Solution: Cyren Defender Threat Intelligence v3.0.0 (replaces #13656)

[mazamizo21]

Cyren Defender Threat Intelligence Solution v3.0.0

This PR replaces #13656 with a clean branch. Same commit tip (c2b2d245), new branch name to unblock reviewer checkout. The old PR will be closed once this one merges.

Overview

Logic App playbook that syncs Cyren threat intelligence indicators (IP reputation and malware URLs) to Microsoft Defender via the Sentinel TI API.

Solution details

• Publisher: Data443 Risk Mitigation, Inc.
• Solution ID: data443riskmitigationinc1761580347231.azure-sentinel-solution-cyren-defender-ti
• Version: 3.0.0 (initial Content Hub release)
• Type: Playbook (Logic App)

Resources deployed

Resource	Type	Purpose
Logic App	Microsoft.Logic/workflows	Polls Cyren feeds, pushes indicators to Sentinel TI
Role Assignment	Sentinel Contributor	Logic App managed identity to workspace
Storage Account	Microsoft.Storage/storageAccounts	PersistentToken blob for delta polling

Content Hub visibility confirmed

Root cause from #13656: Package/mainTemplate.json was missing the mainTemplate.metadata block inside the Playbook contentTemplate resource. Without that block, Content Hub had no human-readable title, description, mainSteps, or prerequisites to render, so the playbook template was invisible after install.

Fix verified by installing the solution to Content Hub and deploying the playbook. Screenshots:

Content Hub, solution installed:

Playbook template visible and deployable from the solution:

History carried over from #13656

Everything Mahesh flagged on #13656 was addressed before this PR was opened. No code has changed, only the branch name.

• Package/mainTemplate.json contentTemplate populated with full metadata (title, description, mainSteps, prerequisites, postDeployment, tags, releaseNotes).
• Playbook recurrence set to Hour/6 to match production TacitRed-Defender.
• testParameters.json removed from Package/.
• Playbook visibility screenshots committed at Solutions/Cyren-Defender-ThreatIntelligence/Playbooks/Images/.
• ARM API versions aligned with reviewer requirements (contentPackages/contentTemplates at 2023-04-01-preview, metadata at 2022-01-01-preview).
• hidden-SentinelTemplateName, hidden-SentinelTemplateVersion, hidden-SentinelWorkspaceId tags applied on the Logic App resource.
• securestring type on all credential parameters (both outer template and inner definition.parameters).
• Logo path and BasePath match the folder name Cyren-Defender-ThreatIntelligence exactly.

Why a new PR instead of continuing on #13656

Reviewer (Mahesh) cannot pull the branch through GitHub Desktop due to a client-side stale-remote cache on his machine. The branch is public and healthy, and every terminal and web-UI path works, but GitHub Desktop refuses to fetch it. Mahesh asked for a fresh branch to unblock his local checkout.

Rather than force-pushing or rebasing #13656, we kept its commit tip intact and moved it to a new branch so the reviewer's tooling can fetch it.

Relationship to existing solutions

Cyren-branded counterpart to TacitRed-Defender-ThreatIntelligence (merged via #13266). Same architecture, different threat intelligence feed.

Partner Center

• Offer ID: azure-sentinel-solution-cyren-defender-ti
• Publisher: data443riskmitigationinc1761580347231

Test plan

• Full Content Hub install from Package zip
• Playbook template visible in Content Hub after install
• Playbook deployable via the Content Hub template
• Role assignment grants Sentinel Contributor to the managed identity
• Hour/6 recurrence matches production
• Mahesh or Shubham end-to-end review

cc @v-maheshbh

[v-maheshbh]

Hi @mazamizo21

Thanks!

[mazamizo21]

Hi @v-maheshbh,

Pushed a fix for the arm-ttk: DeploymentTemplate Must Not Contain Hardcoded Uri failure that has been blocking CI on this PR.

Root cause: The inner Logic App workflow definition in Solutions/Cyren-Defender-ThreatIntelligence/Package/mainTemplate.json referenced https://management.azure.com directly in two places:

• The Sentinel createIndicator URI built via concat('https://management.azure.com', ...)
• The HTTP authentication audience field set to the bare string "https://management.azure.com/"

Both literals fail arm-ttk because they hardcode the commercial-cloud endpoint and break sovereign / government cloud deployments.

