Merge branch 'master' into add_analityc_rules_16_02_26

Author: averbn

.github/copilot-instructions.md

@@ -33,6 +33,12 @@ When reviewing pull requests, follow these rules strictly.
 4. Validate GUID format, rule names, descriptions, severity levels, and other field-based validation rules
 5. Do NOT use general instructions for these files - only use the detections custom instructions
 
+### For Hunting Queries Files (`Hunting Queries/**/*.yaml`, `Solutions/**/Hunting Queries/*.yaml`)
+1. **LOAD and USE:** `.github/instructions/huntingqueries.instructions.md`
+2. Apply ALL guidelines from that file
+3. Verify all required fields are present and properly formatted
+4. Do NOT use general instructions for these files - only use the huntingqueries custom instructions
+
 ---
 
 ## Files and folders to ignore

.github/instructions/detections.instructions.md

@@ -115,6 +115,85 @@ Analytic Rules are YAML files that define scheduled queries to detect threats, s
 - **Pattern**: `/^\d+\.\d+\.\d+$/`
 - **Example**: `1.2.3` ✅
 
+#### **metadata** (Metadata Information - Required for Standalone Files)
+- **Required**: Yes (for standalone detections in `Detections/` folder); No (for rules in `Solutions/**/Analytic Rules/`)
+- **Purpose**: Provides source, author, support tier, and category information for standalone detection rules
+- **Type**: Object with nested properties
+- **Structure**:
+  ```yaml
+  metadata:
+    source:
+      kind: Community        # or "Microsoft" for official rules
+    author:
+      name: Author Name
+    support:
+      tier: Community        # or "Microsoft" for official support
+    categories:
+      domains: [ "Category Name" ]
+  ```
+- **Rules**:
+  - **Required for standalone files** in root `Detections/` folder (matches pattern `Detections/**/*.yaml`)
+  - **Not required** for rules in Solutions folder (`Solutions/**/Analytic Rules/*.yaml`)
+  - `source.kind`: Typically `Community` or `Microsoft`
+  - `author.name`: Name of the rule author or organization
+  - `support.tier`: Support level - `Community` or `Microsoft`
+  - `categories.domains`: Array of domain/category classifications from the valid domains list
+
+#### **Valid Domain Categories** (for `categories.domains`)
+- Application
+- Cloud Provider
+- Cloud Security
+- Compliance
+- DevOps
+- Identity
+- Internet of Things (IoT)
+- IT Operations
+- Migration
+- Networking
+- Platform
+- Security
+- Security - 0-day Vulnerability
+- Security - Automation (SOAR)
+- Security - Cloud Security
+- Security - Information Protection
+- Security - Insider Threat
+- Security - Network
+- Security - Others
+- Security - Threat Intelligence
+- Security - Threat Protection
+- Security - Vulnerability Management
+- Storage
+- Training and Tutorials
+- User Behavior (UEBA)
+
+
+- **Valid Examples**: 
+  ```yaml
+  metadata:
+    source:
+      kind: Community
+    author:
+      name: Alex
+    support:
+      tier: Community
+    categories:
+      domains: [ "Security - Others" ]
+  ```
+  ```yaml
+  metadata:
+    source:
+      kind: Microsoft
+    author:
+      name: Microsoft Sentinel Team
+    support:
+      tier: Microsoft
+    categories:
+      domains: [ "Security - Threat Intelligence", "Security - Threat Protection" ]
+  ```
+- **Invalid Examples** (for standalone files):
+  - Missing `metadata` section ❌
+  - Incomplete metadata (missing `author` or `support`) ❌
+
 #### **tactics** (MITRE ATT&CK Tactics)
 - **Required**: Yes (all rule types)
 - **Framework Version**: ATT&CK Framework v16 Supported
@@ -238,6 +317,26 @@ Analytic Rules are YAML files that define scheduled queries to detect threats, s
   - Must include all connectors required for query execution
   - Specify exact data types needed
   - Use official connector IDs
+  
+#### **connectorId Validation**
+- **Source of Truth**: All `connectorId` values must be validated against the official list:
+  ```
+  https://github.com/Azure/Azure-Sentinel/blob/master/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
+  ```
+- **Validation Process**:
+  - Check if the `connectorId` value exists in ValidConnectorIds.json
+  - If NOT found: Flag as invalid and request update to ValidConnectorIds.json
+  - Case-sensitive matching required
+- **Valid Examples**: 
+  - `CiscoDuoSecurity` ✅ (exists in valid list)
+  - `AzureActiveDirectory` ✅ (exists in valid list)
+  - `CiscoASA` ✅ (exists in valid list)
+- **Invalid Examples**:
+  - `CiscoDuo` ❌ (correct ID is `CiscoDuoSecurity`)
+  - `AzureAD` ❌ (correct ID is `AzureActiveDirectory`)
+  - `CustomConnectorXYZ` ❌ (not in official list - needs to be added to ValidConnectorIds.json)
+- **Action if Invalid**: 
+  - Comment: "connectorId `[value]` is not found in the ValidConnectorIds.json file. Please update ValidConnectorIds.json to include this connector or use a valid connector ID from the official list."
 
 #### **entityMappings** (Entity Extraction)
 - **Required**: Yes for Detections
@@ -756,6 +855,20 @@ query: |
 # Missing: queryFrequency, queryPeriod, triggerOperator, triggerThreshold
 ```
 
+```yaml
+# Standalone detection file missing metadata (should not appear in Detections/ folder without metadata)
+id: 12345678-1234-1234-1234-123456789012
+name: Multiple Failed Login Attempts
+description: Detects multiple failed login attempts from a single IP
+severity: High
+status: Available
+kind: Scheduled
+# ❌ Missing: metadata section (required for standalone Detections/ files)
+# Should include: source.kind, author.name, support.tier, categories.domains
+query: |
+  SecurityEvent | where EventID == 4625
+```
+
 ## Best Practices for Analytic Rules
 
 ### 1. **Detection Logic Philosophy**