Add D3 Smart SOAR data connector v3.0.0 by brianbtzhong · Pull Request #13718 · Azure/Azure-Sentinel

brianbtzhong · 2026-02-27T20:26:14Z

Change(s):

New CCP (Codeless Connector Platform) data connector for D3 Smart SOAR
Polls D3 Smart SOAR incidents via RestApiPoller into D3SOARIncidents_CL custom table every 5 minutes
Includes DataConnectorDefinition, PollingConfig, DCR, and Table JSON files
Full solution package (mainTemplate.json, createUiDefinition.json, 3.0.0.zip)

Reason for Change(s):

New solution submission: enables Microsoft Sentinel customers to ingest D3 Smart SOAR incident data
Publisher: D3 Security (support@d3security.com)

Version Updated:

N/A (new solution, initial version 3.0.0)

Testing Completed:

Yes
Deployed and validated in Microsoft Sentinel workspace
Live ingestion confirmed working (~240,000+ rows ingested)
arm-ttk: 48/49 passed (1 known acceptable failure — see note below)
All package JSON files validated

Checked that the validations are passing and have addressed any issues that are present:

Yes
arm-ttk 48/49 — the single failure is IDs Should Be Derived From ResourceIDs for contentProductId and id properties. Per Tools/Create-Azure-Sentinel-Solution/V3/README.md: "If you see arm-ttk error for 'contentProductId' and 'id' for 'Ids should be derived from ResourceIds' then you can ignore this error validations."

- CCF RestApiPoller connector polling D3 Smart SOAR incidents into D3SOARIncidents_CL every 5 minutes - DCR with KQL transform mapping 19 D3 SOAR fields to clean Sentinel column names - Pagination support (Offset, page index increment) - Instruction step title and description added to connector UI - Renamed product label to "D3 Smart SOAR" throughout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add IncidentRawData and EventRawData dynamic fields via PollFromSentinel:true API parameter - Rename fields in DCR stream declaration (no-space names required by DCR) - Update DCR transformKql to map and project IncidentRawData/EventRawData - Swap package zip 3.0.0 → 3.0.1 - Add .gitignore to exclude local dev scripts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Initial release of D3 Smart SOAR Sentinel data connector - Polls incidents every 5 minutes via CCF RestApiPoller - IncidentRawData and EventRawData dynamic fields via PollFromSentinel:true - UTC-based date filtering - Solution folder: Solutions/D3SmartSOAR Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Remove .claude/settings.json and .claude/settings.local.json from tracking - Remove stale 3.0.1.zip - Add .claude/ to root .gitignore to prevent future accidents Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

brianbtzhong · 2026-02-27T20:28:51Z

@brianbtzhong please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree company="D3 Security"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… SVG - Strip UTF-8 BOM from 5 JSON files (caused ContentValidations, DataConnectorValidations, JsonFileValidation, WorkbooksTemplateValidations failures) - Remove xmlns:xlink attribute from Logos/D3SOAR.svg (caused logoValidator failure) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brianbtzhong · 2026-03-02T19:05:06Z

Issues reported have been fixed

CI logoValidator rejects SVGs with style= attributes. Removed the <style> block, metadata, and Adobe boilerplate, inlining fill colors directly as SVG attributes on each path element. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brianbtzhong · 2026-03-03T20:07:39Z

Fixed the logo issue and pushed. But the other validation failed didn't come from our solution. It's related to other solutions.

brianbtzhong · 2026-03-04T18:39:58Z

Hi @v-atulyadav @v-maheshbh, could you guys help run the workflows again?

brianbtzhong · 2026-03-05T19:53:37Z

Seems like all checks have passed. Could you let me know what's the next step? Thanks!

v-maheshbh · 2026-03-06T06:46:47Z

Hi @brianbtzhong

There is a version mismatch between the main template inside the ZIP and the one outside. Kindly repackage the solution
Please attach the testing screenshots of the CCF connector in the connected state.

Thanks!

The mainTemplate.json inside the zip still had version 3.0.2 from the packager auto-bump while the one outside was reset to 3.0.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brianbtzhong · 2026-03-06T19:03:24Z

Hi @brianbtzhong

There is a version mismatch between the main template inside the ZIP and the one outside. Kindly repackage the solution Please attach the testing screenshots of the CCF connector in the connected state.

Thanks!

Hi @v-maheshbh

I have fixed the version issue. And please kindly check the screenshot of the connector is here:

Thanks!

brianbtzhong · 2026-03-09T17:36:25Z

Hi @v-maheshbh, just a kind follow up on this PR. I have fixed the issue you mentioned. Could you let me know what's the next step for my PR, and normally how long it would take for the change to reflect on Azure after merging? Thanks!

v-maheshbh · 2026-03-10T11:56:57Z

Hi @brianbtzhong

The documentation folder is not required. Please place the README file at the root level, consistent with the release notes.

Thanks!