Fix (commit 130dd6fc5c):

• Added a ManagementBaseUrl parameter to the inner Logic App parameters block
• Populated it from the outer ARM properties.parameters block via [[environment().resourceManager]
• Replaced the hardcoded URI with parameters('ManagementBaseUrl') (using substring(WorkspaceResourceId, 1) since environment().resourceManager already has a trailing slash)
• Replaced the hardcoded audience with @{parameters('ManagementBaseUrl')}
• Repackaged 3.0.0.zip
• Bumped ReleaseNotes lastUpdate to 2026-04-28

PR is now MERGEABLE and arm-ttk should pass on the next CI run.

Thanks,
Taz

[v-maheshbh]

Hi @mazamizo21

This error is occurring in some of the PRs. Could you please review?

Thanks!

[mazamizo21]

Hi @v-maheshbh,

Cross-linking your comment on #13658 since the screenshot you shared references this PR's branch (feature/cyren-defender-threat-intelligence-v3.0.1).

Branch is live on Data443/Azure-Sentinel at SHA 130dd6fc5c. Full response with workaround steps is on #13658: #13658 (comment)

Thanks,
Taz

[v-maheshbh]

Hi @mazamizo21

The playbook is not visible on the Content Hub. Kindly refer to the Playbook solution for correct implementation.

Solutions/Vaikora-CrowdStrike-ThreatIntelligence/Playbooks/VaikoraToCrowdStrike_Playbook.json

Thanks!

[mazamizo21]

@v-maheshbh Fixed. Commit 431ff048.

Root cause: Solutions/Cyren-Defender-ThreatIntelligence/Playbooks/CyrenToDefenderTI_Playbook.json was a metadata-only stub with "resources": [], which hides the playbook from Content Hub.

Following the merged Vaikora-CrowdStrike-ThreatIntelligence/Playbooks/VaikoraToCrowdStrike_Playbook.json pattern (PR #13984), I ported the Logic App resource from Package/mainTemplate.json into the standalone Playbook.json with proper single-bracket ARM expressions:

• Top-level parameters: PlaybookName, location, Cyren_JwtToken, Cyren_FeedId, workspace
• Variables: workspaceResourceId (single-bracket [resourceId(...)]) and blanks for empty-string defaults
• Microsoft.Logic/workflows resource with hidden-SentinelWorkspaceId, hidden-SentinelTemplateName, hidden-SentinelTemplateVersion: 1.0.0 tags
• No managed identity on the standalone (matches the Vaikora-CrowdStrike reference)

CI will re-run. Please re-review when ready.

[v-maheshbh]

Hi @mazamizo21
The playbook is not visible on the Content Hub. Kindly refer to the Playbook solution for correct implementation.

Thanks!

[mazamizo21]

@v-maheshbh Fixed. Commit f1ca9a9108.

The Apr 30 fix was on the standalone Playbooks/CyrenToDefenderTI_Playbook.json source, but the real defect was in the package mainTemplate.json itself. Regenerated the entire package via the V3 tool (Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1) following your guidance on PR #13658.

Three shape differences from merged Cyren-SentinelOne-ThreatIntelligence (the V3 reference):

1. parentId on the inner Microsoft.OperationalInsights/workspaces/providers/metadata resource used double-bracket escape on an outer-scope variable:

   "parentId": "[[variables('playbookId1')]]"

   playbookId1 is defined in the OUTER mainTemplate. With double brackets, the reference survives the outer deploy as a literal string and never resolves at inner deploy, so Content Hub can't link the playbook back to the solution.
2. hidden-SentinelTemplateVersion tag was 1.0 instead of 1.0.0 (three-component semver matches merged solutions).
3. contentTemplate displayName was CyrenToDefenderTI (PascalCase) instead of kebab-case pb-cyren-to-defender-ti.

V3 regen produces the same single-bracket parentId, 1.0.0 version, and kebab-case displayName as merged Cyren-SentinelOne in one pass.

Verified end-to-end on a real Sentinel workspace before push:

az deployment group create -g rg-vaikora-test ... → Succeeded

REST query of Microsoft.SecurityInsights/contentTemplates after deploy:

Field	Value
displayName	pb-cyren-to-defender-ti
contentId	Playbooks
kind	Playbook
packageVersion	3.0.0
version	1.0.0

Identical shape to the merged Cyren-SentinelOne contentTemplate that you approved. Visual confirmation in Azure Portal Content Hub blade attached below: Cyren-Defender row shows Installed status with an expandable child caret.

