DO NOT MERGE - Testing Workflow

[Tintintani]

Required items, please complete

Change(s):

• See guidance below

Reason for Change(s):

• See guidance below

Version Updated:

• Required only for Detections/Analytic Rule templates
• See guidance below

Testing Completed:

• See guidance below

Checked that the validations are passing and have addressed any issues that are present:

• See guidance below

Guidance <- remove section before submitting

---

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

• Updated syntax for XYZ.yaml

Reason for Change(s):

• New schema used for XYZ.yaml
• Resolves ISSUE Add Logstash required version to Readme file #1234

Version updated:

• Yes
• Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

• Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

• Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

• Guidance for Detection checks
• General contribution guidance
• PR validation troubleshooting

---

[github-actions]

Results

---

UI Test Results for Solution: CiscoUmbrella

---

Test Type	Name	Result	Error Message
Metadata	CiscoUmbrella	Failed❌	Expected: '/CiscoUmbrella/'. Actual: 'Cisco Umbrellafeatured'Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/LFAzZNfl5QUjcMDJ
Data Connector	Cisco Umbrella (using Azure Functions)	Passed✅
Analytics Rule	Cisco Umbrella - Connection to Unpopular Website Detected	Passed✅
Analytics Rule	Cisco Umbrella - URI contains IP address	Passed✅
Analytics Rule	Cisco Umbrella - Empty User Agent Detected	Passed✅
Hunting Query	Cisco Umbrella - Proxy 'Allowed' to unreliable categories.	Passed✅
Hunting Query	Cisco Umbrella - High values of Uploaded Data	Passed✅
Hunting Query	Cisco Umbrella - Anomalous FQDNs for domain	Passed✅
Parser	CiscoUmbrella Data Parser	Passed✅
Workbook	Cisco Umbrella	Passed✅
Playbook	CiscoUmbrella-BlockDomain	Passed✅
Playbook	CiscoUmbrella-AssignPolicyToIdentity	Failed❌	Expected: 'Notification'. Actual: 'SyncNotificationTeams Response'Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/smYK42wGK6V7fxrf
Playbook	CiscoUmbrella-GetDomainInfo	Failed❌	Expected: 'Notification'. Actual: 'SyncNotificationTeams Response'Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/bPQYC7QeW0t0IqkP
Delete	Delete Solution	Passed✅

[github-actions]

Results

---

UI Test Results for Solution: CiscoUmbrella

---

Test Type	Name	Result	Error Message
Metadata	CiscoUmbrella	Failed❌	Expected: '/CiscoUmbrella/'. Actual: 'Cisco Umbrellafeatured'
Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/5TKz9IzANQAySLfT
Data Connector	Cisco Umbrella (using Azure Functions)	Passed✅
Analytics Rule	Cisco Umbrella - Connection to Unpopular Website Detected	Passed✅
Analytics Rule	Cisco Umbrella - Request Allowed to harmful/malicious URI category	Passed✅
Analytics Rule	Cisco Umbrella - Rare User Agent Detected	Passed✅
Hunting Query	Cisco Umbrella - High values of Uploaded Data	Passed✅
Hunting Query	Cisco Umbrella - Possible data exfiltration	Passed✅
Hunting Query	Cisco Umbrella - Requests to uncategorized resources	Passed✅
Parser	CiscoUmbrella Data Parser	Passed✅
Workbook	Cisco Umbrella	Passed✅
Playbook	CiscoUmbrella-AddIpToDestinationList	Passed✅
Playbook	CiscoUmbrella-GetDomainInfo	Passed✅
Playbook	CiscoUmbrella-AssignPolicyToIdentity	Passed✅
Delete	Delete Solution	Passed✅

[github-actions]

Results

---

UI Test Results for Solution: CiscoUmbrella

---

Test Type	Name	Result	Error Message
Metadata	CiscoUmbrella	Passed✅
Data Connector	Cisco Umbrella (using Azure Functions)	Passed✅
Analytics Rule	Cisco Umbrella - Crypto Miner User-Agent Detected	Passed✅
Analytics Rule	Cisco Umbrella - Empty User Agent Detected	Passed✅
Analytics Rule	Cisco Umbrella - URI contains IP address	Passed✅
Hunting Query	Cisco Umbrella - Proxy 'Allowed' to unreliable categories.	Passed✅
Hunting Query	Cisco Umbrella - Possible connection to C2.	Passed✅
Hunting Query	Cisco Umbrella - DNS requests to unreliable categories.	Passed✅
Parser	CiscoUmbrella Data Parser	Passed✅
Workbook	Cisco Umbrella	Passed✅
Playbook	CiscoUmbrella-BlockDomain	Passed✅
Playbook	CiscoUmbrella-GetDomainInfo	Passed✅
Playbook	CiscoUmbrella-AddIpToDestinationList	Passed✅
Delete	Delete Solution	Passed✅

[github-actions]

Results

---

UI Test Results for Solution: CiscoMerakiEventsviaRESTAPI

---

Test Type	Name	Result	Error Message
Metadata	Cisco Meraki Events via REST API	Passed✅
Data Connector	Cisco Meraki (using REST API)	Passed✅
Delete	Delete Solution	Failed❌	Element not found Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/bQzsav47tPFLPvq3

UI Test Results for Solution: DomainTools

---

Test Type	Name	Result	Error Message
Metadata	DomainTools	Passed✅
Parser	DomainTools ASIM DNS Schema	Passed✅
Playbook	DomainTools-DNSDB-Co-Located-IP-Addresses	Passed✅
Playbook	DomainTools-DNSDB-Historical-Hosts	Passed✅
Playbook	DomainTools-IP-Address-Playbook	Passed✅
Delete	Delete Solution	Passed✅

[github-actions]

Results

---

UI Test Results for Solution: CiscoMerakiEventsviaRESTAPI

---

Test Type	Name	Result	Error Message
Metadata	Cisco Meraki Events via REST API	Passed✅
Data Connector	Cisco Meraki (using REST API)	Passed✅
Delete	Delete Solution	Failed❌	Element not found Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/LHizEpDsvfdmw754

UI Test Results for Solution: DomainTools

---

Test Type	Name	Result	Error Message
Metadata	DomainTools	Passed✅
Parser	DomainTools ASIM DNS Schema	Passed✅
Playbook	DomainTools-DNSDB-Historical-Hosts	Passed✅
Playbook	DomainTools-ASIM-DNS-Playbook	Failed❌	Expected: 'DNS Resolution'. Actual: 'DNS' Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/r2DqcZutReYQEs1a
Playbook	DomainTools-DNSDB-Historical-IP-Addresses	Failed❌	Expected: 'Host1DNS Resolution'. Actual: 'Host1DNS' Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/DhoiOqzGu6YViryU
Delete	Delete Solution	Passed✅

[github-actions]

Results

---

UI Test Results for Solution: CiscoMerakiEventsviaRESTAPI

---

Test Type	Name	Result	Error Message
Metadata	Cisco Meraki Events via REST API	Passed✅
Data Connector	Cisco Meraki (using REST API)	Passed✅
Delete	Delete Solution	Failed❌	Element not found Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/6hkXevaFwnJrPSho

UI Test Results for Solution: DomainTools

---

Test Type	Name	Result	Error Message
Metadata	DomainTools	Passed✅
Parser	DomainTools ASIM DNS Schema	Passed✅
Playbook	DomainTools-DNSDB-Co-Located-IP-Addresses	Passed✅
Playbook	DomainTools-Iris-Investigate-Playbook	Failed❌	Expected: 'Host2DNS ResolutionURL'. Actual: 'Host2DNSURL' Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/kY7Jz9jldn1gMejy
Playbook	DomainTools-DNSDB-Co-Located-Hosts	Failed❌	Expected: 'Host1DNS Resolution'. Actual: 'Host1DNS' Test Link: https://app.testim.io/#/project/f2n6Q9XeQThQct9PLBnp/runs/suites/PgAI1LYuR82tWCmM
Delete	Delete Solution	Passed✅

[Tintintani]

@microsoft-github-policy-service agree company="Microsoft"

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.