TacitRed-Defender-ThreatIntelligence v3.0.2: Fix InvalidTemplate on hyphenated workspace names

- Remove non-standard 'workspace' parameter from FunctionApp inner template
- Change SENTINEL_WORKSPACE_ID to use variables('workspace-name') instead of
  parameters('workspace'), matching the standard Content Hub pattern
- Fixes deployment error where hyphenated workspace names (e.g.
  Sentinel-Defender-Prod-7) are parsed as arithmetic expressions in
  resourceId() calls
- Bump version to 3.0.2
- Preserve 3.0.0 and 3.0.1 zip packages

Author: mazamizo21

Solutions/TacitRed-Defender-ThreatIntelligence/Data/Solution_TacitRedDefenderThreatIntelligence.json

@@ -9,7 +9,7 @@
     ],
     "Metadata": "SolutionMetadata.json",
     "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\TacitRed-Defender-ThreatIntelligence",
-    "Version": "3.0.1",
+    "Version": "3.0.2",
     "TemplateSpec": true,
     "Is1Pconnector": false
 }

Solutions/TacitRed-Defender-ThreatIntelligence/Package/3.0.2.zip

@@ -33,7 +33,7 @@
     "email": "support@data443.com",
     "_email": "[variables('email')]",
     "_solutionName": "TacitRed-Defender-ThreatIntelligence",
-    "_solutionVersion": "3.0.1",
+    "_solutionVersion": "3.0.2",
     "solutionId": "data443riskmitigationinc1761580347231.azure-sentinel-solution-tacitred-defender-ti",
     "_solutionId": "[variables('solutionId')]",
     "TacitRedDefenderTI_FunctionApp": "TacitRedDefenderTI_FunctionApp",
@@ -65,7 +65,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "TacitRedDefenderTI_FunctionApp Playbook with template version 3.0.1",
+        "description": "TacitRedDefenderTI_FunctionApp Playbook with template version 3.0.2",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion1')]",
@@ -83,12 +83,6 @@
                 "description": "URL to the Function App code zip file"
               },
               "defaultValue": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/TacitRed-Defender-ThreatIntelligence/Playbooks/TacitRedDefenderTI_FunctionApp/functionCode.zip"
-            },
-            "workspace": {
-              "type": "string",
-              "metadata": {
-                "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
-              }
             }
           },
           "variables": {
@@ -195,7 +189,7 @@
                     },
                     {
                       "name": "SENTINEL_WORKSPACE_ID",
-                      "value": "[[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]"
+                      "value": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]"
                     },
                     {
                       "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
@@ -283,7 +277,7 @@
         "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
       ],
       "properties": {
-        "description": "TacitRedToDefenderTI Playbook with template version 3.0.1",
+        "description": "TacitRedToDefenderTI Playbook with template version 3.0.2",
         "mainTemplate": {
           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
           "contentVersion": "[variables('playbookVersion2')]",
@@ -492,7 +486,7 @@
       "apiVersion": "2023-04-01-preview",
       "location": "[parameters('workspace-location')]",
       "properties": {
-        "version": "3.0.1",
+        "version": "3.0.2",
         "kind": "Solution",
         "contentSchemaVersion": "3.0.0",
         "displayName": "TacitRed-Defender-ThreatIntelligence",

Solutions/TacitRed-Defender-ThreatIntelligence/Package/mainTemplate.json

@@ -2,5 +2,6 @@
 
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
 |-------------|--------------------------------|--------------------|
+| 3.0.2       | 18-02-2026                     | Fixed InvalidTemplate error when deploying playbooks on workspaces with hyphenated names (e.g. `Sentinel-Defender-Prod-7`). Removed non-standard `workspace` parameter from Function App inner template and aligned SENTINEL_WORKSPACE_ID to use `variables('workspace-name')`, matching the standard Content Hub pattern used by 530+ Sentinel solutions. |
 | 3.0.1       | 11-02-2026                     | Fixed deployment failure: Restored functionCode.zip package removed in prior commit. Removed workspace-scoped roleAssignments from Function App template to resolve InvalidTemplate error during Content Hub deployment. |
 | 3.0.0       | 09-12-2025                     | Initial release of TacitRed Defender Threat Intelligence solution with Azure Function and Logic App playbook for syncing TacitRed compromised credentials to Microsoft Defender Threat Intelligence. |