Per PR review feedback: Documentation folder not required, README should be at root level consistent with ReleaseNotes.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Already exists at solution root level. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Revert root .gitignore to match upstream and remove solution-level .gitignore, per PR review best practices. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brianbtzhong · 2026-03-10T18:36:30Z

Hi @brianbtzhong

The documentation folder is not required. Please place the README file at the root level, consistent with the release notes.

Thanks!

Hi @v-maheshbh , the readme has been moved to the root level. THanks!

brianbtzhong · 2026-03-11T17:41:35Z

Hi @v-maheshbh , all the checks have passed. Could you let me know what the next step would be? Thanks!

d3-kdeng · 2026-03-11T19:44:31Z

hi, @v-maheshbh could you share some information or suggest our next move? we are expecting to see the connector in Sentinel platform. Do we still need to wait the below reviewers' response before the solution can be merged? how could we reach out them? how long does this usually take? Thank you.

brianbtzhong and others added 15 commits February 18, 2026 13:50

Template added

e9013d6

save for now

397c73a

logo

777fdb4

1 test not passing

719e679

Revert. ID issue can be ignored

417fba6

Fixing small issues

b35ebd8

Remove internal session handoff doc from D3SOAR solution

73cad7e

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Changed link

8107007

Merge branch 'master' of https://github.com/brianbtzhong/Azure-Sentinel

a004436

Remove accidentally committed .claude/ settings files

beba220

- Remove .claude/settings.json and .claude/settings.local.json from tracking - Remove stale 3.0.1.zip - Add .claude/ to root .gitignore to prevent future accidents Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Removd D3SOAR

21632ba

Added description for d3 configuration

5caaab5

brianbtzhong requested review from a team as code owners February 27, 2026 20:26

Merge upstream/master and resolve .gitignore conflict

99c212c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

v-atulyadav assigned v-maheshbh Mar 2, 2026

v-atulyadav added Solution Solution specialty review needed Codeless Connector Framework (CCF) Connector labels Mar 2, 2026

brianbtzhong and others added 2 commits March 2, 2026 10:29

Fix missing space in SVG after xmlns:xlink removal

7310bb6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

v-maheshbh added New Solution For new Solutions which are new to Microsoft Sentinel and removed Solution Solution specialty review needed labels Mar 6, 2026

Fix version mismatch: repackage zip with correct 3.0.0 version

716586b

The mainTemplate.json inside the zip still had version 3.0.2 from the packager auto-bump while the one outside was reset to 3.0.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brianbtzhong and others added 3 commits March 10, 2026 10:50

Move README.md to solution root level

68c0c1e

Per PR review feedback: Documentation folder not required, README should be at root level consistent with ReleaseNotes.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove duplicate ReleaseNotes.md from Documentation folder

42831e5

Already exists at solution root level. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove unrelated .gitignore changes from PR

097f07e

Revert root .gitignore to match upstream and remove solution-level .gitignore, per PR review best practices. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

v-maheshbh approved these changes Mar 12, 2026

View reviewed changes

v-atulyadav approved these changes Mar 12, 2026

View reviewed changes

v-dvedak approved these changes Mar 12, 2026

View reviewed changes

v-dvedak merged commit ba0cd0c into Azure:master Mar 12, 2026
33 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add D3 Smart SOAR data connector v3.0.0#13718

Add D3 Smart SOAR data connector v3.0.0#13718
v-dvedak merged 23 commits into
Azure:masterfrom
DThreeDev:add-d3-smart-soar-v3

brianbtzhong commented Feb 27, 2026 •

edited

Loading

Uh oh!

brianbtzhong commented Feb 27, 2026

Uh oh!

brianbtzhong commented Mar 2, 2026

Uh oh!

brianbtzhong commented Mar 3, 2026

Uh oh!

brianbtzhong commented Mar 4, 2026

Uh oh!

brianbtzhong commented Mar 5, 2026

Uh oh!

v-maheshbh commented Mar 6, 2026 •

edited

Loading

Uh oh!

brianbtzhong commented Mar 6, 2026

Uh oh!

brianbtzhong commented Mar 9, 2026

Uh oh!

v-maheshbh commented Mar 10, 2026

Uh oh!

brianbtzhong commented Mar 10, 2026

Uh oh!

brianbtzhong commented Mar 11, 2026

Uh oh!

d3-kdeng commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

brianbtzhong commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianbtzhong commented Feb 27, 2026

Uh oh!

brianbtzhong commented Mar 2, 2026

Uh oh!

brianbtzhong commented Mar 3, 2026

Uh oh!

brianbtzhong commented Mar 4, 2026

Uh oh!

brianbtzhong commented Mar 5, 2026

Uh oh!

v-maheshbh commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianbtzhong commented Mar 6, 2026

Uh oh!

brianbtzhong commented Mar 9, 2026

Uh oh!

v-maheshbh commented Mar 10, 2026

Uh oh!

brianbtzhong commented Mar 10, 2026

Uh oh!

brianbtzhong commented Mar 11, 2026

Uh oh!

d3-kdeng commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

brianbtzhong commented Feb 27, 2026 •

edited

Loading

v-maheshbh commented Mar 6, 2026 •

edited

Loading