GTI Solution: Added CCF for Vulnerability

[devendra-chavda]

Required items, please complete

Change(s):

• Added Data Connector GTI Vulnerabilities (Codeless Connector Framework, Log Ingestion API).
• Added Parser GTIVulnerabilities.
• Added Analytics Rules: GTI Actively Exploited Vulnerability, GTI CISA Known Exploited Vulnerability, GTI Critical CVSS Vulnerability, GTI Zero Day Vulnerability.
• Added Playbooks: GTI Add Comment To Incident, GTI File Scan Blob Enrichment, GTI File Scan Enrichment, GTI URL Scan Enrichment, GTI URL Scan Entity Enrichment, GTI URL Scan Incident Enrichment, GTI Vulnerability Enrichment.
• Added Workbook Google Threat Intelligence.

Reason for Change(s):

• feature release

Version Updated:

• 3.3.0

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Google Threat Intelligence (GTI) Vulnerabilities support via Codeless Connector Framework (CCF) and expands the GTI solution content (playbooks, workbook, analytics) to enable enrichment and scanning workflows inside Microsoft Sentinel.

Changes:

• Added GTI Vulnerabilities CCF data connector assets (connector definition, DCR, poller config, table schema) and a GTIVulnerabilities parser.
• Added URL scanning and file scanning enrichment playbooks, plus a shared “Add Comment to Incident” sub-playbook.
• Updated solution packaging/UI/metadata and release notes; added new workbook registration.

Reviewed changes

Copilot reviewed 30 out of 33 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Registers the new GoogleThreatIntelligence workbook in global workbook metadata.
Solutions/Google Threat Intelligence/ReleaseNotes.md	Adds v3.3.0 release notes reflecting new connector/parser/rules/playbooks/workbook.
Solutions/Google Threat Intelligence/Playbooks/GTIURLScanEntityEnrichment/azuredeploy.json	Adds entity-trigger URL scan enrichment playbook with DCE/DCR ingestion and incident commenting.
Solutions/Google Threat Intelligence/Playbooks/GTIURLScanEnrichment/azuredeploy.json	Adds HTTP-trigger URL scan enrichment playbook with DCE/DCR ingestion.
Solutions/Google Threat Intelligence/Playbooks/GTIFileScanBlobEnrichment/azuredeploy.json	Adds blob-trigger file scanning playbook using Function for large-file upload and DCE/DCR ingestion.
Solutions/Google Threat Intelligence/Playbooks/GTIAddCommentToIncident/azuredeploy.json	Adds reusable sub-playbook to post GTI scan results into Sentinel incident comments with limits/truncation.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/requirements.txt	Defines Python dependencies for the GTI large-file upload Azure Function.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/host.json	Configures Azure Functions host settings (bundle, timeout, AI sampling).
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/gti_uploader.py	Implements managed-identity blob download + GTI large-file upload flow helper.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/azuredeploy.json	Deploys the shared Function App infrastructure used by playbooks for large-file upload.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/GTIUploadLargeFile/function.json	Defines the HTTP-triggered Azure Function binding for large-file upload.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/GTIUploadLargeFile/app.py	Implements the HTTP endpoint to orchestrate blob download + upload via GTIUploader.
Solutions/Google Threat Intelligence/Playbooks/CustomConnector/GTIFileUpload_FunctionAppConnector/GTIUploadLargeFile/init.py	Marks the Azure Function package module.
Solutions/Google Threat Intelligence/Parsers/GTIVulnerabilities.yaml	Adds KQL parser function/view to normalize GTI vulnerabilities into query-friendly fields.
Solutions/Google Threat Intelligence/Package/testParameters.json	Extends packaging test parameters for workbook and deployment context values.
Solutions/Google Threat Intelligence/Package/createUiDefinition.json	Updates Content Hub UI definition (counts + adds Workbooks section + adds analytics descriptions).
Solutions/Google Threat Intelligence/Data/Solution_GoogleThreatIntelligence.json	Updates solution manifest to include new connector/parser/rules/playbooks/workbook and bumps version.
Solutions/Google Threat Intelligence/Data Connectors/GTIVulnerabilities_ccf/GTIVulnerabilities_tables.json	Defines the GTI_Vulnerabilities_CL table schema for the CCF connector.
Solutions/Google Threat Intelligence/Data Connectors/GTIVulnerabilities_ccf/GTIVulnerabilities_PollerConfig.json	Adds the RestApiPoller configuration to pull vulnerabilities from GTI Collections API.
Solutions/Google Threat Intelligence/Data Connectors/GTIVulnerabilities_ccf/GTIVulnerabilities_DCR.json	Adds DCR + transform to map GTI vulnerability objects into flattened columns.
Solutions/Google Threat Intelligence/Data Connectors/GTIVulnerabilities_ccf/GTIVulnerabilities_ConnectorDefinition.json	Adds the connector definition and UX content (instructions, sample queries, settings).
Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_ZeroDayVulnerability.yaml	Adds scheduled analytic rule for GTI zero-day-tagged vulnerabilities.
Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml	Adds scheduled analytic rule for critical CVSS v3 vulnerabilities.
Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml	Adds scheduled analytic rule for CISA KEV-related vulnerabilities.
Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_ActivelyExploitedVulnerability.yaml	Adds scheduled analytic rule for actively exploited vulnerabilities.
.script/tests/KqlvalidationsTests/CustomTables/GTI_Vulnerabilities_CL.json	Adds KQL validation schema for the new GTI_Vulnerabilities_CL custom table.