JoeSandbox New Solution #12801

RamboV · 2025-09-15T05:54:40Z

Required items, please complete

Change(s):

See guidance below

Reason for Change(s):

See guidance below

Version Updated:

Required only for Detections/Analytic Rule templates
See guidance below

Testing Completed:

See guidance below

Checked that the validations are passing and have addressed any issues that are present:

See guidance below

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

Updated syntax for XYZ.yaml

Reason for Change(s):

New schema used for XYZ.yaml
Resolves ISSUE Add Logstash required version to Readme file #1234

Version updated:

Yes
Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

Guidance for Detection checks

General contribution guidance

PR validation troubleshooting

...aybooks/CustomConnector/JoeSandboxEnrichment_FunctionAppConnector/JoeSandboxGetIOCs/utils.py

Copilot

Pull Request Overview

This PR introduces a new JoeSandbox solution for Microsoft Sentinel that provides threat intelligence integration and automated analysis capabilities.

Key Changes:

Adds complete JoeSandbox solution infrastructure with threat intelligence feed integration
Implements Azure Function apps for file/URL analysis and IOC generation
Provides Logic Apps for automated incident response and email attachment analysis

Reviewed Changes

Copilot reviewed 39 out of 76 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
Solutions/JoeSandbox/SolutionMetadata.json	Solution metadata configuration for marketplace deployment
Solutions/JoeSandbox/ReleaseNotes.md	Version history and release documentation
Solutions/JoeSandbox/README.md	Complete setup and deployment instructions
Solutions/JoeSandbox/Package/mainTemplate.json	ARM template for solution deployment infrastructure
Solutions/JoeSandbox/Data Connectors/	Threat intelligence data connector with Azure Functions
Solutions/JoeSandbox/Playbooks/	Logic Apps for URL analysis and email attachment processing

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-15T07:04:11Z

Solutions/JoeSandbox/README.md

@@ -0,0 +1,227 @@
+# JoeSandbox Threat Intelligence Feed and Enrichment Integration - Microsoft Sentinel
+
+**Latest Version:** **1.0.0** - **Release Date:** **12/09/2025**


The version in README.md (1.0.0) does not match the version in ReleaseNotes.md (3.0.0). These should be consistent across all documentation files.

Suggested change

**Latest Version:** **1.0.0** - **Release Date:** **12/09/2025**

**Latest Version:** **3.0.0** - **Release Date:** **12/09/2025**

Copilot · 2025-09-15T07:04:11Z

Solutions/JoeSandbox/ReleaseNotes.md

+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                          |
+|-------------|--------------------------------|---------------------------------------------|
+| 3.0.0       | 23-07-2025                     | Initial Solution Release                    |


The release date format is inconsistent. ReleaseNotes.md uses DD-MM-YYYY (23-07-2025) while README.md uses DD/MM/YYYY (12/09/2025). Standardize the date format across all files.

Suggested change

| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |

|-------------|--------------------------------|---------------------------------------------|

| 3.0.0 | 23-07-2025 | Initial Solution Release |

| **Version** | **Date Modified (DD/MM/YYYY)** | **Change History** |

|-------------|--------------------------------|---------------------------------------------|

| 3.0.0 | 23/07/2025 | Initial Solution Release |

Copilot · 2025-09-15T07:04:11Z

Solutions/JoeSandbox/README.md

+  1. Azure functions with Flex Consumption plan.
+     Reference: https://learn.microsoft.com/en-us/azure/azure-functions/flex-consumption-plan
+
+	 **Note:** Flex Consumption plans are not available in all regions, please check if the region your are deploying the function is supported, if not we suggest you to deploy the function app with premium plan.


Grammatical error: 'your are' should be 'you are'.

Suggested change

**Note:** Flex Consumption plans are not available in all regions, please check if the region your are deploying the function is supported, if not we suggest you to deploy the function app with premium plan.

**Note:** Flex Consumption plans are not available in all regions, please check if the region you are deploying the function is supported, if not we suggest you to deploy the function app with premium plan.

Copilot · 2025-09-15T07:04:12Z

Solutions/JoeSandbox/Playbooks/JoeSandbox_Outlook_Attachment_Analysis/azuredeploy.json

+                                                                    "status": "New",
+                                                                    "description": "JoeSandbox Email Attachment Scan . From:@{triggerBody()?['from']}. To: @{triggerBody()?['toRecipients']}"
+                                                                },
+                                                                "path": "/Incidents/subscriptions/@{encodeURIComponent('7356a8d4-94f5-4210-a777-f4d6329e1c71')}/resourceGroups/@{encodeURIComponent('Joe-Security')}/workspaces/@{encodeURIComponent('JoeSecurity')}"


Hardcoded subscription ID, resource group, and workspace names in the Logic App template. These should be parameterized to work with different deployments.

