Add DentiSystems Sentinel Solution by Sadman-TheDentian · Pull Request #14965 · Azure/Azure-Sentinel

MD Sadman Shovik (Sadman-TheDentian) · 2026-08-23T20:32:24Z

Required items, please complete

Change(s):      
                                 
- Added the official DentiSystems Active  Deception integration solution package, including Data Connectors, Analytic Rules, Workbooks, and  ASIM Parsers.                                      
                                                 
Reason for Change(s):  
                      
- New Partner Solution integration for DentiSystems (DentiGrid & GATE telemetry).         

Version Updated:

- Yes (Initial Release 1.0.0)

Testing Completed:

 - Yes (KQL and ARM template schema validated successfully in isolated Sentinel workspace).      

Checked that the validations are passing and have addressed any issues that are present: - Yes

MD Sadman Shovik (Sadman-TheDentian) · 2026-08-23T20:35:34Z

@microsoft-github-policy-service agree company="DentiSystems"

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds the initial DentiSystems Microsoft Sentinel solution package (v1.0.0) including an ARM deployment template, UI definition, solution metadata, and packaged security content for DentiGrid & GATE telemetry.

Changes:

Added ARM mainTemplate.json (and packaged copy) deploying the CCP REST API poller data connector, 4 scheduled analytics rules, a workbook, and saved searches for hunting/ASIM normalization.
Added solution documentation and artifacts (workbook JSON, analytic rule JSONs, hunting queries JSON, parser KQL, connector metadata).
Added a Python helper script to generate/emit the solution template and content files.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Solutions/DentiSystems/mainTemplate.json	Primary ARM template for deploying solution resources into a Sentinel-enabled workspace.
Solutions/DentiSystems/generate_templates.py	Local generator script intended to emit templates/content files for the solution package.
Solutions/DentiSystems/createUiDefinition.json	Azure Portal wizard UI definition for collecting workspace and API parameters.
Solutions/DentiSystems/Workbooks/DentiSystems_ThreatOverview.json	Workbook definition used by the solution for visualization.
Solutions/DentiSystems/SolutionMetadata.json	Solution manifest metadata (publisher, categories, version, package counts).
Solutions/DentiSystems/README.md	Solution documentation (architecture, contents, deployment steps, schema).
Solutions/DentiSystems/Parsers/DentiSystems_ASIM_Parser.kql	ASIM normalization parser KQL content (intended function body).
Solutions/DentiSystems/Package/mainTemplate.json	Packaged copy of the primary ARM template (for Content Hub packaging).
Solutions/DentiSystems/Package/createUiDefinition.json	Packaged copy of the Azure Portal wizard UI definition.
Solutions/DentiSystems/Package/README.md	Packaged copy of the solution documentation.
Solutions/DentiSystems/HuntingQueries/DentiSystems_HuntingQueries.json	Two hunting queries shipped with the solution.
Solutions/DentiSystems/DataConnectors/DentiSystems_CCP.json	Data connector metadata artifact for the package.
Solutions/DentiSystems/AnalyticRules/DentiSystems_VolumetricRecon.json	Scheduled analytic rule for volumetric recon detection.
Solutions/DentiSystems/AnalyticRules/DentiSystems_SCADA_Tamper.json	Scheduled analytic rule for ICS/BMS protocol tampering detection.
Solutions/DentiSystems/AnalyticRules/DentiSystems_HighSeverityBreach.json	Scheduled analytic rule for high-severity honeypot breach detection.
Solutions/DentiSystems/AnalyticRules/DentiSystems_GATE_ThreatIntercept.json	Scheduled analytic rule for GATE injection/threat interception detection.

Suppressed comments (1)

Solutions/DentiSystems/Package/createUiDefinition.json:1

Same issue as the non-packaged createUiDefinition.json: steps('basics') is invalid because "basics" isn’t a step. Update to use basics('workspace') for workspace name/location so the packaged UI definition deploys successfully.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    "outputs": {
+      "workspace": "[steps('basics').workspace.name]",
+      "workspaceLocation": "[steps('basics').workspace.location]",
+      "location": "[steps('basics').workspace.location]",
+      "dentiSystemsApiEndpoint": "[steps('dentiSystemsConfig').apiEndpoint]",
+      "dentiSystemsApiKey": "[steps('dentiSystemsConfig').apiKey]",
+      "enableDataConnector": "[steps('dentiSystemsConfig').enableDataConnector]",
+      "enableAnalyticRules": "[steps('securityContent').enableAnalyticRules]",
+      "enableWorkbooks": "[steps('securityContent').enableWorkbooks]",
+      "enableHuntingQueries": "[steps('securityContent').enableHuntingQueries]"
+    }


