feedly
diff --git a/‎.github/copilot-instructions.md‎
Lines changed: 82 additions & 0 deletions b/‎.github/copilot-instructions.md‎
Lines changed: 82 additions & 0 deletions
diff --git a/‎.github/workflows/cleanup-stale-branch.yaml‎
Lines changed: 40 additions & 0 deletions b/‎.github/workflows/cleanup-stale-branch.yaml‎
Lines changed: 40 additions & 0 deletions
diff --git a/‎.github/workflows/runAsimSchemaAndDataTesters.yaml‎
Lines changed: 41 additions & 1 deletion b/‎.github/workflows/runAsimSchemaAndDataTesters.yaml‎
Lines changed: 41 additions & 1 deletion
diff --git a/‎.gitignore‎
Lines changed: 1 addition & 0 deletions b/‎.gitignore‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎.script/package-automation/catalogAPI.ps1‎
Lines changed: 22 additions & 0 deletions b/‎.script/package-automation/catalogAPI.ps1‎
Lines changed: 22 additions & 0 deletions
diff --git a/‎.script/tests/KqlvalidationsTests/CustomFunctions/AWSCloudTrail.json‎
Lines changed: 4 additions & 0 deletions b/‎.script/tests/KqlvalidationsTests/CustomFunctions/AWSCloudTrail.json‎
Lines changed: 4 additions & 0 deletions
@@ -0,0 +1,82 @@
+# GitHub Copilot Instructions for Azure-Sentinel Repository
+
+## Solutions Analyzer Tools
+
+When working with the Solutions Analyzer tools in `Tools/Solutions Analyzer/`:
+
+### Output Locations
+
+There are THREE different output scenarios - **never confuse them**:
+
+1. **Default (development):** CSVs are written to `Tools/Solutions Analyzer/` in the current branch
+   - This is the normal case when developing/testing
+   - **Never generate documentation here**
+
+2. **Output worktree (publishing CSVs):** `C:\Users\ofshezaf\GitHub\Azure-Sentinel-solution-analyzer-output\Tools\Solutions Analyzer`
+   - Only use this when **specifically requested** to "publish CSVs to the output branch"
+   - This is a separate git worktree for the CSV output branch
+   - **Only CSVs go here, never documentation**
+
+3. **Documentation output:** `C:\Users\ofshezaf\GitHub\sentinelninja\Solutions Docs`
+   - This is where generated markdown documentation goes
+   - This is in a **separate repository** (sentinelninja)
+   - Empty the target folder before generating new docs
+
+### Key Rules
+
+- **Never generate docs locally** in the Azure-Sentinel repository
+- **Generate docs only in the sentinelninja repo** when asked or needed
+- **For official CSV releases**, generate CSVs **only** in the solution analyzer output worktree
+- Always use `--output-dir` flag when running `generate_connector_docs.py`
+
+### Running Scripts
+
+#### Mapper Script
+```powershell
+cd "Tools/Solutions Analyzer"
+python map_solutions_connectors_tables.py
+```
+
+**Note:** Do NOT truncate or filter the output (e.g., do not pipe through `Select-Object`). The script prints timestamped progress messages to the console that the user needs to see. Run with `isBackground: false` and `timeout: 0` so the full output is visible.
+
+#### Documentation Generator
+```powershell
+python generate_connector_docs.py --output-dir "C:\Users\ofshezaf\GitHub\sentinelninja\Solutions Docs" --skip-input-generation
+```
+
+**IMPORTANT:** Never run without `--output-dir` flag.
+
+**IMPORTANT:** Do NOT truncate or filter the output (e.g., do not pipe through `Select-Object`). Run with `isBackground: false` and `timeout: 0` so the full output is visible to the user.
+
+**IMPORTANT:** Always use `--skip-input-generation` unless you specifically need to regenerate the input CSVs (mapper + collect_table_info). Without this flag, the doc generator will re-run those scripts automatically, which is slow and unnecessary if the CSVs are already up-to-date.
+
+**IMPORTANT:** Run the mapper script before generating docs if:
+- The mapper script itself was modified, OR
+- Any override YAML file in the `overrides/` folder was modified (including adding, editing, or removing `additional_connectors` entries), OR
+- You specifically need to refresh the CSV data, OR
+- You are explicitly asked to run the mapper
+
+### Caching and Logging
+
+- **Cache:** `.cache/` folder for analysis caching
+- **Logs:** `.logs/` folder for log files
+
+**Log file:** `Tools/Solutions Analyzer/.logs/map_solutions_connectors_tables.log`
+
+Use `--force-refresh` with these types when modifying analysis logic:
+- `asim` - ASIM parser analysis
+- `parsers` - Non-ASIM parser analysis
+- `solutions` - Solution content analysis
+- `standalone` - Standalone content item analysis
+- `marketplace` - Marketplace availability check (requires network)
+- `tables` - Table reference info (requires network)
+
+### Script Documentation
+
+**Before updating a script:** Always review the relevant script documentation in `Tools/Solutions Analyzer/docs/` first.
