Add Claroty xDome CCF solution (initial submission v3.0.0) - #14911
Open
0ccupi3R wants to merge 1 commit into
Open
Add Claroty xDome CCF solution (initial submission v3.0.0)#149110ccupi3R wants to merge 1 commit into
0ccupi3R wants to merge 1 commit into
Conversation
…pared for Azure Sentinel
v-atulyadav
added
the
New Solution
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds the initial Microsoft Sentinel solution package for Claroty xDome CCF (v3.0.0), including a CCF pull-based connector, tables, parsers, workbook, analytics, hunting, and sample data.
Changes:
- Introduces CCF connector definition + polling configuration, plus 7 Log Analytics table resources.
- Adds ASIM/VIM parsers, workbook, analytics rules, hunting queries, and solution packaging metadata/docs.
- Provides sample data and release notes for initial submission.
Reviewed changes
Copilot reviewed 45 out of 46 changed files in this pull request and generated 15 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/Claroty xDome CCF/Workbooks/ClarotyXDome.json | Adds the solution workbook (tabs + KQL tiles/charts). |
| Solutions/Claroty xDome CCF/SolutionMetadata.json | Adds solution marketplace metadata (publisher/offer/support). |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeVulnerability_CL.json | Adds sample vulnerability payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeOTEvent_CL.json | Adds sample OT activity event payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeDevice_CL.json | Adds sample device inventory payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeDeviceVulnerability_CL.json | Adds sample device-vulnerability relation payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeDeviceAlert_CL.json | Adds sample device-alert relation payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeAuditLog_CL.json | Adds sample audit log payloads. |
| Solutions/Claroty xDome CCF/Sample Data/ClarotyXDomeAlert_CL.json | Adds sample alert payloads. |
| Solutions/Claroty xDome CCF/ReleaseNotes.md | Adds initial release notes entry for v3.0.0. |
| Solutions/Claroty xDome CCF/README.md | Adds solution README with deployment link and validation queries. |
| Solutions/Claroty xDome CCF/Parsers/vimNetworkSessionClarotyXDome.yaml | Adds ASIM NetworkSession filtering parser (vim). |
| Solutions/Claroty xDome CCF/Parsers/vimAuditEventClarotyXDome.yaml | Adds ASIM AuditEvent filtering parser (vim). |
| Solutions/Claroty xDome CCF/Parsers/vimAlertEventClarotyXDome.yaml | Adds ASIM AlertEvent filtering parser (vim). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/Im_NetworkSessionCustom.json | Adds custom unifying parser ARM template (Im_*). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/Im_AuditEventCustom.json | Adds custom unifying parser ARM template (Im_*). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/Im_AlertEventCustom.json | Adds custom unifying parser ARM template (Im_*). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/ASim_NetworkSessionCustom.json | Adds custom unifying parser ARM template (ASim_*). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/ASim_AuditEventCustom.json | Adds custom unifying parser ARM template (ASim_*). |
| Solutions/Claroty xDome CCF/Parsers/CustomUnifyingParsers/ASim_AlertEventCustom.json | Adds custom unifying parser ARM template (ASim_*). |
| Solutions/Claroty xDome CCF/Parsers/ClarotyXDomeVulnerability.yaml | Adds solution-specific parser function for vulnerabilities. |
| Solutions/Claroty xDome CCF/Parsers/ClarotyXDomeDeviceVulnerability.yaml | Adds solution-specific parser function for device-vulnerability relations. |
| Solutions/Claroty xDome CCF/Parsers/ClarotyXDomeDevice.yaml | Adds solution-specific parser function for device inventory. |
| Solutions/Claroty xDome CCF/Parsers/ClarotyXDomeAlert.yaml | Adds solution-specific parser function for alerts. |
| Solutions/Claroty xDome CCF/Parsers/ASimNetworkSessionClarotyXDome.yaml | Adds ASIM NetworkSession normalization parser (ASim*). |
| Solutions/Claroty xDome CCF/Parsers/ASimAuditEventClarotyXDome.yaml | Adds ASIM AuditEvent normalization parser (ASim*). |
| Solutions/Claroty xDome CCF/Parsers/ASimAlertEventClarotyXDome.yaml | Adds ASIM AlertEvent normalization parser (ASim*). |
| Solutions/Claroty xDome CCF/Package/testParameters.json | Adds deployment test parameters artifact. |
| Solutions/Claroty xDome CCF/Package/createUiDefinition.json | Adds Azure Marketplace-style createUiDefinition wizard for deployment. |
| Solutions/Claroty xDome CCF/Hunting Queries/ClarotyXDomeOtConfigChanges.yaml | Adds hunting query for OT configuration/mode changes. |
| Solutions/Claroty xDome CCF/Hunting Queries/ClarotyXDomeInternetExposedOtDevices.yaml | Adds hunting query for internet-exposed OT/IoT devices. |
| Solutions/Claroty xDome CCF/Hunting Queries/ClarotyXDomeInsecureProtocols.yaml | Adds hunting query for insecure protocol usage. |
