Skip to content

Commit 82b8ae5

Browse files
v-krishnachiv-krishnachi
committed
QualysVM 3.0.9 - fix Defender portal CCF data connector page client-side KQL parse error
Root cause: When a dataConnectorDefinition (kind: Customizable) is created using API version 2024-01-01-preview or later, the graphQueriesTableName field in connectorUiConfig is dropped during storage by the internal model. This causes {{graphQueriesTableName}} to appear as literal text in the portal instead of the resolved table name, resulting in a 'Query could not be parsed' KQL error when the connector page is opened from security.microsoft.com. Fix (Option A per the unified connectors team): Remove graphQueriesTableName property and inline the literal table name 'QualysHostDetectionV3_CL' directly into baseQuery, sampleQueries[].query, dataTypes[].name, and dataTypes[].lastDataReceivedQuery. Customers must reinstall the solution from Content Hub for the corrected definition model to be re-applied; existing connector instances should be deleted and recreated. Validated via .script/local-validation/build-and-validate.ps1: 13/13 applicable validators passed (TS x10, KQL, ARM-TTK 48 tests, Field Types, Classic App Insights, Hyperlink). 5 skipped due to local runtime gaps (.NET 3.1, trufflehog) - will run in CI.
1 parent abeec7c commit 82b8ae5

6 files changed

Lines changed: 38 additions & 40 deletions

File tree

‎Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_ConnectorDefinition.json‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,23 @@
1010
"title": "Qualys Vulnerability Management (via Codeless Connector Framework)",
1111
"publisher": "Microsoft",
1212
"descriptionMarkdown": "The [Qualys Vulnerability Management (VM)](https://www.qualys.com/apps/vulnerability-management/) data connector provides the capability to ingest vulnerability host detection data into Microsoft Sentinel through the Qualys API. The connector provides visibility into host detection data from vulerability scans.",
13-
"graphQueriesTableName": "QualysHostDetectionV3_CL",
1413
"graphQueries": [
1514
{
1615
"metricName": "Total events received",
1716
"legend": "Qualys Host Detection Logs",
18-
"baseQuery": "{{graphQueriesTableName}}"
17+
"baseQuery": "QualysHostDetectionV3_CL"
1918
}
2019
],
2120
"sampleQueries": [
2221
{
2322
"description": "Get Sample of Qualys Host Detection logs",
24-
"query": "{{graphQueriesTableName}}\n | take 10"
23+
"query": "QualysHostDetectionV3_CL\n | take 10"
2524
}
2625
],
2726
"dataTypes": [
2827
{
29-
"name": "{{graphQueriesTableName}}",
30-
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
28+
"name": "QualysHostDetectionV3_CL",
29+
"lastDataReceivedQuery": "QualysHostDetectionV3_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
3130
}
3231
],
3332
"connectivityCriteria": [

