SOCRadar: Add SOCRadar Solution V1.0.0 by Radargoger · Pull Request #13858 · Azure/Azure-Sentinel

Radargoger · 2026-03-19T02:36:38Z

Description

This Pull Request introduces the SOCRadar XTI Platform solution. This integration enables bidirectional communication between SOCRadar and Microsoft Sentinel.

Key Components Included:

Solution Metadata & Data: Core configuration for the SOCRadar solution.
Hunting Queries (5): - SOCRadar Alarm Overview
- SOCRadar Critical Alarms
- SOCRadar Alarm Trends
- SOCRadar Incident Correlation
- SOCRadar Audit Analysis
Playbooks (4): Infrastructure and automation for Alarm Import and Syncing.
Workbook: A comprehensive SOCRadar Dashboard for visualizing threat intelligence and alarm data.
Logos & Documentation: Updated WorkbooksMetadata.json and added brand assets.

Validation

Verified all JSON/YAML files for schema compliance.
Updated WorkbooksMetadata.json to include the new SOCRadar dashboard.
Ensured all paths in Solution_SOCRadar.json are correctly pointing to the relative directories.

Screenshots

Radargoger · 2026-03-19T02:39:49Z

Hi v-maheshbh (@v-maheshbh) ,

To resolve the previous branch conflicts and provide a clean sync with the upstream master, I have created a new pull request: #13858.

This PR supersedes and closes #13628.

Please review the new PR at your convenience. Thank you for your patience during the branch cleanup.

Best regards,
Burak

Radargoger · 2026-03-19T08:30:07Z

Hi v-maheshbh (@v-maheshbh),
This new PR (#13858) replaces the previous #13628 with a clean branch synced to upstream master.
Changes since last review:

Added custom table schemas (SOCRadar_Alarms_CL.json, SOCRadarAuditLog_CL.json) under .script/tests/KqlvalidationsTests/CustomTables/ to fix KQL validation failures
Added socradar.svg logo under Workbooks/Images/Logos/ to fix Workbooks validation failure
Removed unrelated changes from WorkbooksMetadata file (only SOCRadarDashboard changes remain)
Solution packaged with V3 tool, version 3.0.0

Note: The ARM-TTK DeploymentTemplate Must Not Contain Hardcoded Uri warning is expected — the Logic App playbooks require management.azure.com for Sentinel API calls, which is standard for Sentinel solutions.
Could you please review when you have a chance? Thank you.
Best regards,
Burak

Radargoger · 2026-03-19T08:32:02Z

Hi v-maheshbh (@v-maheshbh) ,
PR #13858 replaces #13628 with a clean branch. All previous review feedback has been addressed:

KQL validation fix: added custom table schemas for SOCRadar_Alarms_CL and SOCRadarAuditLog_CL
Workbooks validation fix: added socradar.svg logo
WorkbooksMetadata: only SOCRadar-related changes
Packaged with V3 tool, version 3.0.0

Ready for review. Could you please review when you have a chance? Thank you!
Best regards,
Burak

Radargoger · 2026-03-22T09:44:24Z

Hi v-maheshbh (@v-maheshbh) ,

I've just pushed a fix for the Workbook validation error. The preview images (SOCRadarDashboardBlack.png and SOCRadarDashboardWhite.png) have been copied to the central Workbooks/Images/Preview directory as required by the validator.

All validation checks should now pass. Ready for your review. Thank you!
Burak

Radargoger

Hi v-maheshbh (@v-maheshbh),

To resolve the previous branch conflicts and provide a clean sync with the upstream master, I have created a new pull request: #13858.

This PR supersedes and closes #13628.

Please review the new PR at your convenience. Thank you for your patience during the branch cleanup.

Best regards,
Burak

Radargoger · 2026-03-22T09:47:33Z

Hi v-maheshbh (@v-maheshbh) ,

I've just pushed a fix for the Workbook validation error. The preview images (SOCRadarDashboardBlack.png and SOCRadarDashboardWhite.png) have been copied to the central Workbooks/Images/Preview directory as required by the validator.

