Recorded Future: add owner_organisation_details columns by aommm · Pull Request #15138 · Azure/Azure-Sentinel

Niklas Logren (aommm) · 2026-09-16T09:05:56Z

Change(s):

Added owner_organisation_details columns to two LAW tables, DCE/DCR definitions, and to the Logic Apps that perform ingestion

Version updated:

Yes
Detections/Analytic Rule templates are required to have the version updated

Testing Completed:

Yes

Copilot

Note

Copilot was unable to run its full agentic suite in this review.

Pull request overview

Adds owner_organisation_details ingestion and storage support for Recorded Future alerts, updating templates and documentation so the new ownership info is persisted in Log Analytics and exposed to users.

Changes:

Added new dynamic columns to LAW tables / DCR transforms for classic and playbook alerts.
Updated both Logic App playbooks to include the new ownership field in payloads.
Updated release notes and connector documentation to describe the manual upgrade requirement.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Solutions/Recorded Future/ReleaseNotes.md	Documents the new column(s) and manual redeploy requirement.
Solutions/Recorded Future/Playbooks/Alerts/RecordedFuture-Playbook-Alert-Importer/azuredeploy.json	Adds playbook alert payload field + release note entry.
Solutions/Recorded Future/Playbooks/Alerts/RecordedFuture-Alert-Importer/azuredeploy.json	Adds classic alert payload field + release note entry.
Solutions/Recorded Future/Package/mainTemplate.json	Updates packaged template content (including playbooks) to carry the new field; also includes reordering edits.
Solutions/Recorded Future/Data Connectors/azuredeploy.json	Adds LAW table columns + DCR transformKql projection for new field; bumps metadata.
Solutions/Recorded Future/Data Connectors/README.md	Adds “Upgrading” guidance about manual redeploy and where to check changes.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

v-rusraut · 2026-09-17T06:55:12Z

Hi Niklas Logren (@aommm),
Please review and resolve all copilot review comments.

…column names in release notes Addresses Copilot CR feedback on PR Azure#15138: the release note previously implied both tables use the snake_case column name, but the classic alerts table uses OwnerOrganisationDetails (PascalCase) while the playbook alerts table uses owner_organisation_details (snake_case).

Niklas Logren (aommm) · 2026-09-21T09:08:34Z

v-rusraut done!

v-rusraut · 2026-09-22T07:54:41Z

Hi Niklas Logren (@aommm),
Please provide screenshots showing the updated playbook workflow running successfully. Also, keep the release notes concise, ideally 1–2 lines.

Please also verify the solution package version. It is 3.2.22, while the release notes mention 3.2.23. Please update it accordingly

v-rusraut · 2026-09-23T05:11:40Z

Hi Niklas Logren (@aommm), Package version 3.2.22 has successfully cleared certification. You can now proceed with packaging the next version 3.2.23. please package it and commit changes.

v-rusraut · 2026-09-25T07:13:21Z

Hi Niklas Logren (@aommm)
Please work on above comment.

RFPD-113845: surface enterprise/organisation ownership info (owner_organisation_details) for both classic and playbook alerts in the Recorded Future Sentinel solution. - Add OwnerOrganisationDetails (classic) / owner_organisation_details (playbook) dynamic columns to the DCR streamDeclarations and workspace table schemas in Data Connectors/azuredeploy.json. - Map the new field in RecordedFuture-Alert-Importer's Compose_Record from owner_organisation_details on the triggered alert. - Map the new field in RecordedFuture-Playbook-Alert-Importer's Compose_Record from the playbook alert lookup response (requires bfi-azure >= 1.9.0). - Bump solution version to 3.2.23 in ReleaseNotes.md and each importer's metadata.releaseNotes. Tested end-to-end in the RF-Erik environment: verified via KQL that both RecordedFutureClassicAlerts_V2_CL and RecordedFuturePlaybookAlerts_V2_CL now populate the new column with real data from the Recorded Future Alerts API.

…column names in release notes Addresses Copilot CR feedback on PR Azure#15138: the release note previously implied both tables use the snake_case column name, but the classic alerts table uses OwnerOrganisationDetails (PascalCase) while the playbook alerts table uses owner_organisation_details (snake_case).

- Solutions/Recorded Future/Package/3.2.22.zip was accidentally overwritten by a repackage commit in this branch; restored from upstream/master since 3.2.22 has already cleared certification. - Bumped Data/Solution_RecordedFuture.json Version to 3.2.23 to match ReleaseNotes.md. - Shortened the 3.2.23 release note entry per reviewer feedback.

Niklas Logren (aommm) · 2026-09-28T12:55:20Z

Hi, I've repackaged the solution and made the release notes shorter.

Here are screenshots:

Alert importer:

LAW table, alerts:

Playbook alert importer:

LAW table, PBA:

v-rusraut · 2026-09-29T06:04:37Z

Hi Niklas Logren (@aommm) ,

During the review, it was found that the Deploy to Azure Gov button in the readme.md files under the Playbooks contain a broken link. Please check all Playbook readme.md files for the Deploy to Azure Gov button and replace the existing broken link with the correct one:

Old link:
https://aka.ms/deploytoazuregovbutton

New link:
https://aka.ms/deploytoazuregovernbutton

After updating these links, there is no need to repackage the solution, as the changes are limited to the readme.md files.

Niklas Logren (aommm) · 2026-09-29T07:24:08Z

v-rusraut Done — replaced https://aka.ms/deploytoazuregovbutton with https://aka.ms/deploytoazuregovernbutton in all Playbook readme.md files (commits 515439f and bbf1607). No repackaging, as the changes are limited to readme files.

