[Airlock Digital] Update solution to version 3.2.0 - #14839
Open
ChrisMaureder wants to merge 1 commit into
Open
Conversation
Solution is now published and maintained by Airlock Digital. - Updated data connector Airlock Digital (Poll) with multi-instance support so several Airlock servers can be connected to one workspace. - Added data connector Airlock Digital (Push) for Airlock Digital 7.0 and above, using external logging to stream execution history, server activity and policy change events. - Added data connector Airlock Digital (Poll - SaaS) for the Airlock Digital hosted offering. - Added ASIM parsers for the Process Event and Audit Event schemas. - Added the Airlock Digital workbook. - Added table AirlockDigitalPolicyChanges_CL for policy change events. Existing table and column names are unchanged, so queries, workbooks and analytics rules built on version 3.1.1 continue to work after upgrade.
ChrisMaureder
force-pushed
the
airlockdigital-3.2.0
branch
from
August 5, 2026 12:55
dcebe18 to
20451a4
Compare
v-atulyadav
added
Solution
|
@ChrisMaureder please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the Airlock Digital Microsoft Sentinel solution to v3.2.0 as partner-owned, adding new connectors (Push + SaaS Poll), new ASIM parsers, and a new workbook.
Changes:
- Transferred publishing/support metadata from Microsoft to Airlock Digital and bumped solution version to 3.2.0.
- Added new data connectors (Push, Poll - SaaS) and updated Poll connector assets (DCR/poller/config/table definitions).
- Added ASIM parsers and a new “Airlock Digital” workbook plus metadata wiring.
Reviewed changes
Copilot reviewed 35 out of 39 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| Workbooks/WorkbooksMetadata.json | Registers the new Airlock Digital workbook and its dependencies. |
| Solutions/AirlockDigital/Workbooks/AirlockDigital.json | Adds the new workbook with multiple tabs and KQL visualizations. |
| Solutions/AirlockDigital/SolutionMetadata.json | Updates publisher/support ownership to Airlock Digital and publish date. |
| Solutions/AirlockDigital/ReleaseNotes.md | Adds release notes entry for 3.2.0. |
| Solutions/AirlockDigital/Parsers/parser_AirlockDigitalServerActivitiesAliasFunction.json | Changes alias function to point directly at the _CL table. |
| Solutions/AirlockDigital/Parsers/parser_AirlockDigitalFileActivitySummaryAliasFunction.json | Removes the file activity summary alias function. |
| Solutions/AirlockDigital/Parsers/parser_AirlockDigitalExecutionHistoriesAliasFunction.json | Changes alias function to point directly at the _CL table. |
| Solutions/AirlockDigital/Parsers/ASimProcessEventAirlockDigital.yaml | Adds ASIM ProcessEvent normalization function. |
| Solutions/AirlockDigital/Parsers/ASimAuditEventAirlockDigitalPolicyChange.yaml | Adds ASIM AuditEvent normalization for policy changes. |
| Solutions/AirlockDigital/Parsers/ASimAuditEventAirlockDigital.yaml | Adds ASIM AuditEvent normalization for server activities. |
| Solutions/AirlockDigital/Package/testParameters.json | Adds workbook name parameter for packaging/tests. |
| Solutions/AirlockDigital/Package/createUiDefinition.json | Updates install UI text + adds sections for multiple connectors and workbook. |
| Solutions/AirlockDigital/Data/Solution_AirlockDigital.json | Updates solution manifest: version, base path, connectors/parsers/workbooks lists. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalServerActivities.json | Removes legacy table definition file. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalFileActivitySummary.json | Removes legacy summary table definition file. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalExecutionHistories.json | Removes legacy table definition file. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_PollerConfig.json | Removes legacy poller config. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_DCR.json | Removes legacy DCR. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalSaas_CCF/AirlockDigitalServerActivities_CL_Table.json | Adds SaaS Poll server activities table definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalSaas_CCF/AirlockDigitalSaas_PollerConfig.json | Adds SaaS Poll connector poller configuration. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalSaas_CCF/AirlockDigitalSaas_DCR.json | Adds SaaS Poll DCR with transforms. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalSaas_CCF/AirlockDigitalSaas_ConnectorDefinition.json | Adds SaaS Poll connector definition + UX. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalSaas_CCF/AirlockDigitalExecutionHistories_CL_Table.json | Adds SaaS Poll execution histories table definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalServerActivities_CL_Table.json | Adds Push connector server activities table definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalPush_PollerConfig.json | Adds Push connector resource configuration. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalPush_DCR.json | Adds Push connector DCR and transforms. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalPush_ConnectorDefinition.json | Adds Push connector definition + UX. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalPolicyChanges_CL_Table.json | Adds policy changes table for Push connector. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPush_CCF/AirlockDigitalExecutionHistories_CL_Table.json | Adds Push connector execution histories table definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPoll_CCF/AirlockDigitalServerActivities_CL_Table.json | Adds Poll connector server activities table definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPoll_CCF/AirlockDigitalPoll_PollerConfig.json | Adds Poll connector poller configuration. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPoll_CCF/AirlockDigitalPoll_DCR.json | Adds Poll connector DCR with transforms. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPoll_CCF/AirlockDigitalPoll_ConnectorDefinition.json | Updates Poll connector definition + UX and renames definition. |
| Solutions/AirlockDigital/Data Connectors/AirlockDigitalPoll_CCF/AirlockDigitalExecutionHistories_CL_Table.json | Adds Poll connector execution histories table definition. |
| .script/utils/workbookCheckers/WorkbookPreviewImageValidationSkipList.json | Skips preview image validation for the new workbook. |
Comment on lines
+3
to
+19
| "name": "AirlockDigitalPushConnector", | ||
| "apiVersion": "2024-09-01", | ||
| "type": "Microsoft.SecurityInsights/dataConnectors", | ||
| "kind": "Push", | ||
| "properties": { | ||
| "connectorDefinitionName": "AirlockDigitalPush", | ||
| "dataType": "Airlock Digital", | ||
| "dcrConfig": { | ||
| "streamName": "Custom-AirlockDigital_CL", | ||
| "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", | ||
| "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" | ||
| }, | ||
| "auth": { | ||
| "type": "Push", | ||
| "AppId": "[[parameters('auth').appId]", | ||
| "ServicePrincipalId": "[[parameters('auth').servicePrincipalId]" | ||
| }, |
Comment on lines
+9
to
+23
| "streamDeclarations": { | ||
| "Custom-AirlockDigital_CL": { | ||
| "columns": [ | ||
| { | ||
| "name": "TimeGenerated", | ||
| "type": "datetime" | ||
| }, | ||
| { | ||
| "name": "event", | ||
| "type": "string" | ||
| }, | ||
| { | ||
| "name": "checkpoint", | ||
| "type": "string" | ||
| }, |
Comment on lines
+215
to
+219
| "dataFlows": [ | ||
| { | ||
| "streams": [ | ||
| "Custom-AirlockDigital_CL" | ||
| ], |
Comment on lines
+224
to
+226
| "outputStream": "Custom-AirlockDigitalExecutionHistories_CL" | ||
| }, | ||
| { |
Comment on lines
+234
to
+236
| "outputStream": "Custom-AirlockDigitalServerActivities_CL" | ||
| }, | ||
| { |
Comment on lines
+244
to
+245
| "outputStream": "Custom-AirlockDigitalPolicyChanges_CL" | ||
| } |
| "category": "Microsoft Sentinel Parser", | ||
| "functionAlias": "AirlockDigitalExecutionHistories", | ||
| "query": "union isfuzzy=true AirlockDigitalExecutionHistories_CL, SentinelAirlockDigitalExecutionHistories", | ||
| "query": "// Short name for the Airlock Digital execution history table.\n// Provided so saved queries, workbooks and analytic rules can reference\n// AirlockDigitalExecutionHistories without the _CL suffix.\nAirlockDigitalExecutionHistories_CL", |
| "type": 3, | ||
| "content": { | ||
| "version": "KqlItem/1.0", | ||
| "query": "ASimProcessEventAirlockDigital\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| summarize ['Received Date'] = min(TimeGenerated) by ['File Name'] = TargetProcessName, Publisher = TargetProcessFileCompany\n| where ['Received Date'] >= {TimeSelector}\n| where isnotempty(['File Name'])\n| project ['Received Date'], ['File Name'], Publisher\n| top 100 by ['Received Date'] desc", |
Comment on lines
+28
to
+35
| AdditionalFields = bag_pack( | ||
| "checkpoint", Checkpoint, | ||
| "policy_id", PolicyId, | ||
| "policy_version", PolicyVersion, | ||
| "uuid", Uuid, | ||
| "user_reason", UserReason, | ||
| "connectorName", ConnectorName | ||
| ) |
Comment on lines
+33
to
+34
| "SyslogConnectorsOverviewWorkbook", | ||
| "AirlockDigital" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: