New solution: HoneyLabs threat intelligence (TAXII)#14697
Open
honeylabshq wants to merge 4 commits into
Open
Conversation
Adds the HoneyLabs solution: honeypot-derived threat intelligence ingested through the built-in Threat Intelligence - TAXII data connector against the HoneyLabs TAXII 2.1 server. Includes a data connector page with copyable configuration values, three TI-map analytic rules (IP to CommonSecurityLog, IP to SigninLogs, URL to CommonSecurityLog), and an incident enrichment playbook that comments the full HoneyLabs verdict on IP entities. Package generated with the V3 packaging tool.
Author
|
@microsoft-github-policy-service agree |
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds a new community Microsoft Sentinel solution for ingesting and operationalizing HoneyLabs threat intelligence via TAXII, including connector instructions, analytics, and an enrichment playbook.
Changes:
- Introduces HoneyLabs solution metadata + release notes.
- Adds a Generic UI data connector page with copyable TAXII configuration values.
- Adds three TI mapping scheduled analytics and an incident enrichment playbook template.
Reviewed changes
Copilot reviewed 12 out of 14 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/HoneyLabs/SolutionMetadata.json | Defines solution publisher/offer metadata and support contact details. |
| Solutions/HoneyLabs/ReleaseNotes.md | Documents initial release version/date and included content. |
| Solutions/HoneyLabs/Playbooks/HoneyLabs-EnrichIncident-IP/readme.md | Describes playbook purpose, prerequisites, and post-deployment steps. |
| Solutions/HoneyLabs/Playbooks/HoneyLabs-EnrichIncident-IP/azuredeploy.json | ARM template for the incident enrichment playbook and API key parameterization. |
| Solutions/HoneyLabs/Package/testParameters.json | Deployment/test parameters for the packaged solution templates. |
| Solutions/HoneyLabs/Package/mainTemplate.json | Main solution package ARM template containing contentTemplates, connector UI, analytics, and playbook artifacts. |
| Solutions/HoneyLabs/Package/createUiDefinition.json | Installer UI definition for selecting the Sentinel workspace and guiding deployment. |
| Solutions/HoneyLabs/Data/Solution_HoneyLabs.json | Solution manifest pointing to included connectors/rules/playbooks and metadata. |
| Solutions/HoneyLabs/Data Connectors/HoneyLabs_TAXII.json | Generic UI data connector definition with configuration instructions. |
| Solutions/HoneyLabs/Analytic Rules/HoneyLabsTIMapURLEntityCommonSecurityLog.yaml | Scheduled rule template mapping HoneyLabs URL indicators to CommonSecurityLog. |
| Solutions/HoneyLabs/Analytic Rules/HoneyLabsTIMapIPEntitySigninLogs.yaml | Scheduled rule template mapping HoneyLabs IP indicators to Entra ID sign-in logs. |
| Solutions/HoneyLabs/Analytic Rules/HoneyLabsTIMapIPEntityCommonSecurityLog.yaml | Scheduled rule template mapping HoneyLabs IP indicators to CommonSecurityLog. |
Comment on lines
+1
to
+3
| | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ||
| |-------------|--------------------------------|---------------------------------------| | ||
| | 3.0.0 | 16-07-2026 | Initial solution release: TAXII data connector instructions, three TI-map analytic rules, IP enrichment playbook. | |
| "SavedSearches": [], | ||
| "Hunting Queries": [], | ||
| "Watchlists": [], | ||
| "BasePath": "/home/lenovo/development/Azure-Sentinel", |
Comment on lines
+892
to
+899
| "variables": { | ||
| "AzureSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", | ||
| "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", | ||
| "_connection-1": "[[variables('connection-1')]", | ||
| "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", | ||
| "workspace-name": "[parameters('workspace')]", | ||
| "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" | ||
| }, |
Comment on lines
+647
to
+671
| "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", | ||
| "apiVersion": "2023-04-01-preview", | ||
| "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", | ||
| "properties": { | ||
| "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", | ||
| "contentId": "[variables('_dataConnectorContentId1')]", | ||
| "kind": "DataConnector", | ||
| "version": "[variables('dataConnectorVersion1')]", | ||
| "source": { | ||
| "kind": "Solution", | ||
| "name": "HoneyLabs", | ||
| "sourceId": "[variables('_solutionId')]" | ||
| }, | ||
| "author": { | ||
| "name": "HoneyLabs", | ||
| "email": "[variables('_email')]" | ||
| }, | ||
| "support": { | ||
| "name": "HoneyLabs", | ||
| "email": "info@honeylabs.net", | ||
| "tier": "Community", | ||
| "link": "https://honeylabs.net" | ||
| } | ||
| } | ||
| } |
Comment on lines
+688
to
+716
| "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", | ||
| "apiVersion": "2023-04-01-preview", | ||
| "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", | ||
| "dependsOn": [ | ||
| "[variables('_dataConnectorId1')]" | ||
| ], | ||
| "location": "[parameters('workspace-location')]", | ||
| "properties": { | ||
| "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", | ||
| "contentId": "[variables('_dataConnectorContentId1')]", | ||
| "kind": "DataConnector", | ||
| "version": "[variables('dataConnectorVersion1')]", | ||
| "source": { | ||
| "kind": "Solution", | ||
| "name": "HoneyLabs", | ||
| "sourceId": "[variables('_solutionId')]" | ||
| }, | ||
| "author": { | ||
| "name": "HoneyLabs", | ||
| "email": "[variables('_email')]" | ||
| }, | ||
| "support": { | ||
| "name": "HoneyLabs", | ||
| "email": "info@honeylabs.net", | ||
| "tier": "Community", | ||
| "link": "https://honeylabs.net" | ||
| } | ||
| } | ||
| }, |
Comment on lines
+464
to
+485
| { | ||
| "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", | ||
| "apiVersion": "2023-04-01-preview", | ||
| "name": "[variables('dataConnectorTemplateSpecName1')]", | ||
| "location": "[parameters('workspace-location')]", | ||
| "dependsOn": [ | ||
| "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" | ||
| ], | ||
| "properties": { | ||
| "description": "HoneyLabs data connector with template version 3.0.0", | ||
| "mainTemplate": { | ||
| "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", | ||
| "contentVersion": "[variables('dataConnectorVersion1')]", | ||
| "parameters": {}, | ||
| "variables": {}, | ||
| "resources": [ | ||
| { | ||
| "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", | ||
| "apiVersion": "2021-03-01-preview", | ||
| "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", | ||
| "location": "[parameters('workspace-location')]", | ||
| "kind": "GenericUI", |
Comment on lines
+717
to
+723
| { | ||
| "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", | ||
| "apiVersion": "2021-03-01-preview", | ||
| "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", | ||
| "location": "[parameters('workspace-location')]", | ||
| "kind": "GenericUI", | ||
| "properties": { |
| "type": "Microsoft.Common.DropDown", | ||
| "label": "Workspace", | ||
| "placeholder": "Select a workspace", | ||
| "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", |
DetectionTemplateSchemaValidation rejected the custom connectorId HoneyLabsThreatIntelligenceTAXII in the analytic rules' requiredDataConnectors (not in ValidConnectorIds.json). Indicators arrive through the built-in ThreatIntelligenceTaxii connector, which the rules already require, so the custom id is removed from all three. SolutionValidations flagged bare 'Sentinel'; the connector description now says 'Microsoft Sentinel'. Package regenerated.
Author
|
Thanks for the review. Pushed fixes for the two failing checks:
On the Copilot comments against |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present:
Solution provider contact: info@honeylabs.net (HoneyLabs, https://honeylabs.net).