‎Solutions/QualysVM/Package/3.0.9.zip‎

54.6 KB
Binary file not shown.

‎Solutions/QualysVM/Package/mainTemplate.json‎

Lines changed: 30 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,11 @@
5555
"email": "support@microsoft.com",
5656
"_email": "[variables('email')]",
5757
"_solutionName": "QualysVM",
58-
"_solutionVersion": "3.0.8",
58+
"_solutionVersion": "3.0.9",
5959
"solutionId": "azuresentinel.azure-sentinel-qualysvm",
6060
"_solutionId": "[variables('solutionId')]",
6161
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
62-
"dataConnectorCCPVersion": "3.0.8",
62+
"dataConnectorCCPVersion": "3.0.9",
6363
"_dataConnectorContentIdConnectorDefinition1": "QualysVMLogsCCPDefinition",
6464
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
6565
"_dataConnectorContentIdConnections1": "QualysVMLogsCCPDefinitionConnections",
@@ -156,7 +156,7 @@
156156
"resources": [
157157
{
158158
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
159-
"apiVersion": "2025-09-01",
159+
"apiVersion": "2022-09-01-preview",
160160
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
161161
"location": "[parameters('workspace-location')]",
162162
"kind": "Customizable",
@@ -166,24 +166,23 @@
166166
"title": "Qualys Vulnerability Management (via Codeless Connector Framework)",
167167
"publisher": "Microsoft",
168168
"descriptionMarkdown": "The [Qualys Vulnerability Management (VM)](https://www.qualys.com/apps/vulnerability-management/) data connector provides the capability to ingest vulnerability host detection data into Microsoft Sentinel through the Qualys API. The connector provides visibility into host detection data from vulerability scans.",
169-
"graphQueriesTableName": "QualysHostDetectionV3_CL",
170169
"graphQueries": [
171170
{
172171
"metricName": "Total events received",
173172
"legend": "Qualys Host Detection Logs",
174-
"baseQuery": "{{graphQueriesTableName}}"
173+
"baseQuery": "QualysHostDetectionV3_CL"
175174
}
176175
],
177176
"sampleQueries": [
178177
{
179178
"description": "Get Sample of Qualys Host Detection logs",
180-
"query": "{{graphQueriesTableName}}\n | take 10"
179+
"query": "QualysHostDetectionV3_CL\n | take 10"
181180
}
182181
],
183182
"dataTypes": [
184183
{
185-
"name": "{{graphQueriesTableName}}",
186-
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
184+
"name": "QualysHostDetectionV3_CL",
185+
"lastDataReceivedQuery": "QualysHostDetectionV3_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
187186
}
188187
],
189188
"connectivityCriteria": [
@@ -368,7 +367,7 @@
368367
},
369368
{
370369
"name": "QualysVMDCR",
371-
"apiVersion": "2024-03-11",
370+
"apiVersion": "2022-06-01",
372371
"type": "Microsoft.Insights/dataCollectionRules",
373372
"location": "[parameters('workspace-location')]",
374373
"kind": "[variables('blanks')]",
@@ -448,7 +447,7 @@
448447
},
449448
{
450449
"name": "QualysHostDetectionV3_CL",
451-
"apiVersion": "2025-07-01",
450+
"apiVersion": "2022-10-01",
452451
"type": "Microsoft.OperationalInsights/workspaces/tables",
453452
"location": "[parameters('workspace-location')]",
454453
"kind": null,
@@ -521,7 +520,7 @@
521520
},
522521
{
523522
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
524-
"apiVersion": "2025-09-01",
523+
"apiVersion": "2022-09-01-preview",
525524
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
526525
"location": "[parameters('workspace-location')]",
527526
"kind": "Customizable",
@@ -531,24 +530,23 @@
531530
"title": "Qualys Vulnerability Management (via Codeless Connector Framework)",
532531
"publisher": "Microsoft",
533532
"descriptionMarkdown": "The [Qualys Vulnerability Management (VM)](https://www.qualys.com/apps/vulnerability-management/) data connector provides the capability to ingest vulnerability host detection data into Microsoft Sentinel through the Qualys API. The connector provides visibility into host detection data from vulerability scans.",
534-
"graphQueriesTableName": "QualysHostDetectionV3_CL",
535533
"graphQueries": [
536534
{
537535
"metricName": "Total events received",
538536
"legend": "Qualys Host Detection Logs",
539-
"baseQuery": "{{graphQueriesTableName}}"
537+
"baseQuery": "QualysHostDetectionV3_CL"
540538
}
541539
],
542540
"sampleQueries": [
543541
{
544542
"description": "Get Sample of Qualys Host Detection logs",
545-
"query": "{{graphQueriesTableName}}\n | take 10"
543+
"query": "QualysHostDetectionV3_CL\n | take 10"
546544
}
547545
],
548546
"dataTypes": [
549547
{
550-
"name": "{{graphQueriesTableName}}",
551-
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
548+
"name": "QualysHostDetectionV3_CL",
549+
"lastDataReceivedQuery": "QualysHostDetectionV3_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
552550
}
553551
],
554552
"connectivityCriteria": [
@@ -823,7 +821,7 @@
823821
},
824822
{
825823
"name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'QualysVMLogsCCP', parameters('guidValue'))]",
826-
"apiVersion": "2025-09-01",
824+
"apiVersion": "2023-02-01-preview",
827825
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
828826
"location": "[parameters('workspace-location')]",
829827
"kind": "RestApiPoller",
@@ -890,7 +888,7 @@
890888
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
891889
],
892890
"properties": {
893-
"description": "QualysHostDetection Data Parser with template version 3.0.8",
891+
"description": "QualysHostDetection Data Parser with template version 3.0.9",
894892
"mainTemplate": {
895893
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
896894
"contentVersion": "[variables('parserObject1').parserVersion1]",
@@ -1022,7 +1020,7 @@
10221020
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
10231021
],
10241022
"properties": {
1025-
"description": "QualysVMv2 Workbook with template version 3.0.8",
1023+
"description": "QualysVMv2 Workbook with template version 3.0.9",
10261024
"mainTemplate": {
10271025
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
10281026
"contentVersion": "[variables('workbookVersion1')]",
@@ -1110,7 +1108,7 @@
11101108
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
11111109
],
11121110
"properties": {
1113-
"description": "HighNumberofVulnDetectedV2_AnalyticalRules Analytics Rule with template version 3.0.8",
1111+
"description": "HighNumberofVulnDetectedV2_AnalyticalRules Analytics Rule with template version 3.0.9",
11141112
"mainTemplate": {
11151113
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
11161114
"contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
@@ -1154,17 +1152,17 @@
11541152
{
11551153
"fieldMappings": [
11561154
{
1157-
"identifier": "FullName",
1158-
"columnName": "NetBios"
1155+
"columnName": "NetBios",
1156+
"identifier": "FullName"
11591157
}
11601158
],
11611159
"entityType": "Host"
11621160
},
11631161
{
11641162
"fieldMappings": [
11651163
{
1166-
"identifier": "Address",
1167-
"columnName": "IPAddress"
1164+
"columnName": "IPAddress",
1165+
"identifier": "Address"
11681166
}
11691167
],
11701168
"entityType": "IP"
@@ -1223,7 +1221,7 @@
12231221
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
12241222
],
12251223
"properties": {
1226-
"description": "NewHighSeverityVulnDetectedAcrossMulitpleHostsV2_AnalyticalRules Analytics Rule with template version 3.0.8",
1224+
"description": "NewHighSeverityVulnDetectedAcrossMulitpleHostsV2_AnalyticalRules Analytics Rule with template version 3.0.9",
12271225
"mainTemplate": {
12281226
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
12291227
"contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]",
@@ -1316,7 +1314,7 @@
13161314
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
13171315
],
13181316
"properties": {
1319-
"description": "QualysCustomConnector Playbook with template version 3.0.8",
1317+
"description": "QualysCustomConnector Playbook with template version 3.0.9",
13201318
"mainTemplate": {
13211319
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
13221320
"contentVersion": "[variables('playbookVersion1')]",
@@ -2966,7 +2964,7 @@
29662964
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
29672965
],
29682966
"properties": {
2969-
"description": "QualysVM-GetAssetDetails Playbook with template version 3.0.8",
2967+
"description": "QualysVM-GetAssetDetails Playbook with template version 3.0.9",
29702968
"mainTemplate": {
29712969
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
29722970
"contentVersion": "[variables('playbookVersion2')]",
@@ -3479,7 +3477,7 @@
34793477
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
34803478
],
34813479
"properties": {
3482-
"description": "QualysVM-GetAssets-ByCVEID Playbook with template version 3.0.8",
3480+
"description": "QualysVM-GetAssets-ByCVEID Playbook with template version 3.0.9",
34833481
"mainTemplate": {
34843482
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
34853483
"contentVersion": "[variables('playbookVersion3')]",
@@ -4563,7 +4561,7 @@
45634561
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
45644562
],
45654563
"properties": {
4566-
"description": "QualysVM-GetAssets-ByOpenPort Playbook with template version 3.0.8",
4564+
"description": "QualysVM-GetAssets-ByOpenPort Playbook with template version 3.0.9",
45674565
"mainTemplate": {
45684566
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
45694567
"contentVersion": "[variables('playbookVersion4')]",
@@ -5522,7 +5520,7 @@
55225520
"[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
55235521
],
55245522
"properties": {
5525-
"description": "QualysVM-LaunchVMScan-GenerateReport Playbook with template version 3.0.8",
5523+
"description": "QualysVM-LaunchVMScan-GenerateReport Playbook with template version 3.0.9",
55265524
"mainTemplate": {
55275525
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
55285526
"contentVersion": "[variables('playbookVersion5')]",
@@ -8175,7 +8173,7 @@
81758173
"apiVersion": "2023-04-01-preview",
81768174
"location": "[parameters('workspace-location')]",
81778175
"properties": {
8178-
"version": "3.0.8",
8176+
"version": "3.0.9",
81798177
"kind": "Solution",
81808178
"contentSchemaVersion": "3.0.0",
81818179
"displayName": "QualysVM",
@@ -8258,7 +8256,7 @@
82588256
]
82598257
},
82608258
"firstPublishDate": "2020-12-14",
8261-
"lastPublishDate": "2025-11-18",
8259+
"lastPublishDate": "2026-06-12",
82628260
"providers": [
82638261
"Qualys"
82648262
],

