[ContrastADR] - CCF Data Connector Support by shashankshah-contrast · Pull Request #13954 · Azure/Azure-Sentinel

shashankshah-contrast · 2026-03-31T07:26:56Z

Change(s):

CCF Data Connector Support
Relevant changes in parser, analytic rules
Change in Data connector UI page
Adding extra panels in 6 workbooks

Reason for Change(s):

enhancements

Version Updated:

3.1.0

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

… Contrast ADR

shashankshah-contrast · 2026-03-31T08:31:53Z

@microsoft-github-policy-service agree company="Contrast Security"

jayeshprajapaticrest · 2026-04-03T12:21:31Z

@v-shukore
Can you please review and provide updates on this PR?

v-shukore · 2026-04-07T03:13:56Z

Hi @shashankshah-contrast, could you share the screenshots of the running CCF data connector here? Also, please confirm if you want to delete the functionapp connector from the solution since you’ve added CCF and resolved the branch conflicts.
Also, please look once copilot review suggestions. Thanks!

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds ContrastADR CCF (Push) data connector support and updates solution assets (parsers, analytic rules, workbooks, metadata) to use the new custom tables and connector ID.

Changes:

Switched solution to CCF push connector and updated connector IDs / table names across rules and workbook queries.
Added workbook panels (time range parameter + table view) to surface ContrastADRAttackEvents_CL data.
Updated solution metadata/tests/sample data to recognize new custom tables and connector ID; bumped solution version to 3.1.0.

Reviewed changes

Copilot reviewed 37 out of 40 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Adds data type + connector dependencies for multiple ContrastADR workbooks.
Solutions/ContrastADR/Workbooks/ContrastADR_XML External_Entity_Injection_Injection_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for XXE events.
Solutions/ContrastADR/Workbooks/ContrastADR_Untrusted_Deserialization_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for deserialization events.
Solutions/ContrastADR/Workbooks/ContrastADR_SQL_Injection_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for SQLi events.
Solutions/ContrastADR/Workbooks/ContrastADR_Path_Traversal_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for path traversal events.
Solutions/ContrastADR/Workbooks/ContrastADR_JNDI_Injection_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for JNDI injection events.
Solutions/ContrastADR/Workbooks/ContrastADR_Command_Injection_Workbook.json	Adds time range parameter + KQL table panel querying `ContrastADRAttackEvents_CL` for command injection events.
Solutions/ContrastADR/ReleaseNotes.md	Adds a 3.1.0 release note entry for CCF connector support.
Solutions/ContrastADR/Parsers/Contrast_incident_parser.yaml	Updates incident parser to new table/column names via a `view()` definition.
Solutions/ContrastADR/Parsers/Contrast_alert_event_parser.yaml	Updates alert/event parser to new table/column names via a `view()` definition.
Solutions/ContrastADR/Package/testParameters.json	Adds parameters for RG/subscription used by deployment UI (ignored for detailed review).
Solutions/ContrastADR/Package/createUiDefinition.json	Updates UI text for the push connector (ignored for detailed review).
Solutions/ContrastADR/Data/Solution_ContrastADR.json	Updates solution data connector reference + version/base path.
Solutions/ContrastADR/Data Connectors/requirements.txt	Removes Function App requirements file (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/proxies.json	Removes proxies.json (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/host.json	Removes host.json (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/azuredeploy_ContrastADR_functionapp.json	Removes legacy Function App deployment template (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADR_API_FunctionApp.json	Removes legacy connector definition (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADRCCF/table_incidents.json	Adds incidents custom table resource (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADRCCF/table_attackevents.json	Adds attack events custom table resource (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADRCCF/dataConnector.json	Adds push data connector resource (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADRCCF/connectorDefinition.json	Adds connector definition + UI steps (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/ContrastADRCCF/DCR.json	Adds DCR for custom tables/streams (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/AzureFunctionContrastADR/function_app.py	Removes Function App ingestion code (ignored for detailed review).
Solutions/ContrastADR/Data Connectors/AzureFunctionContrastADR/function.json	Removes Function App binding config (ignored for detailed review).
Solutions/ContrastADR/Analytic Rules/Contrast_Security_ADR_incident.yaml	Updates rule to new connector/table and adjusts entity/grouping fields.
Solutions/ContrastADR/Analytic Rules/Contrast_ADR_SQL_Injection_Alert_with_DLP_alerts.yaml	Updates rule to new connector/table/field names.
Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Exploited_Attack_Event_in_Production.yaml	Updates rule to new connector/table/field names.
Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Exploited_Attack_Event.yaml	Updates rule to new connector/table/field names.
Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_WAF.yaml	Updates rule to new connector/table/field names and entity grouping.
Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_EDR.yaml	Updates rule join to new connector/table/field names.
Sample Data/Custom/ContrastADRIncidents_CL.csv	Adds sample data for incidents custom table.
Sample Data/Custom/ContrastADRAttackEvents_CL.csv	Adds sample data for attack events custom table.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Registers `ContrastADRCCF` as a valid connector ID for validation tests.
.script/tests/KqlvalidationsTests/CustomTables/ContrastADRIncidents_CL.json	Adds custom table schema for KQL validation tests.
.script/tests/KqlvalidationsTests/CustomTables/ContrastADRIncident_CL.json	Removes legacy incidents table schema for KQL validation tests.
.script/tests/KqlvalidationsTests/CustomTables/ContrastADRAttackEvents_CL.json	Adds custom table schema for KQL validation tests.

…upport

shashankshah-contrast · 2026-04-07T07:32:46Z

Hi @v-shukore

This is CCF Connector which does not have running invocation logs. So, It is not possible to provide running logs.
We are removing support of Pull based DC to CCF. Hence, we deleted the function app connector.
Resolved branch conflict and copilot suggestions.

Thanks

jayeshprajapaticrest · 2026-04-07T11:43:43Z

@v-shukore @v-atulyadav
I have a quick question and would appreciate your guidance.

Would it be okay to keep the Azure Function–based connector code in the Microsoft repository as-is? My concern is that if we remove it and the PR gets merged, existing users of this connector may face functional issues, since the data connector ZIP (referenced at runtime) would no longer be available.

My suggestion is to retain it for now and, once all users have migrated to the CCF-based connector (after it’s available in the Marketplace), I can raise another PR to either remove it or mark it as deprecated.

Please let me know your thoughts before this PR is merged, so I can revert today’s data connector removal changes if needed.

…upport

shashankshah-contrast · 2026-04-10T05:33:33Z

Hi @v-shukore
Could you please run validation checks again to check detectionvalidation failures?

v-shukore · 2026-04-14T07:10:13Z

Hi @shashankshah-contrast, validation is failing because you forgot to add a comma at the end of the line in the ValidConnectorIds.json file. Please correct it and commit the changes. Thanks!

…upport

jayeshprajapaticrest · 2026-04-14T08:40:09Z

@v-shukore
Shashank has fixed the suggested changes and committed. Can you please continue to review it?

Adding support of ccf data connector and relavent component change in…

ad77f5d

… Contrast ADR

shashankshah-contrast requested review from a team as code owners March 31, 2026 07:26

v-atulyadav added Solution Solution specialty review needed Codeless Connector Framework (CCF) Connector labels Mar 31, 2026

v-atulyadav assigned v-maheshbh Mar 31, 2026

v-maheshbh assigned v-shukore and unassigned v-maheshbh Mar 31, 2026

Resolving ARM TTK validation fails

6eb754c

v-shukore requested a review from Copilot April 7, 2026 03:14

Copilot AI reviewed Apr 7, 2026

View reviewed changes

shashankshah-contrast added 2 commits April 7, 2026 12:46

Merge https://github.com/Azure/Azure-Sentinel into Contrast-ADR-CCF-S…

6faecff

…upport

Resolving Copilot review changes

4f77dd7

shashankshah-contrast added 2 commits April 10, 2026 10:46

Merge https://github.com/Azure/Azure-Sentinel into Contrast-ADR-CCF-S…

a9292b6

…upport

Change BasePath to resolve detectiontemplate validation

c59fc3d

Revert existing data connector files

1d5f337

shashankshah-contrast added 2 commits April 14, 2026 13:10

Add comma in validconnectorIds.json

0c66c87

Merge https://github.com/Azure/Azure-Sentinel into Contrast-ADR-CCF-S…

2e50d34

…upport

v-shukore approved these changes Apr 15, 2026

View reviewed changes

v-atulyadav approved these changes Apr 15, 2026

View reviewed changes

rahul0216 approved these changes Apr 15, 2026

View reviewed changes

rahul0216 merged commit a8e7cb6 into Azure:master Apr 15, 2026
36 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ContrastADR] - CCF Data Connector Support#13954

[ContrastADR] - CCF Data Connector Support#13954
rahul0216 merged 9 commits intoAzure:masterfrom
Contrast-Security-OSS:Contrast-ADR-CCF-Support

shashankshah-contrast commented Mar 31, 2026

Uh oh!

shashankshah-contrast commented Mar 31, 2026

Uh oh!

jayeshprajapaticrest commented Apr 3, 2026

Uh oh!

v-shukore commented Apr 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shashankshah-contrast commented Apr 7, 2026

Uh oh!

jayeshprajapaticrest commented Apr 7, 2026

Uh oh!

shashankshah-contrast commented Apr 10, 2026

Uh oh!

v-shukore commented Apr 14, 2026 •

edited

Loading

Uh oh!

jayeshprajapaticrest commented Apr 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

shashankshah-contrast commented Mar 31, 2026

Uh oh!

shashankshah-contrast commented Mar 31, 2026

Uh oh!

jayeshprajapaticrest commented Apr 3, 2026

Uh oh!

v-shukore commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shashankshah-contrast commented Apr 7, 2026

Uh oh!

jayeshprajapaticrest commented Apr 7, 2026

Uh oh!

shashankshah-contrast commented Apr 10, 2026

Uh oh!

v-shukore commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jayeshprajapaticrest commented Apr 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

v-shukore commented Apr 7, 2026 •

edited

Loading

v-shukore commented Apr 14, 2026 •

edited

Loading