Add Prancer PenSuiteAI Integration solution - #14893
Open
Farshid Mahdavi (farchide) wants to merge 4 commits into
Open
Add Prancer PenSuiteAI Integration solution#14893Farshid Mahdavi (farchide) wants to merge 4 commits into
Farshid Mahdavi (farchide) wants to merge 4 commits into
Conversation
Author
|
@microsoft-github-policy-service agree company="Prancer Enterprise" |
Author
|
@microsoft-github-policy-service agree company="Prancer" |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a new Microsoft Sentinel solution package for Prancer PenSuiteAI Integration, expanding the Prancer findings pipeline with enrichment content and operational health monitoring.
Changes:
- Introduces a new watchlist (“Prancer Crown Jewel Assets”) and an analytic rule to escalate findings matching declared crown jewels.
- Adds multiple new playbook templates (enrichment, ticketing, executive digest, app-owner notification, Teams approval-gated notification).
- Adds a parser (
PrancerFindings) plus an optional Connectivity Health-Check Azure Function and updates the data connector to the Logs Ingestion API / DCR model.
Reviewed changes
Copilot reviewed 54 out of 58 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/Prancer PenSuiteAI Integration/Watchlists/CrownJewelAssets.json | Adds ARM template for the “Prancer Crown Jewel Assets” watchlist and sample CSV content. |
| Solutions/Prancer PenSuiteAI Integration/ReleaseNotes.md | Adds 4.0.0–4.2.0 release history entries covering modernization + watchlist + health check. |
| Solutions/Prancer PenSuiteAI Integration/README.md | Adds solution README content (currently written as an internal “draft rewrite”). |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Teams-Approval-Gated-Notification/readme.md | Documents Teams approval-gated playbook behavior and deployment steps. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Teams-Approval-Gated-Notification/azuredeploy.json | Adds ARM template for Teams approval-gated notification Logic App. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Scheduled-Executive-Digest/readme.md | Documents scheduled executive digest playbook and prerequisites. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Scheduled-Executive-Digest/azuredeploy.json | Adds ARM template for weekly digest Logic App querying Log Analytics API. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/RiskScore-Confidence-Thresholded-Ticketing/readme.md | Documents ticketing playbook gating on RiskScore+Confidence. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/RiskScore-Confidence-Thresholded-Ticketing/azuredeploy.json | Adds ARM template for generic HTTP ticket filing and incident comment. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Kill-Chain-Context-Enrichment/readme.md | Documents enrichment-only playbook querying PrancerFindings(). |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/Kill-Chain-Context-Enrichment/azuredeploy.json | Adds ARM template for kill-chain context enrichment Logic App. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/App-Owner-Notification/readme.md | Documents app-owner lookup + notification playbook. |
| Solutions/Prancer PenSuiteAI Integration/Playbooks/App-Owner-Notification/azuredeploy.json | Adds ARM template for owner lookup HTTP call + email + Sentinel comment. |
| Solutions/Prancer PenSuiteAI Integration/Parsers/PrancerFindings.yaml | Adds parser function deriving normalized columns and data-quality flags. |
| Solutions/Prancer PenSuiteAI Integration/Package/testParameters.json | Updates test parameters to include watchlist id parameter. |
| Solutions/Prancer PenSuiteAI Integration/Package/createUiDefinition.json | Updates solution UI definition (counts, links, adds Watchlists + Playbooks blades). |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/RiskScore_Confidence_Divergence_Triage_query.yaml | Adds hunting query for SwarmHack RiskScore/Confidence divergence. |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/PAC_high_severity_query.yaml | Modernizes PAC hunting query to use PrancerFindings and updated schema. |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/Multi_Scanner_MITRE_Corroboration_query.yaml | Adds hunting query correlating MitreIds across scan types. |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/KillChain_MITRE_Decomposition_query.yaml | Adds hunting query decomposing kill-chain stages. |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/Finding_Persistence_Tracker_query.yaml | Adds hunting query for recurring findings across scan cycles. |
| Solutions/Prancer PenSuiteAI Integration/Hunting Queries/CSPM_query.yaml | Modernizes CSPM hunting query to use PrancerFindings snapshots. |
| Solutions/Prancer PenSuiteAI Integration/Data/Solutions_PrancerLogIntegration.json | Updates solution manifest: name, version 4.2.0, adds parsers/playbooks/watchlists. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerLogData.json | Updates data connector to DCR/Logs Ingestion API model and table name. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/run.py | Adds timer-trigger function code for ingestion staleness monitoring + webhook. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/requirements.txt | Adds Python function dependencies. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/readme.md | Adds deployment + rationale documentation for health check function. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/host.json | Adds Azure Functions host configuration. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/function.json | Adds timer trigger binding schedule configuration. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/dcr-connectivity-health-transform.md | Documents health table schema and minimal DCR/DCE requirements. |
