Skip to content

Conversation

@grubmeshi
Copy link

Change(s):

  • Add connector for Azure Sentinel reading meshStack event logs into the an Azure Sentinel enabled LAW.

Reason for Change(s):

  • Vertical/seamless integration of our meshStack product into Azure Sentinel.

Testing Completed:

  • Tested with newly created LAW with Sentinel enabled.
  • Connector works successfuly with meshStack demo instance.
  • LAW is filled with events from meshStack product.

Checked that the validations are passing and have addressed any issues that are present:

  • Installation of manually crafted mainTemplate.json works. Automatic packaging is TODO.

@grubmeshi grubmeshi requested review from a team as code owners December 16, 2025 07:56
@grubmeshi
Copy link
Author

@microsoft-github-policy-service agree company="meshcloud GmbH"

@v-shukore v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Dec 16, 2025
@v-shukore v-shukore assigned v-shukore and unassigned v-maheshbh Dec 16, 2025
@v-shukore
Copy link
Contributor

Hi @grubmeshi, please review the error message regarding the logo validation failure and address it. Additionally, you need to generate the package with version 3.0.0, so please repackage the solution using the V3 tool - https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.….
Thanks!

this assumes that the Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1
is run with the repo root as working directory
local command from repo root (on Linux machine):
$ pwsh Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 -SolutionDataFolderPath ./Solutions/meshStack/Data
@grubmeshi grubmeshi force-pushed the add-meshstack-solution branch from 977000f to 7ef270d Compare January 2, 2026 15:52
@grubmeshi grubmeshi requested review from v-shukore January 2, 2026 15:54
@grubmeshi
Copy link
Author

Hi @grubmeshi, please review the error message regarding the logo validation failure and address it. Additionally, you need to generate the package with version 3.0.0, so please repackage the solution using the V3 tool - https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…. Thanks!

@v-shukore Thanks for having a look at my changes. I've addressed them all I think. I've also successfully managed to package it on my Linux machine with a little fix to support relative basePath as I did not want to hardcode an absolute path in Solution_meshStack.json. I don't know if that will break CI or cause other problems, but the change (see separate commit) seems reasonable.

Let me know what's missing until this can be finally merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Solution For new Solutions which are new to Microsoft Sentinel

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants