF data connector - Workbooks and analytics rules - All templates pass arm-ttk validation

Align TacitRed solution metadata and V3 packaging with Microsoft feed…

fb24642

…back

Align Cyren solution metadata and V3 packaging with Microsoft guidance

b15e49d

V3 compliance: fix Data Connectors paths, BasePath, Name, connector i…

3569444

…d, and regenerate packages

Fix hardcoded dates in TacitRed Logic App playbook, regenerate all ZIPs

378df4a

- TacitRed Logic App: Replace hardcoded dates with dynamic utcNow() expressions - Regenerate all 3.0.0.zip files for all 5 solutions - All CCF and Logic App solutions now use proper placeholders for secrets

Add Tacitred-CCF-Hub-v2ThreatIntelligence Sentinel solution

48cd3ef

- CCF data connector - Workbooks and analytics rules - All templates pass arm-ttk validation

Fix TacitRed and Cyren detection templates and connector IDs

675419a

Add KQL validation schemas for TacitRed and Cyren custom tables

bcb212f

Fix Cyren DCR ID derivation for SolutionValidations

cbaea2d

Add TacitRed SecOps workbook to solution data and externalize workboo…

b6a2c2a

…k JSON

Merge branch 'Azure:master' into feature/tacitred-ccf-hub-v2threatint…

52fd04f

…elligence

Fix Cyren analytic rule GUIDs and connector id expressions for arm-tt…

80a02dc

…k/detectionTemplateSchemaValidation

fix: update CyrenThreatIntelligence Content Hub package

06a362c

fix: sync CyrenThreatIntelligence solution from staging

82bd62c

Revert "fix: sync CyrenThreatIntelligence solution from staging"

1746080

This reverts commit 82bd62c.

fix: sync CyrenThreatIntelligence package from staging

ea5e251

fix: sync TacitRedThreatIntelligence package from staging

b089361

fix: sync TacitRed-IOC-CrowdStrike package from staging

7e1d893

fix: restore valid hex GUIDs in Cyren analytic rule IDs

7df4284

fix: sync TacitRed-SentinelOne package from staging

f0a54f1

fix: sync TacitRedThreatIntelligence package from staging

81762c9

Merge remote-tracking branch 'upstream/master' into feature/tacitred-…

6d2717d

…ccf-hub-v2threatintelligence

Merge remote-tracking branch 'upstream/master' into feature/tacitred-…

c2e6673

…ccf-hub-v2threatintelligence

mazamizo21 added 5 commits December 15, 2025 07:00

fix: Regenerate zip with updated createUiDefinition.json

fb5881e

fix: Enforce Data443 support contact

dcdaab8

fix: Stabilize SentinelOne V3 package

c12d06b

fix(ci): avoid GitHub API rate limits in documentsLinkValidator

7ec3e45

fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)

d4b7032

mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025

fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)

8f92140

mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025

fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)

06180eb

mazamizo21 added a commit to Data443/Azure-Sentinel that referenced this pull request Dec 18, 2025

fix: resolve ValidConnectorIds allowlist conflict (PR Azure#13267)

06df6ea

mazamizo21 added 4 commits December 18, 2025 16:39

Merge upstream/master into feature/tacitred-sentinelone-v1 (resolve V…

cc0f9af

…alidConnectorIds.json)

Merge upstream/master to resolve WorkbooksMetadata.json conflict

52e382a

chore: Restore Threat Intelligence (NEW) solution (undo accidental de…

c7417a5

…letions)

chore: Remove extraneous files and CI fixtures (belongs to other PR b…

54fcbdc

…ranches)

mazamizo21 added 2 commits December 30, 2025 09:00

fix: Address Microsoft feedback - remove 1.0.2.zip, move packageMetad…

695dc08

…ata/deploymentParameters outside Package, fix ReleaseNotes.md format

docs: Add playbook designer screenshots (light and dark themes)

ed7d1cd

contentautomationbot bot added the auto-package label Dec 30, 2025

mazamizo21 mentioned this pull request Dec 30, 2025

Solution: TacitRed Defender Threat Intelligence (Official) #13266

Open

mazamizo21 mentioned this pull request Dec 31, 2025

Solution: TacitRed Threat Intelligence (Official) #13268

Open

mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch 2 times, most recently from 33866c1 to 59a4da3 Compare January 13, 2026 14:20

Remove WorkbooksMetadata.json contamination

abf9afd

- TacitRed-SentinelOne solution has no workbooks - Revert accidental WorkbooksMetadata.json modifications - Branch contamination from earlier operations Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

mazamizo21 force-pushed the feature/tacitred-sentinelone-v1 branch from 59a4da3 to abf9afd Compare January 14, 2026 01:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Solution: TacitRed SentinelOne IOC Automation (Official) #13267

Solution: TacitRed SentinelOne IOC Automation (Official) #13267

Uh oh!

mazamizo21 commented Dec 8, 2025

Uh oh!

v-shukore commented Dec 30, 2025

Uh oh!

mazamizo21 commented Dec 30, 2025

Uh oh!

v-shukore commented Dec 31, 2025

Uh oh!

mazamizo21 commented Dec 31, 2025 via email

Uh oh!

mazamizo21 commented Dec 31, 2025

Uh oh!

v-shukore commented Jan 6, 2026

Uh oh!

mazamizo21 commented Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Solution: TacitRed SentinelOne IOC Automation (Official) #13267

Are you sure you want to change the base?

Solution: TacitRed SentinelOne IOC Automation (Official) #13267

Uh oh!

Conversation

mazamizo21 commented Dec 8, 2025

Official Data443 Submission

Changes

Uh oh!

v-shukore commented Dec 30, 2025

Uh oh!

mazamizo21 commented Dec 30, 2025

Update: All Requested Changes Applied

✅ 1. Removed 1.0.2 zip package

✅ 2. Moved packageMetadata.json and deploymentParameters.json outside Package folder

✅ 3. Created Images folder in Playbooks with running playbook screenshots

✅ 4. Fixed ReleaseNotes.md format

Uh oh!

v-shukore commented Dec 31, 2025

Uh oh!

mazamizo21 commented Dec 31, 2025 via email

Uh oh!

mazamizo21 commented Dec 31, 2025

Uh oh!

v-shukore commented Jan 6, 2026

Uh oh!

mazamizo21 commented Jan 6, 2026

Root Cause

Fix Applied (commit 02582c3)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Fix Applied (commit `02582c3`)