| Solutions/Prancer PenSuiteAI Integration/Data Connectors/PrancerConnectivityHealthCheck/azuredeploy.json | Adds ARM template provisioning Function App infra + app settings. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Watchlist_CrownJewel_Match_Escalation.yaml | Adds crown-jewel watchlist match escalation analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/SwarmHack_HighConfidence_Critical.yaml | Adds SwarmHack high-confidence critical suppression/selection rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/SCA_Critical_Unpatched_And_Blast_Radius.yaml | Adds combined SCA analytic rule for unpatched critical + blast radius. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/SAST_Dangerous_CWE_Confirmed.yaml | Adds SAST analytic rule for dangerous CWE allowlist with evidence. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/KillChain_Traverses_Known_Misconfig.yaml | Adds kill-chain traversal correlation rule with CSPM misconfig pivots. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/KillChain_MITRE_Decomposition.yaml | Adds analytic rule for deep/dangerous kill-chain decomposition. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Finding_Persistence_Tracker.yaml | Adds analytic rule for recurring Critical/High findings across scan cycles. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/DataQuality_Degradation_Meta_Alert.yaml | Adds meta-alert for spikes in data-quality issues by ScanType. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/DAST_Confirmed_Reflected_Exploitation.yaml | Adds DAST analytic rule verifying reflected payload evidence. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/CrownJewel_Severity_Escalation.yaml | Adds SwarmHack crown-jewel confidence-based severity escalation rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/CSPM_SwarmHack_Exploited_Correlation.yaml | Adds correlation rule joining CSPM misconfigs to SwarmHack exploitation. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/CSPM_High_Severity.yaml | Adds consolidated CSPM/IaC high-severity analytic rule replacing per-type rules. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml | Modernizes PAC analytic rule to use PrancerFindings and incident grouping. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Virtual_Networks_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Vaults_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/VM_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Subnets_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Storage_Accounts_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Sites_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Registries_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Network_Security_Groups_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Flow_Logs_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
| Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Disks_High_Severity.yaml | Removes legacy per-resource-type CSPM analytic rule. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Fixes for all 13 review comments from the automated Copilot PR review: - README.md: replace internal staging-note draft with a real customer-facing solution README (what it does, prerequisites, deployment, support). - Kill-Chain-Context-Enrichment playbook: the "no UniqueFindingId" branch only Composed a message but never posted it - add the missing ApiConnection call to /Incidents/Comment so the incident actually gets the skipped-enrichment note. - Watchlist_CrownJewel_Match_Escalation rule: MatchKey can be either a ResourceId or a URL depending on which field the watchlist match came from, but was always entity-mapped as an AzureResource ResourceId. Split into MatchedResourceId/MatchedUrl and map each to the correct entity type. - PrancerFindings parser: rename the SeverityRank let-function to SeverityRankFn (was shadowing the SeverityRank column it computes into, ambiguous in KQL); stop collapsing all missing-FindingId rows into one via arg_max(..., '') by FindingId - only dedupe rows that have a stable FindingId, pass missing-FindingId rows through unmodified so the DataQualityNotes/IsDataQualityIssue flags they're meant to surface aren't hidden by the summarize. - PrancerLogData connector: drop delete:true from the Workspace/DCR/DCE required-permissions blocks - the connector's own display text only ever promised read+write, delete was an unused least-privilege violation. - SwarmHack_HighConfidence_Critical rule: customDetails only exposed UniqueFindingId/Risk_Score/Confidence despite the query projecting Kill_Chain/Crown_Jewels/URL/Solution too - add them so playbooks that read those custom details (RiskScore-Confidence-Thresholded-Ticketing, Teams-Approval-Gated-Notification) actually get real data instead of silently-empty fields. - RiskScore-Confidence-Thresholded-Ticketing playbook: fix the customDetails key it reads for the resource link from Resource_Url to URL, matching what analytic rules actually set. - Watchlist file renamed CrownJewelAssets.json -> PrancerCrownJewelAssets.json: the packaging tool derives the watchlist1-id default from the filename, not the watchlistAlias field inside it, so the old filename produced a mismatched default (CrownJewelAssets vs. the real alias PrancerCrownJewelAssets that the watchlist and analytic rule actually use). Validated: regenerated Package/ via createSolutionV3.ps1, ran the same arm-ttk validation logic as the real Azure-Sentinel CI gate (.script/local-validation/run-arm-ttk.ps1) - 48/48 passing, 0 failures.
