AIShield AI Security Monitoring Solution Guardian updates

[udanashivm]

Required items, please complete

Added new Analytics rules, parser and sample data
Change(s):
See guidance below
Reason for Change(s):

See guidance below
Version Updated:

Required only for Detections/Analytic Rule templates
See guidance below
Testing Completed:

yes
Checked that the validations are passing and have addressed any issues that are present:

[udanashivm]

Hi @v-shukore,

The test Validate_SolutionParsersFunctions_HaveValidKql is failing due to missing columns, tables, or functions. We have already added sample data and a custom table, but the issue persists.

Could you help us identify what might be missing or misconfigured? Thanks!

[v-shukore]

Hi @udanashivm, we will investigate the KQL validation failure and update you by 24th Feb 2025. Thanks!!

[udanashivm]

Hi @v-shukore , Just checking in on the KQL validation failure. Were you able to investigate the issue?

[v-shukore]

Hello, @udanashivm. According to our observations, KQL validation is failing because the columns you specified in the parser query do not match the sample data you added. So, please adjust the column names in the query to match those in the sample data. You referenced "Policy_Violated_ControlFeature_s" in your query, but the column name is "Policy_Violated_Control_Feature_s" in the sample data, so please update it. Thanks!!

[v-shukore]

Hi @udanashivm, we are waiting for your updates. Please make the changes so we can proceed further. Thanks!!

[udanashivm]

Hi @udanashivm, we are waiting for your updates. Please make the changes so we can proceed further. Thanks!!

@v-shukore ,I have updated the code. Please review the changes and let us know if there is anything else pending from our side.
Looking forward to your feedback! Thanks!

[v-shukore]

Hi @udanashivm, Please package the solution using V3 tool
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md
Also, include workbook metadata in this file.
https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json.
Thanks!!

[udanashivm]

Hi @udanashivm, Please package the solution using V3 tool https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md Also, include workbook metadata in this file. https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json. Thanks!!

Thank you, @v-shukore, for the review. I’ve updated the WorkbooksMetadata.json details, created the solution package, and verified it. Please review and let me know if anything else is needed. Thanks!

[udanashivm]

The Data Connector validation is failing. Could you please check and let us know the issue?