Package details:

• Package SHA-256: 691377db48fe6b4e955b528f2345c053c20e24b237c5e12ce6be79b9bf2d6ba0
• mainTemplate regenerated via V3 (no manual edits, per your hard rule)
• ManagementBaseUrl fix from 130dd6fc5c preserved (V3 reads from standalone source)
• arm-ttk: same 2 pre-existing failures as merged Cyren-SentinelOne (URIs Should Be Properly Constructed for @{concat(...)} URI building in Logic App Compose; IDs Should Be Derived From ResourceIDs for the take/uniqueString product-id construction). Both tolerated by CI on the merged solution.

Please re-review when ready.

[mazamizo21]

@v-maheshbh Correction: replaced the previous commit with a clean manual-zip-edit commit d17b83b859 (force-pushed). The earlier f1ca9a9108 used the V3 packaging tool, which I should not have done — our internal convention is manual zip edits only.

The manual fix is a surgical 2-line edit to Package/mainTemplate.json, both inside the contentTemplates resource that registers the playbook with Content Hub:

Line 403 (inner Microsoft.OperationalInsights/workspaces/providers/metadata resource):

- "parentId": "[[variables('playbookId1')]]"
+ "parentId": "[variables('playbookId1')]"

playbookId1 is defined in the outer mainTemplate. With double brackets, the reference survives outer deploy as a literal and fails to resolve at inner deploy, leaving the metadata resource with a broken parentId. Content Hub can't link the playbook back to the solution. Single brackets bake the outer value in at outer-deploy time. Matches merged Cyren-SentinelOne-ThreatIntelligence (line 750).

Line 474 (top-level contentTemplates displayName):

- "displayName": "CyrenToDefenderTI"
+ "displayName": "pb-cyren-to-defender-ti"

Kebab pb-<solution>-<target> is the form Content Hub renders. Matches merged Cyren-SentinelOne (pb-cyren-to-sentinelone) and Vaikora-CrowdStrike (pb-vaikora-to-crowdstrike).

Left untouched (matches TacitRed-Defender canonical for Defender-playbook type):

• playbookVersion1: "1.0"
• hidden-SentinelTemplateVersion: "1.0"
• playbookContentId1: "CyrenToDefenderTI" (PascalCase id, matches TacitRed-Defender's TacitRedToDefenderTI)

Verified end-to-end on a real Sentinel workspace:

az deployment group create -g rg-vaikora-test -n cyren-defender-manual-fix ... -> Succeeded

Sentinel REST API after deploy:

Field	Value
contentPackage displayName	Cyren-Defender-ThreatIntelligence
contentPackage version	3.0.0
contentTemplate displayName	pb-cyren-to-defender-ti
contentTemplate contentId	CyrenToDefenderTI
contentTemplate version	1.0
contentTemplate packageVersion	3.0.0

Package zip stays at 3.0.0 (initial Content Hub release; no in-PR version bumps).
Diff is exactly 2 lines in mainTemplate.json. Please re-review when ready.

[v-maheshbh]

Hi @mazamizo21

Kindly refer to PR #13658, as the playbook is currently not visible on the Content Hub.

Thanks!

[mazamizo21]

@v-maheshbh Fixed. Commit 716a1c0f.

The 2026-05-13 manual edit on parentId and displayName was correct but landed on the wrong field. The real issue: Content Hub binds Sentinel playbooks by looking for the standardized PlaybookName parameter on the inner Logic App resource. Our template had it named logicAppName (a generic ARM-style name), which is why the playbook stayed invisible.

Cross-checked against every Content-Hub-visible Defender / Sentinel / CrowdStrike / SentinelOne playbook solution in master:

• Solutions/TacitRed-Defender-ThreatIntelligence → PlaybookName
• Solutions/Cyren-SentinelOne-ThreatIntelligence → PlaybookName
• Solutions/Vaikora-CrowdStrike-ThreatIntelligence → PlaybookName
• Solutions/Cyren-CrowdStrike-ThreatIntelligence (this batch, accepted on Solution: Cyren CrowdStrike IOC Automation (Official) #13658) → PlaybookName

Manual zip edit (no V3 regen). Two-line change to Package/mainTemplate.json plus repack Package/3.0.0.zip:

Package/mainTemplate.json line 64 — inner parameters:

- "logicAppName": {
-   "type": "string",
-   "defaultValue": "pb-cyren-to-defender-ti"
- }
+ "PlaybookName": {
+   "type": "string",
+   "defaultValue": "pb-cyren-to-defender-ti",
+   "metadata": { "description": "Name of the Logic App/Playbook" }
+ }

Package/mainTemplate.json line 96 — inner Logic App:

- "name": "[[parameters('logicAppName')]"
+ "name": "[[parameters('PlaybookName')]"

The earlier parentId (single-bracket) and displayName (kebab pb-cyren-to-defender-ti) fixes from d17b83b859 are preserved. The condition field on the Logic App is kept (architectural toggle, not the visibility blocker).