…eal coalesce type bug
Running the actual KQL validation suite (.script/tests/KqlvalidationsTests,
dotnet test) locally surfaced two things that ARM-TTK alone couldn't catch:
- PrancerFindings_CL and the PrancerFindings parser function were never
registered in the repo-wide KQL test fixtures (CustomTables/,
CustomFunctions/) - only the legacy prancer_CL table (pre-DCR-migration)
was registered, so every query referencing the current schema failed
schema resolution. Added PrancerFindings_CL.json (from the canonical
schema at prancer-infra's docs/sentinel/prancer-findings-native-table-schema.json)
and PrancerFindings.json (the parser's full output schema: passthrough
columns + derived columns).
- Once schema resolution worked, it surfaced a real bug the earlier
validation couldn't see: `AlertSolution = tostring(coalesce(Payload.alert.solution, Solution))`
coalesces a dynamic property access with a typed string column, which KQL
rejects ("the expression must have the type dynamic"). Fixed by converting
the dynamic side to string before coalescing:
`coalesce(tostring(Payload.alert.solution), Solution)`.
- Added Watchlist_CrownJewel_Match_Escalation's rule ID to
SkipValidationsTemplates.json with the same "Watchlist custom columns"
reason already used for every other watchlist-consuming rule in this repo
- the validator can't statically resolve _GetWatchlist()'s runtime schema,
a documented, known limitation (see KqlValidationTests.cs's own
`_GetWatchlist` exclusion comment), not something specific to this rule.
Verified: dotnet test now reports 45/45 passing (was 0 discoverable before -
GitHub App auth is required for the default path; used the documented fork
path via SYSTEM_PULLREQUEST_ISFORK=true + PRNUM=14893 to run it
unauthenticated against this PR's actual changed files). Re-ran
run-arm-ttk.ps1 after regenerating Package/ - still 48/48.
…end checks) CI ran Azure-Sentinel's Detection Template Schema Validation suite on the original commit and found 7 real structural violations against Sentinel's actual backend data model - a category neither ARM-TTK nor the KQL semantic validator checks. Fixed all 7, plus 2 more of the same classes that were masked (validation fails fast per-file, so fixing one error just reveals the next one in the same file): - SCA_Critical_Unpatched_And_Blast_Radius: CustomDetails key 'BlastRadiusConfigCount' (22 chars) exceeded the 20-char max - shortened to 'BlastRadiusCount'. Also had no entityMappings at all (required, 1-10) - added a URL mapping (the rule now also projects ResourceUrl). - DataQuality_Degradation_Meta_Alert: entityMappings was an empty array (Sentinel requires 1-10) - added a CloudApplication/Name mapping on ScanType, the closest honest fit for an operational telemetry rule with no natural entity. - Finding_Persistence_Tracker: queryPeriod was 30d, exceeding Sentinel's PT5M-P14D max - reduced to 14d (and the internal LookbackWindow to match, since queryPeriod caps what data the query can actually see). CustomDetails key 'PersistenceDurationDays' (23 chars) exceeded 20 - shortened to 'PersistenceDays' (also renamed in the companion hunting query for consistency). Also fixed tactics: T1592 (Gather Victim Host Information) is a Reconnaissance technique, not Discovery - found via manual MITRE cross-check before it could surface as a third masked error. - CrownJewel_Severity_Escalation & CSPM_SwarmHack_Exploited_Correlation: both used severity: Critical - Sentinel's actual Severity enum is only Informational/Low/Medium/High (confirmed via the validator's own enum definition), no Critical tier exists. Changed both to High, and reworked CrownJewel_Severity_Escalation's escalation logic/description accordingly (escalates to the real ceiling, excludes findings already at High instead of already at "Critical"). - CSPM_SwarmHack_Exploited_Correlation also had queryPeriod: 30d (masked by the severity error) - reduced to 14d, and a CustomDetails key 'CorroboratingCspmFinding' (24 chars) exceeded 20 - shortened to 'CorroboratingCspmId'. - SAST_Dangerous_CWE_Confirmed: T1600 (Weaken Encryption) has no matching tactic - it's a Defense Evasion technique and the rule's tactics list only had InitialAccess/CredentialAccess. Added DefenseEvasion (the rule genuinely covers CWE-327 crypto findings, so this is a real, not cosmetic, fix). Verified: dotnet test against detectionTemplateSchemaValidation now reports 53/53 real per-file checks passing. One remaining failure (Validate_DetectionTemplates_NoSameTemplateIdTwice) is a pre-existing, unrelated collision between two Mimecast solution files differing only in filename case (MimecastDLP_Hold.yaml vs MimecastDLP_hold.yaml) - confirmed via temporary debug instrumentation (not included in this commit) that only reproduces on case-insensitive local filesystems (macOS), not on the case-sensitive Linux CI runners this actually ships on, and has nothing to do with this PR's content. Also re-verified after these changes: run-arm-ttk.ps1 48/48, KQL semantic validation suite 45/45. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: