Dragos 3.1.2 release by dragosinc-sentinel · Pull Request #14138 · Azure/Azure-Sentinel

dragosinc-sentinel · 2026-04-27T00:44:55Z

Change(s):

Updating Dragos Sentinel solution for next release

Reason for Change(s):

Minor query fixes
Support pulling from multiple Dragos sitestores

Version updated:

Yes
Detections/Analytic Rule templates are required to have the version updated

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Dragos Sentinel solution for the 3.1.2 release, focusing on parser/query adjustments to better support multiple Dragos Cloud Sitestores and incident enrichment.

Changes:

Updated solution and content versions to 3.1.2 / 1.1.x across solution artifacts.
Enhanced parsers to populate separate Source/Destination IP address fields for incidents.
Updated release notes to document the 3.1.2 changes.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Solutions/Dragos/ReleaseNotes.md	Adds 3.1.2 entry to document the release.
Solutions/Dragos/Parsers/DragosPushNotificationsToSentinel.yaml	Updates parser version and enriches output with separate source/destination IP arrays.
Solutions/Dragos/Parsers/DragosPullNotificationsToSentinel.yaml	Updates parser version and separates IPs by directionality (source/destination/uncategorized).
Solutions/Dragos/Parsers/DragosNotificationsToSentinel.yaml	Updates wrapper parser version and de-dupes by keeping latest per id.
Solutions/Dragos/Package/mainTemplate.json	Skipped (ignored path per repo instructions).
Solutions/Dragos/Package/createUiDefinition.json	Skipped (ignored path per repo instructions).
Solutions/Dragos/Data/Solution_Dragos.json	Bumps solution version to 3.1.2.
Solutions/Dragos/Data Connectors/DragosSiteStore_CCP/dragosSitestoreDataConnectorDefinition.json	Skipped (ignored path per repo instructions).
Solutions/Dragos/Data Connectors/DragosSiteStore_CCP/dcr.json	Skipped (ignored path per repo instructions).
Solutions/Dragos/Data Connectors/DragosSiteStore_CCP/dataPoller.json	Skipped (ignored path per repo instructions).
Solutions/Dragos/Analytic Rules/DragosNotifiction.yaml	Adds SourceIP/DestinationIP custom details and bumps rule version.

v-maheshbh · 2026-04-27T06:25:56Z

Hi @dragosinc-sentinel

Please review the comments above.
Thanks!

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dragosinc-sentinel · 2026-04-30T01:25:26Z

Ack. I think the automatic PR comments have been resolved. Waiting on the PR checks to complete.

dragosinc-sentinel · 2026-05-01T19:41:14Z

@v-maheshbh @v-shukore could I please get some help with the failing PR validation checks. From what I can tell there aren't issues directly related to my changes:

The ARM-ttk Validations check is failing various ARM validation checks, but I didn't write that file by hand. I used Azure Sentinel's own build script https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Create-Azure-Sentinel-Solution/V3 to create it. If there are any ARM validation errors, it seems like the build script should be fixed and not my build artifact
The Detection Validations check is failing, but the error appears to be related to some git checkout error. Its not clear to me how this is related to my code chage.
The KQL Validations check is failing, but the query is valid KQL syntax. It appears to be a problem with the validator and not my query itself.

v-maheshbh · 2026-05-05T08:23:19Z

Hi @dragosinc-sentinel

The current Content Hub version is 3.0.0; please update the next package version to 3.0.1 for minor changes or 3.1.0 for significant updates.

Review the KQL function/query blocks in both YAMLs and update the expressions around the reported lines so they return scalars.

The failure is most likely caused by an ID change validation issue on the modified parser:
If this PR modified an existing rule, restore the original id value in DragosNotifiction.yaml instead of introducing a new GUID.

Thanks!

…support

dragosinc-sentinel · 2026-05-07T23:41:48Z

@v-maheshbh I think I've addressed everything except for the KQL validations. That change is more complicated as we must re-test and validate the app prior to pushing an update. I'd like to verify we have all other issues resolved before committing time to testing KQL changes

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 9 comments.