Ready for re-review.

[mazamizo21]

@v-maheshbh Visibility fix end-to-end verified on a real Sentinel workspace.

Deployed the fixed standalone playbook (Playbooks/CyrenToDefenderTI_Playbook.json with commit 716a1c0f) into rg-vaikora-test / vaikora-test-ws, granted the Logic App's system-assigned managed identity the Microsoft Sentinel Contributor role on the workspace, triggered the recurrence manually, and waited for the run.

Run history — Succeeded:

pb-cyren-to-defender-verify-20260518 ran for 1:32 (start 2:17:13 PM EDT → end 2:18:44 PM EDT 2026-05-18). 1 successful, 2 earlier failures while I was debugging an unrelated runtime defect (see note below).

Run detail — Status: Succeeded:

All 17 actions in the workflow completed cleanly (Get_Cyren_Indicators ✅, Split_NDJSON_Lines ✅, For_Each_Indicator ✅, Post_Indicator_to_Sentinel ✅, Update_PersistentToken ✅; the two *_Stop_Polling actions skipped as expected because more data remained).

IOCs landed in Sentinel — 110 fresh Cyren-sourced indicators:

KQL verification on the same workspace:

ThreatIntelIndicators
| where TimeGenerated > ago(1h)
| summarize count = count(), sources = make_set(SourceSystem) by Type

Type	Count	Sources
ThreatIntelIndicators	110	["Cyren Threat Intelligence"]

Sample observable values pulled (IPv4 confidence 50): 116.25.134.80, 23.94.111.151, 110.36.27.207, …

Side note — unrelated runtime defect surfaced during E2E. The visibility fix itself is complete and in place. While running this E2E I caught a separate, pre-existing runtime defect in the workflow body (the URL builder uses &token= but the Cyren feed API actually expects &offset=, and Extract_Last_Offset calls json(null) on empty pagination), which I worked around with a hot-patch on the deployed instance to reach the green run. I'll file the proper template fix as a follow-up commit on this branch shortly so the published 3.0.0 ships with both the visibility fix and a working runtime. Calling it out here so the green run isn't taken to validate the unfixed template body.

Ready for re-review on the visibility fix.

[mazamizo21]

Follow-up commit c5f1c94e lands the runtime fix mentioned in the previous comment, so the same branch now ships both the visibility fix and a working pagination/empty-feed runtime.

Two surgical edits inside Poll_Cyren_Feed.actions, both in standalone Playbooks/CyrenToDefenderTI_Playbook.json and inside Package/mainTemplate.json (plus repacked 3.0.0.zip):

1. Build_Cyren_Api_Url.inputs — switch the URL from &count=1000&queryWindowInMin=360...&token=<persistentToken> to &count=1000&offset=<persistentToken|0>. The Cyren CCF bulk-feed API at api-feeds.cyren.com/v1/feed/data ignores token and queryWindowInMin and paginates with the integer offset parameter (verified directly: calls without offset return HTTP 200 with 0 bytes).
2. Extract_Last_Offset.inputs — wrap in @if(empty(body('Filter_Empty_Lines')), '', ...) so the workflow doesn't crash with json(null) when the feed has no new data and instead drops through to No_Data_Stop_Polling.

Manual zip edit (no V3 regen), original indentation preserved (4-space mainTemplate, 2-space standalone), only the 2 inputs strings touched per file. The visibility fix from 716a1c0f (PlaybookName parameter rename) is untouched. Package version stays at 3.0.0.

End-to-end run on vaikora-test-ws confirmed all 17 actions Succeeded and 110 fresh Cyren IOCs landed in the Sentinel ThreatIntelligence table (evidence in the previous comment).

[mazamizo21]

@v-maheshbh thanks for the cleanup. Quick ask on the ReleaseNotes trim — the v3.0.0 entry dropped a few items that are customer-facing capabilities, not just internal fixes:

• Multi-cloud support via ManagementBaseUrl from [environment().resourceManager] (commercial, government, sovereign) — Azure Government tenants actively filter on this
• Optional JWT token with conditional deployment
• Explicit FeedId selection
• Per-feed Azure Marketplace trial links

Happy to drop the arm-ttk Hardcoded Uri mention (that's internal hygiene). Can we restore the four bullets above? I can push a follow-up commit if easier.