Skip to content

Commit 77c2aa3

Browse files
mazamizo21mazamizo21
committed
TacitRed-SentinelOne v3.0.2: Fix InvalidResourceLocation and remove domain filter
- Remove non-standard 'location' parameter from inner template, use variables('workspace-location-inline') matching 489 other solutions - Fix metadata resource name: change [[ (double bracket) to [ (single bracket) for outer template resolution, matching 481 other solutions - Remove TacitRed_Domain parameter from deployment UI, Logic App params, and API URI — playbook now fetches all findings without domain filter - Update standalone playbook template to match - Bump version to 3.0.2 - Preserve 3.0.0 zip package
1 parent 99b3040 commit 77c2aa3

File tree

5 files changed

+13
-44
lines changed

5 files changed

+13
-44
lines changed

‎Solutions/TacitRed-SentinelOne/Data/Solution_TacitRedSentinelOneAutomation.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
],
99
"Metadata": "SolutionMetadata.json",
1010
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\TacitRed-SentinelOne",
11-
"Version": "3.0.1",
11+
"Version": "3.0.2",
1212
"TemplateSpec": true,
1313
"Is1Pconnector": false
1414
}

‎Solutions/TacitRed-SentinelOne/Package/3.0.2.zip‎

5.3 KB
Binary file not shown.

‎Solutions/TacitRed-SentinelOne/Package/mainTemplate.json‎

Lines changed: 9 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
"email": "support@data443.com",
3434
"_email": "[variables('email')]",
3535
"_solutionName": "TacitRed-SentinelOne",
36-
"_solutionVersion": "3.0.1",
36+
"_solutionVersion": "3.0.2",
3737
"solutionId": "data443riskmitigationinc1761580347231.azure-sentinel-solution-tacitred-s1-ioc-auto",
3838
"_solutionId": "[variables('solutionId')]",
3939
"blanks": "[replace('b', 'b', '')]",
@@ -56,7 +56,7 @@
5656
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
5757
],
5858
"properties": {
59-
"description": "pb-tacitred-to-sentinelone Playbook with template version 3.0.0",
59+
"description": "pb-tacitred-to-sentinelone Playbook with template version 3.0.2",
6060
"mainTemplate": {
6161
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
6262
"contentVersion": "[variables('playbookVersion1')]",
@@ -65,24 +65,13 @@
6565
"type": "string",
6666
"defaultValue": "pb-tacitred-to-sentinelone"
6767
},
68-
"location": {
69-
"type": "string",
70-
"defaultValue": "[concat('[resourceGroup().locatio', 'n]')]"
71-
},
7268
"TacitRed_ApiKey": {
7369
"type": "securestring",
7470
"defaultValue": "",
7571
"metadata": {
7672
"description": "TacitRed API Key for authentication"
7773
}
7874
},
79-
"TacitRed_Domain": {
80-
"type": "string",
81-
"defaultValue": "",
82-
"metadata": {
83-
"description": "Optional domain filter for TacitRed findings"
84-
}
85-
},
8675
"SentinelOne_ApiToken": {
8776
"type": "securestring",
8877
"defaultValue": "",
@@ -108,16 +97,13 @@
10897
"type": "Microsoft.Logic/workflows",
10998
"apiVersion": "2019-05-01",
11099
"name": "[[parameters('PlaybookName')]",
111-
"location": "[[parameters('location')]",
100+
"location": "[[variables('workspace-location-inline')]",
112101
"properties": {
113102
"state": "Enabled",
114103
"parameters": {
115104
"TacitRed_ApiKey": {
116105
"value": "[[parameters('TacitRed_ApiKey')]"
117106
},
118-
"TacitRed_Domain": {
119-
"value": "[[parameters('TacitRed_Domain')]"
120-
},
121107
"SentinelOne_ApiToken": {
122108
"value": "[[parameters('SentinelOne_ApiToken')]"
123109
},
@@ -137,10 +123,6 @@
137123
"type": "string",
138124
"defaultValue": "[variables('blanks')]"
139125
},
140-
"TacitRed_Domain": {
141-
"type": "string",
142-
"defaultValue": "[variables('blanks')]"
143-
},
144126
"SentinelOne_BaseUrl": {
145127
"type": "string",
146128
"defaultValue": "https://usea1-001.sentinelone.net"
@@ -165,7 +147,7 @@
165147
"type": "Http",
166148
"inputs": {
167149
"method": "GET",
168-
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&domains[]=@{encodeUriComponent(parameters('TacitRed_Domain'))}&date_from=@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}&page=1&page_size=100",
150+
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&date_from=@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}&page=1&page_size=100",
169151
"headers": {
170152
"accept": "application/json",
171153
"User-Agent": "Microsoft-Sentinel-TacitRed/1.0",
@@ -212,13 +194,15 @@
212194
}
213195
},
214196
"tags": {
197+
"hidden-SentinelTemplateName": "TacitRedToSentinelOne",
198+
"hidden-SentinelTemplateVersion": "1.0",
215199
"hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]"
216200
}
217201
},
218202
{
219203
"type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
220204
"apiVersion": "2022-01-01-preview",
221-
"name": "[[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]",
205+
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]",
222206
"properties": {
223207
"parentId": "[[variables('playbookId1')]]",
224208
"contentId": "[variables('_playbookContentId1')]",
@@ -251,8 +235,7 @@
251235
"postDeployment": [
252236
"1. Configure the TacitRed API Key parameter",
253237
"2. Configure the SentinelOne API Token and Base URL parameters",
254-
"3. Optionally set a domain filter to limit findings to specific domains",
255-
"4. Enable the Logic App and configure the recurrence trigger as needed"
238+
"3. Enable the Logic App and configure the recurrence trigger as needed"
256239
],
257240
"lastUpdateTime": "2026-01-22T00:00:00Z",
258241
"tags": [
@@ -288,7 +271,7 @@
288271
"apiVersion": "2023-04-01-preview",
289272
"location": "[parameters('workspace-location')]",
290273
"properties": {
291-
"version": "3.0.0",
274+
"version": "3.0.2",
292275
"kind": "Solution",
293276
"contentSchemaVersion": "3.0.0",
294277
"displayName": "TacitRed-SentinelOne",

‎Solutions/TacitRed-SentinelOne/Playbooks/TacitRedToSentinelOne_Playbook.json‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,7 @@
88
"postDeployment": [
99
"1. Configure the TacitRed API Key parameter",
1010
"2. Configure the SentinelOne API Token and Base URL parameters",
11-
"3. Optionally set a domain filter to limit findings to specific domains",
12-
"4. Enable the Logic App and configure the recurrence trigger as needed"
11+
"3. Enable the Logic App and configure the recurrence trigger as needed"
1312
],
1413
"prerequisitesDeployTemplateFile": "",
1514
"lastUpdateTime": "2026-01-22T00:00:00.000Z",
@@ -38,13 +37,6 @@
3837
"description": "TacitRed API Key for authentication"
3938
}
4039
},
41-
"TacitRed_Domain": {
42-
"type": "string",
43-
"defaultValue": "",
44-
"metadata": {
45-
"description": "Optional domain filter for TacitRed findings"
46-
}
47-
},
4840
"SentinelOne_ApiToken": {
4941
"type": "securestring",
5042
"defaultValue": "",
@@ -72,9 +64,6 @@
7264
"TacitRed_ApiKey": {
7365
"value": "[parameters('TacitRed_ApiKey')]"
7466
},
75-
"TacitRed_Domain": {
76-
"value": "[parameters('TacitRed_Domain')]"
77-
},
7867
"SentinelOne_ApiToken": {
7968
"value": "[parameters('SentinelOne_ApiToken')]"
8069
},
@@ -94,10 +83,6 @@
9483
"type": "string",
9584
"defaultValue": ""
9685
},
97-
"TacitRed_Domain": {
98-
"type": "string",
99-
"defaultValue": ""
100-
},
10186
"SentinelOne_BaseUrl": {
10287
"type": "string",
10388
"defaultValue": "https://usea1-001.sentinelone.net"
@@ -122,7 +107,7 @@
122107
"type": "Http",
123108
"inputs": {
124109
"method": "GET",
125-
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&domains[]=@{encodeUriComponent(parameters('TacitRed_Domain'))}&date_from=@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}&page=1&page_size=100",
110+
"uri": "@{parameters('TacitRed_ApiUrl')}?types[]=compromised_credentials&date_from=@{formatDateTime(addDays(utcNow(), -7), 'yyyy-MM-dd')}&page=1&page_size=100",
126111
"headers": {
127112
"accept": "application/json",
128113
"User-Agent": "Microsoft-Sentinel-TacitRed/1.0",

‎Solutions/TacitRed-SentinelOne/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|----------------------------|
3+
| 3.0.2 | 17-02-2026 | Fixed `InvalidResourceLocation` error: removed non-standard `location` parameter from inner template, aligned with standard Content Hub variable pattern. Fixed metadata resource name using wrong bracket type. Removed `TacitRed_Domain` filter parameter from deployment UI — playbook now fetches all findings without domain restriction. |
34
| 3.0.0 | 09-12-2025 | Initial Solution Release. |

0 commit comments

Comments
 (0)