New solution: ContraForce (ContraForce Events data connector + analytic rules) - #14890
New solution: ContraForce (ContraForce Events data connector + analytic rules)#14890DanielMLCF wants to merge 3 commits into
Conversation
…nalytic rules), v3.0.0
|
@microsoft-github-policy-service agree company="ContraForce" |
1 similar comment
|
@microsoft-github-policy-service agree company="ContraForce" |
v-atulyadav
added
Codeless Connector Framework (CCF) Connector
New Solution
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds the new ContraForce Microsoft Sentinel solution package, including a CCF (RestApiPoller) data connector to ingest ContraForce events and three scheduled analytic rule templates for out-of-the-box detections.
Changes:
- Added solution metadata + release notes for ContraForce solution v3.0.0.
- Added generated solution package artifacts (ARM
mainTemplate.json,createUiDefinition.json,testParameters.json). - Added connector assets (DCR, custom table, polling config, connector definition) and 3 analytic rule YAML templates.
Reviewed changes
Copilot reviewed 13 out of 15 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/ContraForce/SolutionMetadata.json | Adds Marketplace/solution metadata (publisher/offer, categories, support). |
| Solutions/ContraForce/ReleaseNotes.md | Adds initial release notes entry for v3.0.0. |
| Solutions/ContraForce/Package/testParameters.json | Adds deployment test parameters used by the generated package. |
| Solutions/ContraForce/Package/mainTemplate.json | Adds the generated ARM solution package containing the connector + analytic rule templates. |
| Solutions/ContraForce/Package/createUiDefinition.json | Adds the installation UI definition for selecting workspace and describing solution content. |
| Solutions/ContraForce/Data/Solution_ContraForce.json | Adds solution manifest listing included connector + analytic rules. |
| Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_tables.json | Defines the custom table schema for ContraForce events. |
| Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_PollingConfig.json | Defines the RestApiPoller configuration for ingesting events. |
| Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_DataConnectorDefinition.json | Defines the connector UI + permissions + instructions. |
| Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_DCR.json | Defines the DCR stream + transform mapping into the custom table. |
| Solutions/ContraForce/Analytic Rules/ContraForcePrivilegedAccessChange.yaml | Adds scheduled analytic rule template for privileged access changes. |
| Solutions/ContraForce/Analytic Rules/ContraForceMachineCredentialActivity.yaml | Adds scheduled analytic rule template for machine credential lifecycle activity. |
| Solutions/ContraForce/Analytic Rules/ContraForceDestructiveWorkspaceAction.yaml | Adds scheduled analytic rule template for destructive workspace actions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ||
| |-------------|--------------------------------|-----------------------------------------------------------------| | ||
| | 3.0.0 | 07-08-2026 | Initial solution release: ContraForce Events CCF data connector and three **Analytic rules** (privileged access change, machine credential activity, destructive workspace action). | |
There was a problem hiding this comment.
On the ReleaseNotes table: the rows begin with a single |; we've verified the table renders correctly on GitHub.
| "Analytic Rules/ContraForceMachineCredentialActivity.yaml", | ||
| "Analytic Rules/ContraForceDestructiveWorkspaceAction.yaml" | ||
| ], | ||
| "BasePath": "C:\\repos\\Azure-Sentinel\\Solutions\\ContraForce", |
| "guidValue": { | ||
| "defaultValue": "[[newGuid()]", | ||
| "type": "securestring" | ||
| }, |
| } | ||
| }, | ||
| { | ||
| "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ContraForceEvents', parameters('guidValue'))]", |
| "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", | ||
| "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" | ||
| }, | ||
| "auth": { | ||
| "type": "Basic", | ||
| "userName": "[[parameters('clientId')]", | ||
| "password": "[[parameters('clientSecret')]" | ||
| }, | ||
| "request": { | ||
| "apiEndpoint": "[[concat(parameters('apiBaseUrl'),'/api/v2/workspaces/',parameters('cfWorkspaceId'),'/export/audit')]", |
| "mainTemplate": { | ||
| "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", | ||
| "contentVersion": "[variables('dataConnectorCCPVersion')]", | ||
| "parameters": { |
| "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ContraForceEvents', parameters('guidValue'))]", | ||
| "apiVersion": "2023-02-01-preview", | ||
| "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", | ||
| "location": "[parameters('workspace-location')]", |
| "apiVersion": "2022-06-01", | ||
| "type": "Microsoft.Insights/dataCollectionRules", | ||
| "location": "[parameters('workspace-location')]", | ||
| "kind": "[variables('blanks')]", |
| "requiredPermissions": { | ||
| "read": true, | ||
| "write": true, | ||
| "delete": true | ||
| } |
| - T1098 | ||
| query: | | ||
| ContraForceEvents_CL | ||
| | where ingestion_time() > ago(5m) |
There was a problem hiding this comment.
On the ingestion_time() filter in the analytic rules: this follows the documented guidance for handling ingestion delay in scheduled analytics rules (https://learn.microsoft.com/azure/sentinel/ingestion-delay). The connector delivers events several minutes after their TimeGenerated, so filtering on ingestion time with a wider queryPeriod lookback is what guarantees late-arriving events are not missed; during pre-submission validation we confirmed that a plain TimeGenerated window missed events for exactly this reason, while the current pattern alerted exactly once per event (incident-level dedup via EventId custom-detail grouping).
…ble schema and ContraForceEvents connector id
… and conventional BasePath; package regenerated with the V3 tool
|
Thanks for the review. We've addressed the feedback as follows: Accepted and fixed in the latest commit:
On the |
Required items, please complete
Change(s):
Solutions/ContraForce(v3.0.0): the ContraForce Events CCF data connector (Customizabledefinition,RestApiPollerpolling config, DCR, custom tableContraForceEvents_CL) and three scheduled analytic rules: ContraForce - Privileged access change, ContraForce - Machine credential activity, ContraForce - Destructive workspace action.Logos/contraforce.svg.Reason for Change(s):
contraforce1580881495588): ingest ContraForce security service delivery events (incident detections, administrative access changes, machine credential activity, destructive workspace actions) into customers' Microsoft Sentinel with out-of-the-box detections.Version Updated:
Testing Completed:
Package/mainTemplate.jsonwas deployed to a Microsoft Sentinel environment with no custom parsers, functions, or tables; the connector was connected through the connector page UI (the Connect flow created the DCE, DCR, table, and poller connection); live data was ingested by the CCF poller; and each analytic rule was instantiated from its template and produced incidents from real triggering events end to end. No custom parsers or functions are required by this solution.Checked that the validations are passing and have addressed any issues that are present:
IDs Should Be Derived From ResourceIDs, matches published solutions' packages, e.g. 1Password). The analytic rules query only the solution's own table with built-in KQL operators.