All validation checks should now pass. Ready for your review. Thank you!
Burak

Radargoger · 2026-03-23T07:18:38Z

Hi v-maheshbh (@v-maheshbh) ,

Just following up on my previous message regarding the Workbook validation fix.

The preview images have been moved to the required directory, and all validation checks should now be passing. Could you please review when you have a moment?

Thanks in advance!

Best regards,
Burak

Radargoger · 2026-03-24T07:02:11Z

Hi v-maheshbh (@v-maheshbh)

We passed the reviews. Please let us know if there is anything else needed to proceed and approve.

Best regards,
Burak GOGER
Senior Product Manager

Radargoger · 2026-03-26T13:43:45Z

Hi v-maheshbh (@v-maheshbh) v-shukore ,

We passed the reviews. Please let us know if there is anything else needed to proceed and approve.

Best regards,
Burak GOGER
Senior Product Manager

v-maheshbh (v-maheshbh) · 2026-03-27T05:25:24Z

Hi Radargoger

Kindly resolve the branch conflict to proceed further.

Thanks!

Radargoger · 2026-03-27T20:37:22Z

Hi v-maheshbh (@v-maheshbh) v-shukore

Conflict is resolved. Please proceed. Thanks in advence.

Best Regards
Burak

Radargoger · 2026-03-28T19:17:54Z

Hi v-maheshbh (@v-maheshbh) v-shukore,

The conflict has been resolved. You can proceed.

Thanks in advance.

Best regards,
Burak

Radargoger · 2026-03-30T03:59:43Z

Hi v-maheshbh (@v-maheshbh) v-shukore,

The conflict has been resolved. You can proceed.

Thanks in advance.

Best regards,
Burak

Radargoger · 2026-04-02T07:10:29Z

Hi v-maheshbh (@v-maheshbh) ,

The current ARM-TTK failure is due to the mandatory URI management.azure.com used in the Playbooks. This is a standard implementation across all Sentinel solutions and cannot be parameterized differently for this use case.

Since all other 22 checks have passed and the manual reviews are complete, could you please manually bypass/approve this specific ARM-TTK check? We have also reached out to the Certification Engagement team as requested by support (SR# 2603310010001792).

Best
Burak

v-maheshbh (v-maheshbh) · 2026-04-02T12:09:39Z

Hi Radargoger
The Hunting Queries metadata is missing the required fields severity and relevantTechniques, entityMappings section Kindly add these properties in each hunting query YAML file as per the standard schema and update the solution accordingly.

Refer below solution for guidance:
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Amazon%20Web%20Services/Hunting%20Queries

The ZIP package is missing from the package folder. Kindly repackage the solution
using V3 tool https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

Thanks!

Radargoger · 2026-04-03T06:52:06Z

Hi v-maheshbh (@v-maheshbh) ,

Thanks for update & feedback

We have updated the Hunting Queries metadata by adding the required fields (severity, relevantTechniques, and entityMappings) to each YAML file in accordance with the standard schema.

Additionally, the solution has been repackaged using the V3 tool, and the ZIP package is now properly included in the package folder.

Please let us know if anything further is needed.

Thanks!
Burak

v-maheshbh (v-maheshbh) · 2026-04-07T10:03:09Z

Hi Radargoger

We are getting a deployment error in the main template.
The error occurs because utcNow() is only supported in ARM parameter default value expressions.
Its usage in variables, resources, or URIs is not supported.
Please move utcNow() to a parameter default value or compute the timestamp at runtime.
kindly do changes in respective file (PLaybook) and then repackage solution.

Thanks!

Radargoger · 2026-04-08T12:26:00Z

Hi v-maheshbh (@v-maheshbh) ,

Thanks for pointing this out.