| Solutions/Claroty xDome CCF/Data/Solution_ClarotyXDomeCCF.json | Adds solution package manifest listing assets and version. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeVulnerability_CL.json | Adds custom table resource for vulnerabilities. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeOTEvent_CL.json | Adds custom table resource for OT activity events. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeDevice_CL.json | Adds custom table resource for device inventory. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeDeviceVulnerability_CL.json | Adds custom table resource for device-vulnerability relations. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeDeviceAlert_CL.json | Adds custom table resource for device-alert relations. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeAuditLog_CL.json | Adds custom table resource for audit log. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeAlert_CL.json | Adds custom table resource for alerts. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/ClarotyXDomeCCF_PollingConfig.json | Adds CCF poller resources for all data types. |
| Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/ClarotyXDomeCCF_ConnectorDefinition.json | Adds the connector definition UI/behavior metadata. |
| Solutions/Claroty xDome CCF/Analytic Rules/ClarotyXDomeKevOnOtDevice.yaml | Adds scheduled rule for KEV on OT devices. |
| Solutions/Claroty xDome CCF/Analytic Rules/ClarotyXDomeHighSeverityAlert.yaml | Adds scheduled rule for high/critical severity device alerts. |
Suppressed comments (1)
Solutions/Claroty xDome CCF/Data Connectors/ClarotyXDomeCCF_ccf/table_ClarotyXDomeAlert_CL.json:119
- The Alerts table schema uses
ID,UpdatedTime, andCategory, while the ClarotyXDomeAlert parser/workbook content referencesAlertId,AlertUpdated, andAlertCategory. This mismatch will break the workbook tiles/visualizations and parser function results. Standardize the schema vs. parser naming (either update the table columns to the parser names, or update all downstream KQL to the table names).
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+4
to
+5
| "apiVersion": "2024-09-01", | ||
| "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/ClarotyXDomeAlert', uniqueString(parameters('friendlyName')))]", |
| "dataType": "ClarotyXDomeAlert_CL", | ||
| "auth": { | ||
| "type": "APIKey", | ||
| "ApiKey": "[[parameters('apiKey')]", |
| "ApiKeyIdentifier": "Bearer" | ||
| }, | ||
| "request": { | ||
| "apiEndpoint": "[[concat(parameters('apiRootUrl'), '/api/v1/alerts/')]", |
| "dataType": "Alerts" | ||
| } | ||
| }, | ||
| "condition": "[[contains(parameters('selectedDataTypes'), 'ClarotyXDomeAlert_CL')]" |
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "UID", |
Comment on lines
+1
to
+3
| | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ||
| |-------------|--------------------------------|--------------------| | ||
| | 3.0.0 | 13-08-2026 | Initial submission of the Claroty xDome CCF solution, including connector definition, DCR and polling configuration, seven destination tables, parsers, workbook, analytic rules, hunting queries, sample data, and package artifacts for deployment. | |
Comment on lines
+2
to
+36
| "location": { | ||
| "type": "string", | ||
| "minLength": 1, | ||
| "defaultValue": "[resourceGroup().location]", | ||
| "metadata": { | ||
| "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" | ||
| } | ||
| }, | ||
| "workspace-location": { | ||
| "type": "string", | ||
| "defaultValue": "", | ||
| "metadata": { | ||
| "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" | ||
| } | ||
| }, | ||
| "workspace": { | ||
| "defaultValue": "", | ||
| "type": "string", | ||
| "metadata": { | ||
| "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" | ||
| } | ||
| }, | ||
| "resourceGroupName": { | ||
| "type": "string", | ||
| "defaultValue": "[resourceGroup().name]", | ||
| "metadata": { | ||
| "description": "resource group name where Microsoft Sentinel is setup" | ||
| } | ||
| }, | ||
| "subscription": { | ||
| "type": "string", | ||
| "defaultValue": "[last(split(subscription().id, '/'))]", | ||
| "metadata": { | ||
| "description": "subscription id where Microsoft Sentinel is setup" | ||
| } |
| ActorUsername = Username, | ||
| ActorUsernameType = 'Simple', | ||
| ActorDisplayName = UserDisplayName, | ||
| SrcIpAddr = '', |
Comment on lines
+107
to
+110
| IpAddr = SrcIpAddr | ||
| | where (eventresult == '*' or EventResult =~ eventresult) | ||
| and (array_length(eventtype_in) == 0 or EventType in~ (eventtype_in)) | ||
| and (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix)) |
Comment on lines
+39
to
+42
| - entityType: Host | ||
| fieldMappings: | ||
| - identifier: HostName | ||
| columnName: DeviceUid |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
What is included
Non-impact statement
Deployment
Versioning
Validation
Checklist