 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                             |
 |-------------|--------------------------------|------------------------------------------------|
-| 3.0.0       | 10-01-2025                     | Initial solution release.                      |
+| 3.1.0       | 05-01-2025                     | Support for pulling data from multiple Dragos Cloud Sitestores. Adding additional IP Address Source and Dest fields to Sentinel Incidents, instead of a single IP Address field. |


            "connectorDefinitionName": {
-              "defaultValue": " Dragos Notifications via Cloud Sitestore",
-              "type": "string",
+              "defaultValue": "Dragos Notifications via Cloud Sitestore",
+              "type": "securestring",
              "minLength": 1
            },
            "workspace": {
              "defaultValue": "[parameters('workspace')]",
-              "type": "string"
+              "type": "securestring"
            },


-              "minLength": 4
+            "guidValue": {
+              "defaultValue": "[[newGuid()]",
+              "type": "securestring"


  // Format IP addresses into the proper Sentinel Entity format
  let IpAddresses = CommonSecurityLog
-  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform' and DeviceVersion == '2'
+  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform'


  // Format Hosts into the proper Sentinel format
  let Hosts = CommonSecurityLog
-  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform' and DeviceVersion == '2'
+  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform'


  | summarize SentinelHosts = make_list(SentinelHost, 250), Hosts = make_list(Host, 250) by ExtID;
  CommonSecurityLog
-  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform' and DeviceVersion == '2'
+  | where DeviceVendor == 'Dragos' and DeviceProduct == 'Platform'


            },
            {
-              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'dataPoller')]",
+              "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'dragosDataPoller', parameters('guidValue'))]",


  Title: Dragos Pull Notifications Sentinel Incidents
-  Version: '1.0.0'
+  Version: '1.1.1'
  LastUpdated: '2024-08-25'


+                "Hostname": "[[parameters('dragosSitestoreHostname')]",
+                "MinSeverity": "[[parameters('minSeverity')]",
+                "MaxSeverity": "[[parameters('maxSeverity')]"
+            },


v-maheshbh · 2026-05-14T08:06:26Z

Hi @dragosinc-sentinel

Kindly address the required review comments if required.

Thanks!

Dragos 3.1.2 release

fce21d8

dragosinc-sentinel requested review from a team as code owners April 27, 2026 00:44

v-shukore assigned v-maheshbh Apr 27, 2026

v-shukore added the Solution Solution specialty review needed label Apr 27, 2026

v-maheshbh requested a review from Copilot April 27, 2026 06:18

Copilot AI reviewed Apr 27, 2026

View reviewed changes

Comment thread Solutions/Dragos/ReleaseNotes.md Outdated

Comment thread Solutions/Dragos/Parsers/DragosNotificationsToSentinel.yaml

Comment thread Solutions/Dragos/Data/Solution_Dragos.json

Comment thread Solutions/Dragos/Parsers/DragosPushNotificationsToSentinel.yaml Outdated

Apply suggestions from code review

673b8c1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dragosinc-sentinel added 2 commits May 7, 2026 19:00

Reverting inadvertent id change as reccomended by Microsoft Sentinel …

27e36f9

…support

Fixing version to match Microsoft support reccomendations

a455cc4

v-maheshbh requested a review from Copilot May 14, 2026 08:02

Copilot AI reviewed May 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dragos 3.1.2 release#14138

Dragos 3.1.2 release#14138
dragosinc-sentinel wants to merge 4 commits into
Azure:masterfrom
dragosinc-sentinel:master

dragosinc-sentinel commented Apr 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

v-maheshbh commented Apr 27, 2026

Uh oh!

dragosinc-sentinel commented Apr 30, 2026

Uh oh!

dragosinc-sentinel commented May 1, 2026

Uh oh!

v-maheshbh commented May 5, 2026 •

edited

Loading

Uh oh!

dragosinc-sentinel commented May 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

v-maheshbh commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

dragosinc-sentinel commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

v-maheshbh commented Apr 27, 2026

Uh oh!

dragosinc-sentinel commented Apr 30, 2026

Uh oh!

dragosinc-sentinel commented May 1, 2026

Uh oh!

v-maheshbh commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dragosinc-sentinel commented May 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

v-maheshbh commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dragosinc-sentinel commented Apr 27, 2026 •

edited

Loading

v-maheshbh commented May 5, 2026 •

edited

Loading