‎Solutions/QualysVM/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|----------------------------------------------------------------|
3+
| 3.0.9 | 12-06-2026 | Removed `graphQueriesTableName` placeholder substitution from **Data Connector** definition; inlined `QualysHostDetectionV3_CL` directly in `graphQueries`, `sampleQueries`, and `dataTypes` to fix client-side KQL parse error in Defender portal connector page. |
34
| 3.0.8 | 14-05-2026 | Bumping API version |
45
| 3.0.7 | 18-11-2025 | Adding adjustable API partition limit & rate limit protection. |
56
| 3.0.6 | 18-09-2025 | Updated Analytic rules, Parsers, and Workbooks in Sentinel solution content for **CCF connector** compatibility. |

‎Solutions/QualysVM/SolutionMetadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"publisherId": "azuresentinel",
33
"offerId": "azure-sentinel-qualysvm",
44
"firstPublishDate": "2020-12-14",
5-
"lastPublishDate": "2025-11-18",
5+
"lastPublishDate": "2026-06-12",
66
"providers": ["Qualys"],
77
"categories": {
88
"domains": ["Security - Vulnerability Management","Security - Automation (SOAR)"]

‎Solutions/QualysVM/data/Solution_QualysVM.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
],
2626
"Metadata": "SolutionMetadata.json",
2727
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\QualysVM",
28-
"Version": "3.0.8",
28+
"Version": "3.0.9",
2929
"TemplateSpec": true,
3030
"Is1PConnector": false
31-
}
31+
}

0 commit comments

Comments
 (0)