🧹Cleanup and rename analytic keys

[pemontto]

Required items, please complete

Change(s):

• Cleanup and rename incorrectly named analytic keys

Reason for Change(s):

• Data is invalid and can breaks rule pipelines. It looks like some of these fields came from the API or deployed rules instead of templates.

Version Updated: ✅

Testing Completed: ✅

Checked that the validations are passing and have addressed any issues that are present:

• See guidance below

[pemontto]

There are also additional (and redundant) keys in Solutions/Microsoft Entra ID/Analytic Rules/nrt_FirstAppOrServicePrincipalCredential.yaml, threatAnalysisTactics and threatAnalysisTechniques. Not sure if there are future plans for these fields specifically?

tactics:
  - DefenseEvasion
relevantTechniques:
  - T1550.001
[..]
threatAnalysisTactics: [ "DefenseEvasion" ]
threatAnalysisTechniques: [ "T1550.001" ]

[v-prasadboke]

Hello @pemontto, Can you try to resolve falling validations

[pemontto]

Accidentally forced pushed without commit. Re-opening with fixed tactics

[pemontto]

@v-prasadboke, looking good now. Haven't dug into how the validator works, but it still wasn't happy with T1659 being considered InitialAccess. For now I've left T1659 in there commented out for future reference. Regardless, we're in better stead that we were before when they were under the wrong key 👍

[pemontto]

@v-prasadboke anything else need here?

[pemontto]

@v-prasadboke any feedback, or is this OK to be merged?

[v-prasadboke]

Hello @pemontto, Please repackage the Solutions.

Please go through this documentation to package the solutions
https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.md

[pemontto]

@v-prasadboke repackaged these with no other changes.

[pemontto]

@v-prasadboke do you want/need me to repackage this again, or do you want to merge master into this branch?

[pemontto]

@v-prasadboke I can combine this and #11199 into a single MR if you'd prefer?

[v-prasadboke]

irrelevant deletion
packaging tool automatically removed this field

[v-prasadboke]

irrelevant removal of whitespace
packaging tool automatically removes this blankspace

[v-prasadboke]

irrelevant deletion
tool automatically removes this

[v-prasadboke]

Also we cannot remove this properties from the rules as it may lead to incorrect format in future

As for Solution with typo correction for use requiretechniques instead of relevanttechniques I'll raise a new PR for the same

until then you can close all of your PR's 😊😊
I have added a proper comment to those

Thanks and sorry for the delay in response

[v-prasadboke]

We wanted to check on the status of PR #11124. PR is pending for more than 10+ days. Please let us know if you need any assistance to review this PR. Per our standard operating procedures if no response is received in the next 7 business days, we will close this PR. Thank you for your cooperation.

[v-prasadboke]

Since we have not received a response in the last 7 days, we are closing your PR #11124 per our standard operating procedures. If you still need support for this issue, you can re-open the PR at any time.

If you do re-open, we simply request that you ensure the PR has response to the last request. Thank you for your cooperation.