I’ve updated the playbook accordingly by moving the utcNow() usage to a parameter default value as required. The solution has been repackaged with these changes.

Could you please review and let me know if everything looks good on your side?

Thanks!
Burak

v-maheshbh (v-maheshbh) · 2026-04-09T10:47:09Z

Hi v-maheshbh (@v-maheshbh) ,

Thanks for pointing this out.

I’ve updated the playbook accordingly by moving the utcNow() usage to a parameter default value as required. The solution has been repackaged with these changes.

Could you please review and let me know if everything looks good on your side?

Thanks! Burak

Kindly check — I do not see any changes related to replacing utcNow() usage with a parameter in main template.

Thanks!

- Added SOCRadar Solution Data and Metadata - Added SOCRadar Hunting Queries (Alarm Trends, Audit Analysis, etc.) - Added SOCRadar Playbooks for Alarm Import and Sync - Added SOCRadar Dashboard Workbook and Preview Images - Updated WorkbooksMetadata.json with SOCRadar details

Radargoger · 2026-04-16T07:20:50Z

Hi v-maheshbh (@v-maheshbh) ,

Thank you for support.

All your suggestion is done. Please help us to proceed.

You are right; my previous push didn't include the repackaged mainTemplate.json. I apologize for the confusion.

Thank you for your time and guidance! Best.
Burak GOGER
Senior Product Manager
Enterprise API & Integration Team Lead

v-maheshbh (v-maheshbh) · 2026-04-16T09:33:20Z

Hi Radargoger

ARM TTK validation indicates that the uri contains a hard‑coded management endpoint. To comply with best practices, please create a variable for the management base URL, for example:
"management": "[concat('https://management','.azure','.com/')]

Thanks!

v-maheshbh (v-maheshbh) · 2026-04-17T03:59:46Z

Hi Radargoger

kindly check below link.
and Please upload custom sample data to test the playbook and hunting queries, or attach relevant testing screenshots for verification.
https://github.com/Azure/Azure-Sentinel/tree/master/Sample%20Data/Custom Thanks!
Kindly update the above link

Thanks!

Radargoger · 2026-04-17T07:46:16Z

Hi v-maheshbh (@v-maheshbh)

Thank you for support.

We updated PR about ARM TTK feedback.
Please help us to proceed.
Best Regards.
Burak

Inline role definition GUIDs in mainTemplate.json instead of using intermediate variables, ensuring subscriptionResourceId calls reference the correct IDs. Update Logic App/Playbook HTTP action expressions to use @{...} expression syntax and correct incident PUT URI to reference items('For_Each_Incident')?['name'] properly. Also update packaged 3.0.0.zip and adjust ReleaseNotes.md table formatting.

v-maheshbh (v-maheshbh) · 2026-04-17T09:27:19Z

Hi Radargoger
kindly update link https://socradar.io/support

Thanks!

Radargoger · 2026-04-20T06:30:47Z

Hi v-maheshbh (@v-maheshbh) ,

We updated the documentation link.
Please help us to proceed.

Kind Regards
Burak

mismatch in main template

Add new Logos/socradar.svg vector asset. The file contains the SOC Radar wordmark and an accent mark (primary fill #1B1B3C and accent #FF4562) with viewBox 0 0 1583 420 for scalable branding usage.

v-maheshbh (v-maheshbh) · 2026-04-21T06:23:48Z

Hi Radargoger

Below mentioned playbook not visible on content hub kindly check metadata section.

Thanks!

Radargoger · 2026-04-22T08:40:00Z

Hi v-maheshbh (@v-maheshbh) ,

We resolved the mentioned playbook issue
Please help us to proceed.

Kind Regards
Burak

v-maheshbh (v-maheshbh) · 2026-04-22T10:17:17Z

Hi Radargoger
Kindly resolve branch conflict.

Thanks!

Radargoger · 2026-04-22T21:19:15Z

Hi v-maheshbh (@v-maheshbh) ,

We resolved the conflict.
Please help us to proceed.