Copilot · 2025-09-15T07:04:12Z

Solutions/JoeSandbox/Playbooks/JoeSandbox_Outlook_Attachment_Analysis/azuredeploy.json

+                                                                        },
+                                                                        "method": "post",
+                                                                        "body": {
+                                                                            "To": "[email protected]",


Hardcoded email addresses in the Logic App template. This should be parameterized to allow users to specify their own email addresses.

Copilot · 2025-09-15T07:04:13Z

...dbox/Data Connectors/azuredeploy_JoeSandboxThreatIntelligenceFuncApp_AzureFunction_flex.json

+        "WaitSection"
+      ],
+      "properties": {
+        "packageUri": "https://github.com/RamboV/JoeSandboxMSSentinel/raw/refs/heads/main/JoeSandboxThreatIntelligence/FlexCunsumptionPlan/JoeSandboxConn.zip",


Typo in URL path: 'FlexCunsumptionPlan' should be 'FlexConsumptionPlan'.

Suggested change

"packageUri": "https://github.com/RamboV/JoeSandboxMSSentinel/raw/refs/heads/main/JoeSandboxThreatIntelligence/FlexCunsumptionPlan/JoeSandboxConn.zip",

"packageUri": "https://github.com/RamboV/JoeSandboxMSSentinel/raw/refs/heads/main/JoeSandboxThreatIntelligence/FlexConsumptionPlan/JoeSandboxConn.zip",

Copilot · 2025-09-15T07:04:13Z

Solutions/JoeSandbox/Package/mainTemplate.json

+                                  "status": "New",
+                                  "description": "JoeSandbox Email Attachment Scan . From:@{triggerBody()?['from']}. To: @{triggerBody()?['toRecipients']}"
+                                },
+                                "path": "/Incidents/subscriptions/@{encodeURIComponent('7356a8d4-94f5-4210-a777-f4d6329e1c71')}/resourceGroups/@{encodeURIComponent('Joe-Security')}/workspaces/@{encodeURIComponent('JoeSecurity')}"


Multiple hardcoded values in the main template including subscription IDs, workspace IDs, and email addresses. These should be replaced with parameters to ensure the template works across different environments.

Copilot · 2025-09-15T07:04:13Z

Solutions/JoeSandbox/Package/mainTemplate.json

+                                      "sourcesystem": "JoeSandboxThreatIntelligence",
+                                      "indicators": "@body('GetJoeSanboxIOCs')['custom_response']"
+                                    },
+                                    "path": "/V2/ThreatIntelligence/4f06a513-315c-41be-8dc2-3dd4da0ba830/UploadIndicators/"


Multiple hardcoded values in the main template including subscription IDs, workspace IDs, and email addresses. These should be replaced with parameters to ensure the template works across different environments.

Copilot · 2025-09-15T07:04:13Z

Solutions/JoeSandbox/Package/mainTemplate.json

+                                    },
+                                    "method": "post",
+                                    "body": {
+                                      "To": "[email protected]",


Multiple hardcoded values in the main template including subscription IDs, workspace IDs, and email addresses. These should be replaced with parameters to ensure the template works across different environments.

Copilot · 2025-09-15T07:04:13Z

Solutions/JoeSandbox/Package/mainTemplate.json

+                                  },
+                                  "method": "post",
+                                  "body": {
+                                    "To": "[email protected]",


Multiple hardcoded values in the main template including subscription IDs, workspace IDs, and email addresses. These should be replaced with parameters to ensure the template works across different environments.

...aybooks/CustomConnector/JoeSandboxEnrichment_FunctionAppConnector/JoeSandboxGetIOCs/utils.py

+    return indicators
+
+
+def check_ip(ip: str) -> Optional[str]:


…nalysis directory

v-maheshbh · 2025-10-17T06:30:29Z

Hi @RamboV Kindly check failing Validations.

Thanks!

v-maheshbh · 2025-11-03T07:58:53Z

Hi @RamboV Kindly check above comment.

Thanks!

shubhamloginsoft · 2025-11-07T11:04:38Z

Hi @RamboV Kindly check above comment.

Thanks!

@v-maheshbh We have fixed the failed checks. Kindly review and let me know if any changes required.

v-maheshbh · 2025-11-18T08:57:08Z

Hi @RamboV
Kindly update the offerId to follow the correct format and repackage solution.
azure-sentinel-solution-solutionName

Thanks!

RamboV · 2025-11-18T18:42:47Z

Hi @v-maheshbh
updated the offerId.
Thanks!

RamboV · 2025-11-20T15:21:40Z

Hi @v-maheshbh , any update please?

v-maheshbh · 2025-11-21T11:21:06Z

Hi @RamboV
We are putting your PR on hold because your solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at [email protected] to discuss available options.

