Notebook fixes #3

2802

…IntelImprovements

Minor fixes for nullable fields from Guardicore ThreatIntel feed

Update

Update AlsidForAD.json

Armorblox Sentinel Solution Azure Function changes

Initial Commit with the first version

…47385-cs-47271

Bumps version. Updates code & solution zip file.

Tanium typo fixes and playbook readmes

Merging upstream into master

XDR-1172: Set up Upstream Sync for Azure-Sentinel using CI with Azure Pipelines (feat)

Merge master back to fork repo

Add files via upload

changes

…dpointconnector-ccp

Adding tables to .script/tests/KqlvalidationsTests/CustomTables

Pull changes from Azure Main Repo

Corrected validations and re-packaged the solution.

…zureCredential

[MXDR-3374] fix default azure credential

Co-authored-by: jlheard <1328792+jlheard@users.noreply.github.com>

Co-authored-by: anthonylamark <3209818+anthonylamark@users.noreply.github.com>

Co-authored-by: v-maheshbh <207855009+v-maheshbh@users.noreply.github.com>

)"

This reverts commit 803d26e.

* recompile using v3 tool

* recompile using v3 tool

* self review

* follow up from claude on depends for contentPackages

* revert

* cleanup

* minimize diff

Fixes two deploy-time bugs in v3.1.0 (PR Azure#13524).

Bug Azure#1 — Paging:
Switched pagingType from "NextPageUrl" to "Offset", matching the IONIX
API's standard DRF LimitOffsetPagination shape. The old config failed
CCF connectivity validation with "Missing NextPageParaName from config"
(RES40002) for every customer on 3.1.0.

Bug Azure#3 — Table declaration:
The original v3.1.1 attempt removed IONIX_Table.json on the theory that
Log Analytics would auto-create the custom table on first DCR write.
That's not how it works — Sentinel's DCR validator requires the custom
output table to already exist, and Connect failed with:

  InvalidOutputTable: Table for output stream
  'Custom-CyberpionActionItems_CL' is not available for destination
  'IONIX-Destination'.

Restored IONIX_Table.json with the 12-column declaration (same shape as
v3.1.0) so the table is created when the solution is installed via
Content Hub (which auto-executes the contentTemplates nested mainTemplate).
This matches the pattern used by every other CCF solution in the catalog
(Auth0, Cloudflare CCF, SAP BTP, CyrenThreatIntelligence — all have the
table declared inside the contentTemplates wrapper, none at top level).

Package regenerated via Tools/Create-Azure-Sentinel-Solution/V3
(createSolutionV3.ps1) — mainTemplate.json + 3.1.1.zip are canonical
V3-tool output.

Verified end-to-end on a fresh Sentinel workspace:
- Solution installs via Content Hub
- CyberpionActionItems_CL table created
- CCF connector connects (green), no RES40002
- First poll ingested 64 deduped action items via Offset paging
- Workbook + analytics rule template both render

Note: customers migrating from the deprecated push connector who already
have a populated CyberpionActionItems_CL table with the legacy 15-18
column set will still hit "Invalid output table schema" on this version
(same behavior as v3.1.0). Migration handling is tracked separately for
v3.1.2 — recommended approach is a new table name for the CCF connector
with a union shim during the transition period.

…zure#3, Azure#4)

Azure#2 — Renamed Whisper - BGP Anomaly Hunt → Whisper - ASN Reputation Score Hunt
to match the query's actual logic (compares ASN reputation scores across
24-hour windows, flags increases >20 points). Filename kept stable.

Azure#3 — Standardized the playbook parameter naming across all 10 playbooks
from `playbook-name` (kebab) to `PlaybookName` (PascalCase) per the
Azure-Sentinel repo convention. Updated both the parameter declaration
and every `parameters('playbook-name')` reference.

Azure#4 — Moved the Whisper Security custom API connector ARM template into
its own folder per repo convention:
  Solutions/Whisper/Playbooks/WhisperSecurityConnector.json
    → Solutions/Whisper/Playbooks/WhisperSecurityConnector/azuredeploy.json

Package regenerated to 3.0.29 via Create-Azure-Sentinel-Solution V3.

Azure#1 (parse_json on comma-separated strings) — replied on the thread
explaining deferral until we have live data to verify the actual
ingestion-pipeline output format; not changing code in this round.

Signed-off-by: Elakkuvan Rajamani <elakkuvan@whisper.security>