add entra traffic type

[iwaiss-iwaiss]

Change(s):

Updated Global Secure Access solution (version 3.0.4):

Workbooks — Updated GSAM365EnrichedEvents.json (25 queries) and GSANetworkTraffic.json (1 iff condition) to support the new Entra traffic type: TrafficType == 'microsoft365' → TrafficType in ('microsoft365', 'entra')
Analytic Rule — Fixed regex in GSA - TI URL Entity.yaml for correct URL indicator matching: replace(@'[|]|"""', ...) → replace(@'[[]"]', ...)
Package — Regenerated mainTemplate.json and 3.0.4.zip using createSolutionV3.ps1
ReleaseNotes.md — Added version 3.0.4 entry; fixed missing 3.0.3 entry
Reason for Change(s):

Global Secure Access introduced a new entra TrafficType (split from microsoft365). Workbook queries need to include both types.
The TI URL Entity analytic rule had a broken regex that left a leading quotation mark in IndicatorType, causing URL-based TI detections to produce zero alerts.
Version Updated:

Yes — 3.0.3 → 3.0.4

Testing Completed:

Yes — Package generated using createSolutionV3.ps1. All JSON files validated.

Checked that the validations are passing and have addressed any issues that are present:

Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Global Secure Access solution workbooks to include the new entra traffic type, and bumps the solution version/release notes accordingly.

Changes:

• Updated workbook KQL queries to treat TrafficType == 'entra' similarly to microsoft365.
• Updated solution version to 3.0.4 and added release notes entry for the workbook changes.
• Normalized the solution data file’s empty “Hunting Queries” list to [].

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 5 comments.

File	Description
Solutions/Global Secure Access/Workbooks/GSANetworkTraffic.json	Expands TrafficType handling to include entra in workbook query logic.
Solutions/Global Secure Access/Workbooks/GSAM365EnrichedEvents.json	Updates multiple workbook queries to include entra traffic alongside microsoft365.
Solutions/Global Secure Access/ReleaseNotes.md	Adds a 3.0.4 entry documenting workbook update for Entra traffic type.
Solutions/Global Secure Access/Data/Solution_GlobalSecureAccess.json	Bumps solution version to 3.0.4 and adjusts empty Hunting Queries array representation.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.