+azure_sentinel_dir = "/home/sadmanthedentian/Documents/DENTISYSTEMS/Azure-Sentinel"
+package_dir = os.path.join(azure_sentinel_dir, "Package")
+connectors_dir = os.path.join(azure_sentinel_dir, "DataConnectors")
+rules_dir = os.path.join(azure_sentinel_dir, "AnalyticRules")
+workbooks_dir = os.path.join(azure_sentinel_dir, "Workbooks")
+hunting_dir = os.path.join(azure_sentinel_dir, "HuntingQueries")
+parsers_dir = os.path.join(azure_sentinel_dir, "Parsers")
+
+for d in [azure_sentinel_dir, package_dir, connectors_dir, rules_dir, workbooks_dir, hunting_dir, parsers_dir]:
+    os.makedirs(d, exist_ok=True)


+for filepath, content in files_to_write.items():
+    with open(filepath, "w", encoding="utf-8") as f:
+        json.dump(content, f, indent=2)
+    print(f"Wrote {filepath} ({os.path.getsize(filepath)} bytes)")


+DENTIGRIDThreats_CL
+| extend EventVendor = 'DentiSystems', EventProduct = 'DentiGrid', EventProductVersion = '1.0'


…tputs, wrap ASIM KQL parser view, and refine generate_templates

…idations

…pilot review

…Validations

@@ -0,0 +1,36 @@
+import json


v-maheshbh (v-maheshbh) · 2026-08-31T05:51:38Z

Hi MD Sadman Shovik (@Sadman-TheDentian)

Invalid domains: [Security - Deception & Honeypots] verticals: [Critical Infrastructure, PropTech & Smart Buildings, Enterprise Security] provided.

Kindly refer to the below solution as a reference for the analytical rule and CCF connector folder structure

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF

Thanks!

v-maheshbh (v-maheshbh) · 2026-09-09T09:11:19Z

Hi MD Sadman Shovik (@Sadman-TheDentian)

Kindly review above comments.

Thanks!

v-maheshbh (v-maheshbh) · 2026-09-18T05:22:57Z

Hi MD Sadman Shovik (@Sadman-TheDentian)

Kindly review above comments.

Thanks!

Add DentiSystems Sentinel Solution

6fe1f65

MD Sadman Shovik (Sadman-TheDentian) requested review from a team as code owners August 23, 2026 20:32

v-maheshbh (v-maheshbh) requested a lite review from Copilot August 24, 2026 06:49

v-maheshbh (v-maheshbh) self-assigned this Aug 24, 2026

v-maheshbh (v-maheshbh) added the New Solution For new Solutions which are new to Microsoft Sentinel label Aug 24, 2026

Copilot AI reviewed Aug 24, 2026

View reviewed changes

MD Sadman Shovik (Sadman-TheDentian) added 19 commits August 24, 2026 17:18

Fix Copilot code review feedback: update createUiDefinition basics ou…

7fb3c92

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

7bd085c

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

0fa036e

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

bd1a504

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

133fa21

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

e544ec9

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

56a8da9

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

4f11787

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

79ce360

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

afe692e

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

aac8f0e

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

129a9e8

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

d0ca168

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

a1801d3

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

0c4dcd0

…tputs, wrap ASIM KQL parser view, and refine generate_templates

Fix Copilot code review feedback: update createUiDefinition basics ou…

d0a141a

…tputs, wrap ASIM KQL parser view, and refine generate_templates

fix(sentinel): wrap ASIM KQL parser in view () declaration for KqlVal…

a1556af

…idations

fix(sentinel): wrap generate_templates.py in __main__ guard to fix Co…

915435f

…pilot review

fix(sentinel): update SolutionMetadata.json taxonomy to pass Solution…

5cb2e20

…Validations

github-advanced-security Bot found potential problems Aug 27, 2026

View reviewed changes

Comment thread Solutions/DentiSystems/generate_templates.py

@@ -0,0 +1,36 @@

import json

Navigation Menu

Add DentiSystems Sentinel Solution - #14965

Add DentiSystems Sentinel Solution#14965
MD Sadman Shovik (Sadman-TheDentian) wants to merge 20 commits into
Azure:masterfrom
dectrax-security:feature/dentisystems-solution

MD Sadman Shovik (Sadman-TheDentian) commented Aug 23, 2026 •

edited

Loading

Uh oh!

MD Sadman Shovik (Sadman-TheDentian) commented Aug 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

v-maheshbh (v-maheshbh) commented Aug 31, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Sep 9, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		DENTIGRIDThreats_CL
		\| extend EventVendor = 'DentiSystems', EventProduct = 'DentiGrid', EventProductVersion = '1.0'

Conversation

MD Sadman Shovik (Sadman-TheDentian) commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MD Sadman Shovik (Sadman-TheDentian) commented Aug 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

v-maheshbh (v-maheshbh) commented Aug 31, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Sep 9, 2026

Uh oh!

v-maheshbh (v-maheshbh) commented Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MD Sadman Shovik (Sadman-TheDentian) commented Aug 23, 2026 •

edited

Loading