Fix IPinfo connectors: runtime pinning, dependency updates, and multi…

[Prasanna92Sekar]

PR Summary

• This PR focuses on improving deployment reliability and installation stability for the IPinfo data connector.

What’s included in this PR:
Change(s):

• Added missing native dependency (cffi) to ensure reliable Function App startup and publishing.
• Pinned Azure Functions runtime to v4 and verified Python 3.11 is correctly picked up during deployment.
• Standardized DCR workspace validation and creation logic across IPinfo Azure Functions to support multi-workspace deployments.
• Applied the same DCR handling logic consistently across IPinfo connectors.
• Verified end-to-end log ingestion; data ingestion has been tested and confirmed working.

Reason for Change(s):

• See guidance below

Version Updated:

• 3.0.2

Testing Completed:
-- tested log ingestion to worksapce table.

Pending / Follow-ups:
-- aka.ms short link is required for final Marketplace/Solution readiness.

What’s intentionally out of scope (next PR):

• Further enhancements to other data connector multi-workspace behavior will be handled in a follow-up PR, after validating stability in this release.

Please confirm when it’s okay to add the short link, and I’ll update it accordingly.

Guidance <- remove section before submitting

---

Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:

Thank you for your contribution to the Microsoft Sentinel Github repo.

Details of the code changes in your submitted PR. Providing descriptions for pull requests ensures there is context to changes being made and greatly enhances the code review process. Providing associated Issues that this resolves also easily connects the reason.

Change(s):

• Updated syntax for XYZ.yaml

Reason for Change(s):

• New schema used for XYZ.yaml
• Resolves ISSUE Add Logstash required version to Readme file #1234

Version updated:

• Yes
• Detections/Analytic Rule templates are required to have the version updated

The code should have been tested in a Microsoft Sentinel environment that does not have any custom parsers, functions or tables, so that you validate no incorrect syntax and execution functions properly. If your submission requires a custom parser or function, it must be submitted with the PR.

Testing Completed:

• Yes/No/Need Help

Note: If updating a detection, you must update the version field.

Before the submission has been made, please look at running the KQL and Yaml Validation Checks locally.
https://github.com/Azure/Azure-Sentinel#run-kql-validation-locally

Checked that the validations are passing and have addressed any issues that are present:

• Yes/No/Need Help

Note: Let us know if you have tried fixing the validation error and need help.

References:

• Guidance for Detection checks
• General contribution guidance
• PR validation troubleshooting

---

[Prasanna92Sekar]

Hi @v-shukore / @v-maheshbh,

Just a gentle follow-up on this PR.
The changes are now complete and ready for review.

This PR focuses on:

• Runtime pinning and dependency fixes
• Stabilizing Function App deployment
• Consistent DCR handling and multi-workspace support

I’m happy to iterate quickly on any review feedback or required changes.

Thanks!

[Prasanna92Sekar]

Hi @v-shukore @v-maheshbh,

Just following up on this PR. We're on a tight delivery timeline and this is currently blocking our marketplace publication.

Could you please review? Happy to walk through the changes if that helps speed things up.

We also have a follow-up PR with 3 new connectors ready to go, which depends on this one being merged first.

Thanks for your help!

[v-shukore]

Hi @Prasanna92Sekar,
Could you please share the running data connector screenshots for all the connectors updated in this PR?
Thanks!

[Prasanna92Sekar]

Hi @v-shukore, All 17 connectors have been tested. Attached are screenshots for 15 of them — the remaining 2 were tested but screenshots weren't captured at the time. Happy to re-run those if needed.

[ ](url)

[v-shukore]

Hi @Prasanna92Sekar, thanks for providing screenshots of running connector will review the PR and merge it. Thanks!!

[Prasanna92Sekar]

Hi @v-shukore, just a note — a reminder the aka.ms short links.
Please let us know if you need anything from our side for that.

[v-shukore]

i @Prasanna92Sekar, could you please clarify which shortlinks you would like to update? I want to make sure I’m aligned correctly. Thanks!

[Prasanna92Sekar]

Hi @v-shukore,

The shortlinks I'm referring to are the WEBSITE_RUN_FROM_PACKAGE URLs in each connector's ARM template (azuredeploy_Connector_IPinfo_*_AzureFunction.json).

Currently they point to GitHub raw URLs, for example:
https://github.com/Azure/Azure-Sentinel/raw/refs/heads/master/Solutions/IPinfo/Data%20Connectors/Abuse/IPinfoAbuseConn.zip

This is also related to the marketplace validation error we received previously:

"Please check the short-links (starting with https://aka.ms) for Azure Function App. Most of them are not working."

We need valid aka.ms shortlinks pointing to the zip packages to pass marketplace validation. Please let me know if you'll be generating these or if you need us to take any action.

[v-shukore]

Hi @Prasanna92Sekar,
Just to confirm my understanding for the 17 connectors, we should create shortlinks for the WEBSITE_RUN_FROM_PACKAGE URLs (instead of raw URLs), with each shortlink pointing to its respective connector ZIP file.

[Prasanna92Sekar]

Yes @v-shukore, that's correct! Each of the 17 connectors needs an aka.ms shortlink for its WEBSITE_RUN_FROM_PACKAGE URL, pointing to the respective ZIP file. Just a reminder to repackage the solution as well so mainTemplate.json picks up the updated links. Thanks!

[v-shukore]

Ok @Prasanna92Sekar, please create shortlinks for all 17 data connectors based on their respective names and share the shortlinks here. For Ex. https://aka.ms/sentinel-VMRay-functionapp then I will update the corresponding paths for these shortlinks from the aka.ms portal. Thanks!

[Prasanna92Sekar]

Hi @v-shukore,

Here are the proposed aka.ms shortlinks for all 17 connectors:

Abuse - https://aka.ms/sentinel-Ipinfo-Abuse-functionapp
ASN - https://aka.ms/sentinel-Ipinfo-ASN-functionapp
Carrier - https://aka.ms/sentinel-Ipinfo-Carrier-functionapp
Company - https://aka.ms/sentinel-Ipinfo-Company-functionapp
Country ASN - https://aka.ms/sentinel-Ipinfo-Country-functionapp
Domain - https://aka.ms/sentinel-Ipinfo-Domain-functionapp
Iplocation - https://aka.ms/sentinel-Ipinfo-Iplocation-functionapp
Iplocation Extended - https://aka.ms/sentinel-Ipinfo-Iplocation-Extended-functionapp
Privacy - https://aka.ms/sentinel-Ipinfo-Privacy-functionapp
Privacy Extended - https://aka.ms/sentinel-Ipinfo-Privacy-Extended-functionapp
RIRWHOIS - https://aka.ms/sentinel-Ipinfo-RIRWHOIS-functionapp
RWHOIS - https://aka.ms/sentinel-Ipinfo-RWHOIS-functionapp
WHOIS ASN - https://aka.ms/sentinel-Ipinfo-WHOIS-ASN-functionapp
WHOIS MNT - https://aka.ms/sentinel-Ipinfo-WHOIS-MNT-functionapp
WHOIS NET - https://aka.ms/sentinel-Ipinfo-WHOIS-NET-functionapp
WHOIS ORG - https://aka.ms/sentinel-Ipinfo-WHOIS-ORG-functionapp
WHOIS POC - https://aka.ms/sentinel-Ipinfo-WHOIS-POC-functionapp

Each should point to its respective connector ZIP file on the master branch. Thanks!