Thanks!

RamboV · 2025-11-21T13:42:22Z

Hi @RamboV We are putting your PR on hold because your solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at [email protected] to discuss available options.

Thanks!

Hello @v-maheshbh ,

CCF Framework will not work in this scenario, this includes.multuple API calls to process the data, each API calls is dependent on other.. hence we went with function app... please kindly arrange a call to discuss on this further.

v-maheshbh · 2025-11-28T04:47:40Z

Hi @RamboV
Please drop a mail to the Microsoft Sentinel Partners at [email protected] to get their feedback and approval, so we can proceed further.

Thanks!

RamboV · 2025-11-28T04:49:46Z

Hi @RamboV Please drop a mail to the Microsoft Sentinel Partners at [email protected] to get their feedback and approval, so we can proceed further.

Thanks!

Hi @v-maheshbh , already did that.. please proceed with the review we got approval .

v-maheshbh · 2025-11-28T04:59:02Z

Hi @RamboV
Could you please attach the approval so we can proceed? Thank you.

RamboV · 2025-11-28T05:03:35Z

Hi @RamboV Could you please attach the approval so we can proceed? Thank you.

If you still need anything please let me know your emails so that I will add them to the loop

v-maheshbh · 2025-11-28T08:44:15Z

Hi @RamboV

Please update the short link and ensure the description is formatted correctly so the author can easily distinguish between the two files. please find below links -
https://aka.ms/sentinel-JoeSandbox-azuredeployflex
https://aka.ms/sentinel-JoeSandbox-azuredeploypremium
Additionally, could you please confirm whether both URLs point to the same ZIP file?

and Kindly attach the screenshot of the playbook created.

Thanks!

v-maheshbh · 2025-12-09T11:06:31Z

Hi @RamboV
Kindly review above comments.

Thanks!

RamboV · 2025-12-10T07:06:31Z

Hi @v-maheshbh can you please create a soft link for below zip.
https://github.com/Azure/Azure-Sentinel/raw/refs/heads/master/Solutions/JoeSandbox/Data%20Connectors/JoeSandboxConn.zip

RamboV · 2025-12-10T07:15:22Z

@v-maheshbh please create softlink for below as well
https://github.com/Azure/Azure-Sentinel/raw/refs/heads/master/Solutions/JoeSandbox/Playbooks/CustomConnector/JoeSandboxEnrichment_FunctionAppConnector/JoeSandboxEnrichment.zip

Co-authored-by: RamboV <[email protected]>

RamboV · 2025-12-15T11:10:27Z

Hi @v-maheshbh any update on soft links please?

Co-authored-by: v-maheshbh <[email protected]>

RamboV · 2025-12-17T15:44:50Z

Hi @v-maheshbh any update on this please?

)" This reverts commit 803d26e.

v-maheshbh · 2025-12-19T07:05:54Z

Hi @RamboV
Kindly revert the changes related to chore: Update Solutions Analyzer CSV files and documentation (#2) that were automatically added via workflow.

and Additionally, we will be working on creating the soft link as part of the next steps.

Thanks!

)" This reverts commit 20419d8.

Co-authored-by: RamboV <[email protected]>

RamboV · 2025-12-22T09:26:54Z

Hello @v-maheshbh I have reverted the commit as suggested. Please kindly move on to the next steps.

v-maheshbh · 2025-12-30T10:01:48Z

Hi @RamboV Kindly resolved the Branch conflict. and revert the changes related to chore files.

Thanks!

)" This reverts commit 60cd42b.

Co-authored-by: RamboV <[email protected]>

)" This reverts commit 18d71db.

RamboV · 2026-01-06T09:58:19Z

@v-maheshbh can you please help us here its getting so much delayed, let us sync on a call to resolve the issues and merge the PR

v-maheshbh · 2026-01-07T13:47:14Z

@v-maheshbh can you please help us here its getting so much delayed, let us sync on a call to resolve the issues and merge the PR
Let us connect tomorrow. I will be available as per IST. Please find my [email protected]

Thanks!

Add files via upload

a6de4c2

RamboV requested review from a team as code owners September 15, 2025 05:54

RamboV added 2 commits September 15, 2025 11:25

Add files via upload

efb92c3

Update joesandbox.svg

987dd53

v-shukore assigned v-maheshbh Sep 15, 2025

v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Sep 15, 2025

github-advanced-security bot found potential problems Sep 15, 2025

View reviewed changes

...aybooks/CustomConnector/JoeSandboxEnrichment_FunctionAppConnector/JoeSandboxGetIOCs/utils.py Fixed Show fixed Hide fixed

