Hi @mazamizo21,
Please ensure that each solution includes the data connector folder and its relevant files, as well as the data file, releasenote file, solutionmetadata file, maintemplate, createui files, and a zip file with version 3.0.0. All these files are required.
You can package the solution using the V3 tool. Here is the readme file for creating a new solution: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…
Also, you can refer any solution from our repo to get understanding of folder structure.
If you have any questions, please feel free to connect with me and Mahesh on MS teams this is my email id: [email protected].
Thanks!

Hi @v-shukore,

Thank you for the feedback! We've reviewed the Azure Sentinel Solutions repository and found 20+ approved production solutions that are playbook-only without data connector folders.

Examples of Approved Playbook-Only Solutions

Pure playbook solutions (no data connectors):

• HYAS (v3.0.0) - 24 playbooks, no data connectors
• Recorded Future (v3.2.17) - 14 playbooks + 8 workbooks + 4 analytics, no data connectors
• Tanium - Playbooks + workbooks + analytics, no data connectors
• Pure Storage - Playbooks + workbooks, no data connectors
• SalemCyber, Farsight DNSDB, GoogleDirectory, Apache Log4j Vulnerability Detection, SAP, AWS Systems Manager, Group-IB, NCSC-NL NDN, Neustar IP GeoPoint, DNS Essentials, ShadowByte Aria, AWS_IAM, IronNet IronDefense, Intel471, Torq - All playbook-only, no data connectors

Our Solution Structure

TacitRed SentinelOne IOC Automation follows the same pattern:

• ✅ Playbook-only automation solution (no data ingestion)
• ✅ Consumes existing threat intelligence from Sentinel
• ✅ Prepares indicators for SentinelOne ingestion
• ✅ All V3 packaging files present:
  • mainTemplate.json, createUiDefinition.json, 3.0.0.zip
  • SolutionMetadata.json (with lastPublishDate: 2025-12-10)
  • ReleaseNotes.md, README.md

Question

Based on these 20+ approved playbook-only solutions in the repository, can you confirm that data connector folders are not required for automation-only solutions?

Our solution structure is identical to HYAS and other approved playbook-only solutions.

Thank you for your guidance!

Data443 Risk Mitigation, Inc.
[email protected]

Hi @mazamizo21, the solution now appears well-organized with the appropriate files included. I will review it and inform you if any updates are required. Thank you.

Hi @mazamizo21,

Please remove the 1.0.2 zip package from the solution.

Also, remove the packagemetadata.json and deploymentParameters.json files from the package folder. If these files are necessary, please keep them outside the package folder.

Additionally, create a folder named Image inside the Playbook folder and add all running playbook images into it.

Please also correct the format of the releasenote.md file.

Thanks!

Update: All Requested Changes Applied

Hi Microsoft Team,

Thank you for your feedback. We have addressed all the requested changes:

✅ 1. Removed 1.0.2 zip package

• Deleted Solutions/TacitRed-SentinelOne/Package/1.0.2.zip
• Only 3.0.0.zip remains in the Package folder

✅ 2. Moved packageMetadata.json and deploymentParameters.json outside Package folder

• Before: Solutions/TacitRed-SentinelOne/Package/packageMetadata.json
• After: Solutions/TacitRed-SentinelOne/packageMetadata.json
• Before: Solutions/TacitRed-SentinelOne/Package/deploymentParameters.json
• After: Solutions/TacitRed-SentinelOne/deploymentParameters.json

✅ 3. Created Images folder in Playbooks with running playbook screenshots

• Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneLight.png
• Solutions/TacitRed-SentinelOne/Playbooks/Images/TacitRedToSentinelOneDark.png

✅ 4. Fixed ReleaseNotes.md format

• Added proper # Release Notes heading
• Aligned table columns correctly

Thank you!

Data443 Risk Mitigation, Inc.

Hi @mazamizo21, could you please grant me the branch access so I can make the necessary changes and commit them. Thanks!!

Verified: This solution does not contain any broken tacitred.com or cyren.com documentation URLs. The only TacitRed references are API endpoints (app.tacitred.com) which are functional and required for the connector to work.

Hi @mazamizo21, we deployed the maintemplate in our Microsoft Sentinel workspace and checked, but the playbook isn't showing or loading, so we're unable to test it. Could you check in your workspace and share a screenshot here? Thanks!

Hi @v-shukore,

Thank you for testing the solution! I've identified and fixed the issue with the playbook not showing/loading.

Root Cause

The playbookContentId1 in the mainTemplate was set to a generic string "Playbooks" instead of a unique identifier. This prevented Content Hub from properly registering and displaying the playbook after deployment.

Fix Applied (commit 02582c3)

1. Changed playbookContentId1 from "Playbooks" → "TacitRedToSentinelOne"
2. Updated displayName from "Playbooks" → "TacitRed to SentinelOne IOC Automation"
3. Fixed dependency contentId reference to use the correct variable
4. Removed unused variables for ARM-TTK compliance

The playbook should now properly appear in Content Hub after deployment. Please redeploy and let me know if you can see and test the playbook now.

Thanks!