Kind Regards
Burak

Radargoger requested review from a team as code owners March 19, 2026 02:36

Radargoger mentioned this pull request Mar 19, 2026

SOCRadar-Solution #13628

Closed

Radargoger requested a review from a team as a code owner March 19, 2026 08:21

v-shukore assigned v-maheshbh (v-maheshbh) Mar 20, 2026

v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Mar 20, 2026

Radargoger commented Mar 22, 2026

View reviewed changes

Radargoger added 3 commits April 11, 2026 21:08

update WorkbooksMetadata.json

dd4a169

Add SOCRadar custom table schemas and logo for validation

1a69e43

Radargoger force-pushed the master branch from 2c4416e to 91f0605 Compare April 16, 2026 07:17

Merge branch 'Azure:master' into master

15c4d33

arm ttk updates

431dc87

Radargoger added 5 commits April 18, 2026 12:05

Merge branch 'Azure:master' into master

031d66d

Update SolutionMetadata.json

420c8e7

Update mainTemplate.json

a609401

Update SolutionMetadata.json

39504c6

Merge branch 'Azure:master' into master

daca6fe

v-maheshbh (v-maheshbh) added 2 commits April 20, 2026 18:30

Update SOCRadar 3.0.0 package zip

dacc4bc

mismatch in main template

Add socradar logo SVG

16e5836

Add new Logos/socradar.svg vector asset. The file contains the SOC Radar wordmark and an accent mark (primary fill #1B1B3C and accent #FF4562) with viewBox 0 0 1583 420 for scalable branding usage.

Radargoger added 2 commits April 22, 2026 11:35

Merge branch 'Azure:master' into master

206173d

mentioned playbook issue

edcb085

Merge branch 'master' into master

e45c47e

v-maheshbh (v-maheshbh) approved these changes Apr 23, 2026

View reviewed changes

v-atulyadav approved these changes Apr 23, 2026

View reviewed changes

v-dvedak approved these changes Apr 23, 2026

View reviewed changes

v-dvedak merged commit 0661aec into Azure:master Apr 23, 2026
36 checks passed

rvoloshi mentioned this pull request May 10, 2026

Akamai Guardicore Solution v3.1.0 #14225

Merged

Radargoger mentioned this pull request Jun 19, 2026

SOCRadar Alerts solution v3.0.1 #14522

Merged

Uh oh!

Conversation

Radargoger commented Mar 19, 2026

Description

Key Components Included:

Validation

Screenshots

Uh oh!

Radargoger commented Mar 19, 2026

Uh oh!

Radargoger commented Mar 19, 2026

Uh oh!

Radargoger commented Mar 19, 2026

Uh oh!

Radargoger commented Mar 22, 2026

Uh oh!

Radargoger left a comment

Choose a reason for hiding this comment

Uh oh!

Radargoger commented Mar 22, 2026

Uh oh!

Radargoger commented Mar 23, 2026

Uh oh!

Radargoger commented Mar 24, 2026

Uh oh!

Radargoger commented Mar 26, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Mar 27, 2026

Uh oh!

Radargoger commented Mar 27, 2026

Uh oh!

Radargoger commented Mar 28, 2026

Uh oh!

Radargoger commented Mar 30, 2026

Uh oh!

Radargoger commented Apr 2, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Radargoger commented Apr 3, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Radargoger commented Apr 8, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 9, 2026

Uh oh!

Radargoger commented Apr 16, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 16, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 17, 2026

Uh oh!

Radargoger commented Apr 17, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 17, 2026

Uh oh!

Radargoger commented Apr 20, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 21, 2026

Uh oh!

Radargoger commented Apr 22, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Apr 22, 2026

Uh oh!

Radargoger commented Apr 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

v-maheshbh (v-maheshbh) commented Apr 2, 2026 •

edited

Loading

v-maheshbh (v-maheshbh) commented Apr 7, 2026 •

edited

Loading