rahul0216 requested a review from Copilot September 15, 2025 07:00

Copilot AI reviewed Sep 15, 2025

View reviewed changes

RamboV added 3 commits September 15, 2025 16:01

Add files via upload

0bea8bd

Update azuredeploy.json

da1e8b3

Update mainTemplate.json

7dff631

github-advanced-security bot found potential problems Sep 19, 2025

View reviewed changes

RamboV added 4 commits October 9, 2025 12:08

Delete Solutions/JoeSandbox/Playbooks/JoeSandbox_Outlook_Attachment_A…

1e42045

…nalysis directory

Add files via upload

c38434f

Update README.md

97bd54c

Update README.md

6f9ab5f

RamboV added 2 commits November 4, 2025 13:15

Add files via upload

ffa2487

Update playbook entry in Solution_JoeSandbox.json

15ef9b3

Add files via upload

4be90ea

RamboV added 3 commits November 19, 2025 00:08

Update offerId in SolutionMetadata.json

bd94463

Update fmt.Println message from 'Hello' to 'Goodbye'

aa0ad1f

Add files via upload

54e9698

RamboV and others added 2 commits December 15, 2025 14:22

Merge branch 'Azure:master' into master

2c48ab9

chore: Update Solutions Analyzer CSV files and documentation (#2)

20419d8

Co-authored-by: RamboV <[email protected]>

v-maheshbh and others added 2 commits December 17, 2025 16:54

Merge branch 'master' into pr/12801

59f942a

chore: Update Solutions Analyzer CSV files and documentation (#3)

803d26e

Co-authored-by: v-maheshbh <[email protected]>

Revert "chore: Update Solutions Analyzer CSV files and documentation (#3

3d8b657

)" This reverts commit 803d26e.

RamboV and others added 2 commits December 19, 2025 16:53

Revert "chore: Update Solutions Analyzer CSV files and documentation (#2

c0796e4

)" This reverts commit 20419d8.

chore: Update Solutions Analyzer CSV files and documentation (#4)

60cd42b

Co-authored-by: RamboV <[email protected]>

RamboV and others added 3 commits January 2, 2026 14:44

Revert "chore: Update Solutions Analyzer CSV files and documentation (#4

8ab9350

)" This reverts commit 60cd42b.

chore: Update Solutions Analyzer CSV files and documentation (#5)

18d71db

Co-authored-by: RamboV <[email protected]>

Revert "chore: Update Solutions Analyzer CSV files and documentation (#5

334af37

)" This reverts commit 18d71db.

		@@ -0,0 +1,227 @@
		# JoeSandbox Threat Intelligence Feed and Enrichment Integration - Microsoft Sentinel

		Latest Version: 1.0.0 - Release Date: 12/09/2025

	Latest Version: 1.0.0 - Release Date: 12/09/2025
	Latest Version: 3.0.0 - Release Date: 12/09/2025

	Note: Flex Consumption plans are not available in all regions, please check if the region your are deploying the function is supported, if not we suggest you to deploy the function app with premium plan.
	Note: Flex Consumption plans are not available in all regions, please check if the region you are deploying the function is supported, if not we suggest you to deploy the function app with premium plan.

	"packageUri": "https://github.com/RamboV/JoeSandboxMSSentinel/raw/refs/heads/main/JoeSandboxThreatIntelligence/FlexCunsumptionPlan/JoeSandboxConn.zip",
	"packageUri": "https://github.com/RamboV/JoeSandboxMSSentinel/raw/refs/heads/main/JoeSandboxThreatIntelligence/FlexConsumptionPlan/JoeSandboxConn.zip",

JoeSandbox New Solution #12801

Are you sure you want to change the base?

JoeSandbox New Solution #12801

Uh oh!

Conversation

RamboV commented Sep 15, 2025

Guidance <- remove section before submitting

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes:

Reviewed Changes

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Check notice

v-maheshbh commented Oct 17, 2025

Uh oh!

v-maheshbh commented Nov 3, 2025

Uh oh!

shubhamloginsoft commented Nov 7, 2025

Uh oh!

v-maheshbh commented Nov 18, 2025

Uh oh!

RamboV commented Nov 18, 2025

Uh oh!

RamboV commented Nov 20, 2025

Uh oh!

v-maheshbh commented Nov 21, 2025

Uh oh!

RamboV commented Nov 21, 2025

Uh oh!

v-maheshbh commented Nov 28, 2025

Uh oh!

RamboV commented Nov 28, 2025

Uh oh!

v-maheshbh commented Nov 28, 2025

Uh oh!

RamboV commented Nov 28, 2025

Uh oh!

v-maheshbh commented Nov 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-maheshbh commented Dec 9, 2025

Uh oh!

RamboV commented Dec 10, 2025

Uh oh!

RamboV commented Dec 10, 2025

Uh oh!

v-maheshbh commented Nov 28, 2025 •

edited

Loading

v-maheshbh commented Dec 19, 2025 •

edited

Loading