+
+**When updating a script**, update the corresponding script doc to reflect:
+- Any script parameters added or changed
+- Any output file changes, including changes to CSV files (new columns, renamed columns, removed columns)
+- Any changes to analysis methods or logic
+- Update the primary readme.md if needed and add the change to the change log. Do not add a version if the previous version as manifested by the changelog, was not committed yet.
@@ -0,0 +1,40 @@
+# .github/workflows/cleanup-stale-branch.yaml
+name: Cleanup Stale Branches
+run-name: Stale Branches Cleanup Running 
+
+on:
+  schedule:
+  # Runs at 4:00 AM every day (Monday to Sunday)
+    - cron: '0 4 * * *'
+  # Allows to run workflow manually from the Actions tab
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  cleanup_stale_branches:
+  # Only run if the repository is not a fork and not archived
+    if: github.event.repository.fork == false && github.event.repository.archived == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cleanup Stale Branches
+        uses: crs-k/stale-branches@593086d4e251bb26dd5cd21202d0102fcf172164
+        with:
+          repo-token: '${{ secrets.GITHUB_TOKEN }}'
+          days-before-stale: 120
+          days-before-delete: 180
+          comment-updates: false
+          max-issues: 20
+          tag-committer: false
+          stale-branch-label: 'stale-branch'
+          compare-branches: 'info'
+          branches-filter-regex: '^((?!dependabot))'
+          rate-limit: true
+          pr-check: true
+          dry-run: true
+          ignore-issue-interaction: true
+          include-protected-branches: false
+          include-ruleset-branches: false
+          ignore-commit-messages: ''
+          ignore-committers: ''
@@ -43,6 +43,14 @@ jobs:
     outputs:
       approved: ${{ steps.check-approval.outputs.approved }}
     steps:
+      - name: Checkout pull request branch
+        if: github.event.pull_request != null
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          fetch-depth: 0
+
       - name: Check if PR needs approval
         id: check-approval
         run: |
@@ -96,7 +104,39 @@ jobs:
             echo "needs_approval=false" >> $GITHUB_OUTPUT
             echo "comment_needed=false" >> $GITHUB_OUTPUT
           fi
-      
+
+      - name: Prevent fork modifications to test infrastructure
+        if: github.event.pull_request.head.repo.fork == true
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          log_info() { echo "ℹ️  $1"; }
+          log_error() { echo "❌ $1"; }
+          log_success() { echo "✅ $1"; }
+
+          log_info "Checking for modifications to asimParsersTest folder in fork PR..."
+
+          # We are currently checked out at the fork's HEAD SHA (actions/checkout did that).
+          # Add the base repo as a remote and fetch the base branch, so we can diff reliably.
+          git remote remove upstream 2>/dev/null || true
+          git remote add upstream "https://github.com/${{ github.repository }}.git"
+
+          log_info "Fetching base branch ${{ github.event.pull_request.base.ref }} from upstream..."
+          git fetch --no-tags --prune upstream "${{ github.event.pull_request.base.ref }}"
+
+          # Diff base branch (FETCH_HEAD) -> current HEAD (fork head)
+          modified_files="$(git diff --name-only "FETCH_HEAD...HEAD")"
+
+          if echo "$modified_files" | grep -E "\.script/tests/asimParsersTest/" > /dev/null; then
+            log_error "Fork PRs cannot modify the asimParsersTest test infrastructure folder"
+            log_error "Modified test files detected:"
+            echo "$modified_files" | grep "\.script/tests/asimParsersTest/" | sed 's/^/  - /'
+            exit 1
+          fi
+          
+          log_success "No modifications to asimParsersTest folder detected"
+
       - name: Comment on fork PR for approval guidance
         if: |
           always() && 
 
@@ -346,3 +346,4 @@ Hunting Queries/DeployedQueries.json
 .script/**/*.js.map
 .script/**/*.d.ts
 .script/**/*.d.ts.map
+/.vscode
@@ -25,6 +25,28 @@ function GetCatalogDetails($offerId)
                 return $null;
             }
             else {
+                # Handle case where multiple offers are returned with same OfferId
+                if ($offerDetails -is [System.Object[]] -and $offerDetails.Count -gt 1)
+                {
+                    Write-Host "Multiple offers found for offerId $offerId. Matching by publisherId from baseMetadata."
+                    $matched = $offerDetails | Where-Object { $_.publisherId -eq $baseMetadata.publisherId }
+                    if ($null -ne $matched)
+                    {
+                        if ($matched -is [System.Object[]])
+                        {
+                            $offerDetails = $matched[0]
+                        }
+                        else
+                        {
+                            $offerDetails = $matched
+                        }
+                    }
+                    else
+                    {
+                        Write-Host "No offer matched publisherId '$($baseMetadata.publisherId)'. Defaulting to first offer."
+                        $offerDetails = $offerDetails[0]
+                    }
+                }
                 Write-Host "CatalogAPI Details found for offerId $offerId"
                 return $offerDetails;
             }
 
@@ -146,6 +146,10 @@
             "name": "EC2RoleDelivery",
             "type": "String"
         },
+        {
+            "name": "UserIdentityAccessKeyId",
+            "type": "String"
+        },
         {
             "name": "Session*",
             "type": "String"