… API migration Adds troubleshooting guidance for the 'authentication token provided does not have access to ingest data' error seen on the six playbooks migrated to the Log Ingestion API. Root-caused as an expected RBAC propagation race (Monitoring Metrics Publisher on the DCR can take up to ~30 min to propagate) rather than a misconfiguration - confirmed by reproducing the failure on a fresh deployment and observing it self-heal on retry with no changes. Also clarifies: - the Roles and Permissions table describes deployer permissions, not the playbook's own managed identity permissions

…eadme

…k readmes

v-rusraut · 2026-10-01T07:35:16Z

Hi Niklas Logren (@aommm)

After deploying the solution through the mainTemplate, I encountered the following error while checking the playbook.

For the create_role_assignment parameter, I am unable to enter any value because there is no textbox available in the UI.

Based on the screenshots you shared, it appears that you were able to deploy the playbook successfully. Could you please confirm whether you deployed these playbooks separately rather than through the mainTemplate?

The playbook UI expects the parameter type to be string to display a textbox. Currently, the parameter type is set to bool, which is why the textbox is not visible.

We tested changing the data type from bool to string, and after making this change, we were able to see the textbox, as shown in the image below.

Please fix these issue

v-rusraut · 2026-10-05T06:23:56Z

Hi Niklas Logren (@aommm),
Please fix playbook issue.

…the playbook deploy UI The Sentinel content hub playbook deployment UI renders no input for bool parameters. Use a string with allowedValues true/false and compare via equals(toLower(...), 'true'). Repackage 3.2.23.

Niklas Logren (aommm) · 2026-10-05T12:13:40Z

Hi v-rusraut , I've pushed a fix now.

I deployed the templates individually (from buttons in Github readme).

We don't know any way of testing the full "content hub flow" other than deploying it to prod, updating our solution in content hub and testing there. If there's a better way we would be happy to hear it!

v-rusraut · 2026-10-07T08:13:55Z

Hi Niklas Logren (@aommm)
Now we are able to deploy playbook successfully through mainTemplate, you can deploy the solution’s mainTemplate using the Custom Deployment steps to your workspace(test workspace). Please refer to the attached document for guidance. Once the deployment is completed, you can see this updated solution in content hub, please test all the playbooks and confirm that they are working properly.

Document :
CustomDeploymentSteps.docx

v-rusraut · 2026-10-09T09:24:28Z

Hi Niklas Logren (@aommm),
Is there any update on this?

Niklas Logren (aommm) · 2026-10-12T12:55:31Z

Hi, I deployed from mainTemplate.json now and created a new instance of playbook. It could run successfully. So I think all is good!

(I currently work part-time, sorry for the delay in answering your queries)

Niklas Logren (aommm) requested review from a team as code owners September 16, 2026 09:05

v-atulyadav assigned v-rusraut Sep 16, 2026

v-atulyadav requested a lite review from Copilot September 16, 2026 10:13

v-atulyadav added the Solution Solution specialty review needed label Sep 16, 2026

Copilot AI reviewed Sep 16, 2026

View reviewed changes

Comment thread Solutions/Recorded Future/Data Connectors/azuredeploy.json

Comment thread Solutions/Recorded Future/Data Connectors/azuredeploy.json

Comment thread Solutions/Recorded Future/Package/mainTemplate.json

Comment thread Solutions/Recorded Future/ReleaseNotes.md Outdated

Niklas Logren (aommm) added 3 commits September 28, 2026 14:02

chore: repackage solution

7c32f47

Niklas Logren (aommm) force-pushed the rfpd-113845-owner-org-details branch from 4d30519 to 2313eba Compare September 28, 2026 12:02

Niklas Logren (aommm) added 2 commits September 28, 2026 14:07

chore: repackage solution

26432eb

Niklas Logren (aommm) added 3 commits September 29, 2026 09:30

docs: fix broken Deploy to Azure Gov button link in Alerts playbook r…

8d141c3

…eadme

docs: fix broken Deploy to Azure Gov button link in remaining playboo…

403dc59

…k readmes

Niklas Logren (aommm) force-pushed the rfpd-113845-owner-org-details branch from bbf1607 to 403dc59 Compare September 29, 2026 07:31

Niklas Logren (aommm) added 2 commits October 5, 2026 13:25

refactor: use bool() to read create_role_assignment string parameter

541dc18

chore: repackage solution

38cc202

Niklas Logren (aommm) mentioned this pull request Oct 6, 2026

Recorded Future Identity - make boolean playbook parameters strings #15268

Open

v-rusraut mentioned this pull request Oct 7, 2026

Group-IB playbooks update #15073

Merged

v-rusraut approved these changes Oct 13, 2026

View reviewed changes

v-atulyadav merged commit ab3cdd9 into Azure:master Oct 13, 2026
33 checks passed

Conversation

Niklas Logren (aommm) commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

v-rusraut commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Niklas Logren (aommm) commented Sep 21, 2026

Uh oh!

v-rusraut commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-rusraut commented Sep 23, 2026

Uh oh!

v-rusraut commented Sep 25, 2026

Uh oh!

Niklas Logren (aommm) commented Sep 28, 2026

Uh oh!

v-rusraut commented Sep 29, 2026

Uh oh!

Niklas Logren (aommm) commented Sep 29, 2026

Uh oh!

v-rusraut commented Oct 1, 2026

Uh oh!

v-rusraut commented Oct 5, 2026

Uh oh!

Niklas Logren (aommm) commented Oct 5, 2026

Uh oh!

v-rusraut commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-rusraut commented Oct 9, 2026

Uh oh!

Niklas Logren (aommm) commented Oct 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

v-rusraut commented Sep 17, 2026 •

edited

Loading

v-rusraut commented Sep 22, 2026 •

edited

Loading

v-rusraut commented Oct 7, 2026 •

edited

Loading