Mxdr 3763 trend ai connectors#14667
Open
V1ManagedServices wants to merge 5 commits into
Open
Conversation
v-atulyadav
added
Solution
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a new Trend Vision One (TrendAI) Microsoft Sentinel solution based on the Codeless Connector Framework (CCF), including DCR-based ingestion, custom tables, parsers, analytic rule, and a workbook.
Changes:
- Added solution packaging artifacts (metadata, UI definition, release notes, README) for Content Hub deployment.
- Implemented two CCF REST poller connectors (Workbench Alerts, OAT Detections) with DCR transforms and custom table schemas.
- Added KQL parser functions, an analytic rule template, and a workbook dashboard.
Reviewed changes
Copilot reviewed 18 out of 22 changed files in this pull request and generated 14 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/TrendAI Vision One(CCF)/Workbooks/TrendAIVisionOneWorkbenchOverview.json | Adds a workbook to visualize Workbench alert trends and top entities. |
| Solutions/TrendAI Vision One(CCF)/SolutionMetadata.json | Adds solution metadata required for publishing/support info. |
| Solutions/TrendAI Vision One(CCF)/ReleaseNotes.md | Adds initial release notes entry for the new solution. |
| Solutions/TrendAI Vision One(CCF)/README.md | Adds end-user documentation for installation, configuration, and queries. |
| Solutions/TrendAI Vision One(CCF)/Parsers/TrendAIWorkbench_Complete.yaml | Adds a parser to normalize/union legacy + CCF Workbench data. |
| Solutions/TrendAI Vision One(CCF)/Parsers/TrendAIOAT_Complete.yaml | Adds a parser to union legacy + CCF OAT data. |
| Solutions/TrendAI Vision One(CCF)/Package/testParameters.json | Adds ARM test parameter definitions for solution packaging/validation. |
| Solutions/TrendAI Vision One(CCF)/Package/createUiDefinition.json | Adds the deployment UI definition for Content Hub installation. |
| Solutions/TrendAI Vision One(CCF)/Data/Solution_TrendAIVisionOne.json | Registers solution components (connectors, parsers, workbook, rule). |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneWorkbench_ccp/TrendAIVisionOneWorkbench_table.json | Adds custom table schema for Workbench ingestion. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneWorkbench_ccp/TrendAIVisionOneWorkbench_PollerConfig.json | Adds the REST poller configuration for Workbench connector. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneWorkbench_ccp/TrendAIVisionOneWorkbench_DCR.json | Adds DCR stream + transform for Workbench ingestion-time mapping. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneWorkbench_ccp/TrendAIVisionOneWorkbench_ConnectorDefinition.json | Adds the connector definition + UI for Workbench connector. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneOAT_ccp/TrendAIVisionOneOAT_table.json | Adds custom table schema for OAT ingestion. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneOAT_ccp/TrendAIVisionOneOAT_PollerConfig.json | Adds the REST poller configuration for OAT connector. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneOAT_ccp/TrendAIVisionOneOAT_DCR.json | Adds DCR stream + transform for OAT ingestion-time mapping. |
| Solutions/TrendAI Vision One(CCF)/Data Connectors/TrendAIVisionOneOAT_ccp/TrendAIVisionOneOAT_ConnectorDefinition.json | Adds the connector definition + UI for OAT connector. |
| Solutions/TrendAI Vision One(CCF)/Analytic Rules/TrendAIVisionOneWorkbenchIncident.yaml | Adds an analytic rule template to create incidents from Workbench alerts. |
- Fix unbalanced ARM template brackets [[...]] in PollerConfig and DCR files - Fix testParameters.json defaultValue: null with valid default string - Remove alertRuleTemplateName: null from analytic rule - Optimize workbook KQL queries by moving time filter before summarize
-Added default value for filters in OAT connector. -Added connector page text with data loss notice.
Contributor
|
Hi @V1ManagedServices, please resolve validation failures. Thanks! |
- Fix ARM-TTK errors: apiVersion, empty values, null fields - Add connector IDs to ValidConnectorIds.json - Add custom table schemas for KQL validation - Update 3.1.1.zip package
Contributor
Author
|
Hello @v-shukore, Updated the PR, Kindly do the needful. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Added a new Trend Vision One Microsoft Sentinel data connector based on the Common Connector Framework (CCF).
Added ARM templates and deployment artifacts required for connector deployment.
Added DCR-based ingestion configuration and transformation logic for Workbench data ingestion.
Added custom table schema and supporting resources required for data collection.
Added parser/query support to transform ingested Workbench data into the expected Sentinel schema.
Reason for Change(s):
Introduce a CCF-based implementation of the Trend Vision One connector aligned with Microsoft's modern ingestion architecture.
Reduce dependency on the legacy Azure Function-based connector model.
Enable DCR-based ingestion-time transformations and simplify deployment for Microsoft Sentinel customers.
Provide a foundation for future enhancements while maintaining compatibility with existing Trend Vision One data consumption scenarios.
Version Updated:
N/A
Testing Completed:
Yes
Successfully deployed the ARM template in a Microsoft Sentinel test environment.
Verified connector deployment and data ingestion from Trend Vision One APIs.
Verified records are written to the target Log Analytics table.
Verified transformation/query logic produces the expected output schema.
Checked that the validations are passing and have addressed any issues that are present:
Yes