Add TrendAI Vision One CCF-based Microsoft Sentinel Data Connector

Solutions/TrendAI Vision One/CODEOWNERS

@@ -0,0 +1,12 @@
+# Code owners for this repository.
+#
+# Every pull request that touches a path listed below will automatically
+# request review from the matching owners. When branch protection is
+# enabled on `main` with "Require review from Code Owners", these owners
+# must approve before the PR can merge.
+#
+# Replace @trendmicro/mxdr-team with the real GitHub team handle before
+# enabling the corresponding branch protection rule.
+# Syntax: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
+
+* @trendmicro/mxdr-team

Solutions/TrendAI Vision One/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+opensource@github.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

Solutions/TrendAI Vision One/CONTRIBUTING.md

@@ -0,0 +1,116 @@
+# Contributing
+
+We're so glad you're thinking about contributing to the **Trend Vision One – Microsoft Sentinel Data Connectors** repository! This repo contains production ARM templates that ship Trend Vision One security data into Microsoft Sentinel via the Codeless Connector Platform (CCP). Because every change can affect a live deployment in someone's Azure tenant, we ask contributors to keep templates deployable and review-friendly.
+
+We welcome contributions from everyone and are particularly looking for help in the following areas:
+
+- **Fixing template or documentation errors** — typos, broken parameter references, outdated screenshots, incorrect KQL examples, or missing fields in `mainTemplate.json` / `createUiDefinition.json`.
+- **Adding new features** — additional Trend Vision One data sources, new parser functions, improved data-collection-rule transforms, or richer connector UI.
+- **Improving existing documentation** — clearer deployment walkthroughs, better troubleshooting steps, more useful sample KQL queries.
+
+## Code of Conduct
+
+This project follows the [Contributor Covenant Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.
+
+## Reporting Issues
+
+Please report issues in the [GitHub issue tracker](https://github.com/trendmicro/trendai-sentinel-ccf-data-connector/issues) using one of the provided templates. Include as much detail as possible — connector (Workbench / OAT), deploy region, commit SHA, Azure portal error output, and any relevant KQL — so we can reproduce the problem.
+
+> **Security vulnerabilities** must **not** be filed as public issues. See [SECURITY.md](SECURITY.md) for the private reporting process.
+
+## Contributing Code
+
+1. **Fork the repository.** Click the *Fork* button at the top right of the repo page and clone your fork locally.
+2. **Create a branch.** Use a descriptive name, e.g. `fix/oat-dcr-transform` or `feat/workbench-parser-iocs`.
+3. **Make your changes.** Edit templates, parser functions, or documentation. Keep changes focused — one logical change per PR.
+4. **Validate locally** before pushing (see below).
+5. **Commit your changes** with a clear message describing the *why*, not just the *what*.
+6. **Push to your fork** and open a pull request against `main` using the [PR template](.github/PULL_REQUEST_TEMPLATE.md).
+
+## Local Validation
+
+Before opening a pull request, please run these checks:
+
+### JSON syntax
+
+```bash
+find templates -name "*.json" -not -path "*/legacy/*" -print0 \
+  | xargs -0 -n1 jq empty
+```
+
+Every file must parse cleanly.
+
+### ARM template structure
+
+For changes to `mainTemplate.json` or any file under `templates/*/components/`, confirm the required top-level fields exist:
+
+```bash
+jq -e '.["$schema"] and .contentVersion and .resources' \
+  templates/workbench/mainTemplate.json
+```
+
+### Azure validation (recommended for template changes)
+
+If you have an Azure subscription with a Sentinel-enabled workspace, validate the deployment without actually creating resources:
+
+```bash
+az deployment group validate \
+  --resource-group <your-test-rg> \
+  --template-file templates/workbench/mainTemplate.json \
+  --parameters workspace=<workspace-name> trendaiRegion=US
+```
+
+### End-to-end deployment
+
+For non-trivial template changes, deploy to a test workspace and confirm data ingestion before requesting review. Note in the PR description which workspace/region you tested against.
+
+## Secure Contributor Setup
+
+A few one-time settings on your GitHub account make every contribution
+safer for you and for the people who deploy this connector.
+
+### Sign your commits
+
+We strongly recommend signing your commits with **GPG** or **SSH**. Signed
+commits show a green *Verified* badge on GitHub and make it harder for
+someone to impersonate you. See GitHub's guide:
+[About commit signature verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification).
+
+Quick start (SSH signing, Git 2.34+):
+
+```bash
+git config --global gpg.format ssh
+git config --global user.signingkey ~/.ssh/id_ed25519.pub
+git config --global commit.gpgsign true
+```
+
+Then add the **same** SSH public key on GitHub under
+*Settings → SSH and GPG keys* as a **Signing key** (not just an auth key).
+
+### Use short-lived Personal Access Tokens
+
+If you authenticate with HTTPS + a Personal Access Token, please set an
+**expiration date** on the token (90 days or less is a good default).
+Long-lived tokens are a top source of leaked credentials. Better still,
+use SSH or the GitHub CLI's OAuth flow.
+
+## Style Guidelines
+
+- **ARM JSON:** 2-space indentation, trailing newline. Keep `apiVersion` values consistent across components.
+- **Parameter names:** camelCase (matches existing templates).
+- **KQL:** Format multi-line queries with one clause per line; align `|` operators.
+- **Documentation:** Markdown headings use sentence case; code fences specify the language.
+
+## Pull Request Review
+
+- A maintainer will review your PR within a few business days.
+- Address review feedback in additional commits — don't force-push during active review.
+- Once approved, a maintainer will squash-merge to `main`.
+
+## Contact
+
+If you have questions about contributing, open a [GitHub discussion](https://github.com/trendmicro/trendai-sentinel-ccf-data-connector/discussions) or contact us at `alloftrendgithubenterpriseadmin@trendmicro.com`.
+
+## Acknowledgements
+
+Thank you to everyone who has helped improve these connectors. Every typo fix, parameter tweak, and parser improvement makes the project more useful for the Sentinel community.

Solutions/TrendAI Vision One/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Trend Micro Incorporated
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.