SpyCloud CCF Connector

[RamboV]

Required items, please complete

Change(s):

Added new Spycloud CCF Connector
Reason for Change(s):

New Spycloud CCF Connector
Version Updated:

None
Testing Completed:

Yes
Checked that the validations are passing and have addressed any issues that are present:

See guidance below

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new SpyCloud Enterprise Protection CCF-based Microsoft Sentinel solution package, including connector definition/poller/DCR/table schemas plus supporting parsers, analytic rules, and response playbooks.

Changes:

• Added solution metadata, release notes, solution packaging (UI definition + parameters), and solution manifest entries.
• Added CCF data connector assets: connector definition, poller config, DCR transforms, and custom table schemas.
• Added content artifacts: KQL parsers, analytic rules, and three playbook ARM templates (MDE automation, Conditional Access automation, and Automation Rules glue).

Reviewed changes

Copilot reviewed 27 out of 29 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
Solutions/SpyCloud Enterprise Protection CCF/SolutionMetadata.json	Adds solution metadata for publisher/offer, categories, and support.
Solutions/SpyCloud Enterprise Protection CCF/ReleaseNotes.md	Introduces initial release notes entry for the solution.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_MDE_Automation/readme.md	Documents deployment and parameters for the MDE automation playbook.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_MDE_Automation/azuredeploy.json	Adds Logic App + connections template for MDE response automation and log ingestion.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_Conditional_Access_Playbook/readme.md	Documents deployment and parameters for the Conditional Access playbook.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_Conditional_Access_Playbook/azuredeploy.json	Adds Logic App template for Entra ID response actions and log ingestion.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_AutomationRules/readme.md	Documents deployment and parameters for Sentinel automation rules wiring.
Solutions/SpyCloud Enterprise Protection CCF/Playbooks/SpyCloud_AutomationRules/azuredeploy.json	Adds ARM template to deploy two Sentinel automation rules to run the playbooks.
Solutions/SpyCloud Enterprise Protection CCF/Parsers/get_spycloud_compass_data.yaml	Adds parser function definition for Compass feed table.
Solutions/SpyCloud Enterprise Protection CCF/Parsers/get_Spycloud_enriched_data.yaml	Adds parser function joining watchlist data with breach catalog enrichment.
Solutions/SpyCloud Enterprise Protection CCF/Package/testParameters.json	Adds ARM TTK-related test parameters for packaging validation.
Solutions/SpyCloud Enterprise Protection CCF/Package/createUiDefinition.json	Adds UI definition for Content Hub install experience.
Solutions/SpyCloud Enterprise Protection CCF/Data/Solution_SpyCloudEnterpriseProtection.json	Adds solution manifest referencing all included artifacts.
Solutions/SpyCloud Enterprise Protection CCF/Data Connectors/SpyCloudEnterpriseProtectionLogsV2_ccp/SpyCloudEnterpriseProtectionLogsV2_connectorDefinition.json	Defines the CCF connector UI and parameters (API key, severity, compass toggle).
Solutions/SpyCloud Enterprise Protection CCF/Data Connectors/SpyCloudEnterpriseProtectionLogsV2_ccp/SpyCloudEnterpriseProtectionLogsV2_Tables.json	Declares Log Analytics custom table schemas used by connector and playbooks.
Solutions/SpyCloud Enterprise Protection CCF/Data Connectors/SpyCloudEnterpriseProtectionLogsV2_ccp/SpyCloudEnterpriseProtectionLogsV2_PollerConfig.json	Configures REST pollers for watchlist, catalog, and optional compass ingestion.
Solutions/SpyCloud Enterprise Protection CCF/Data Connectors/SpyCloudEnterpriseProtectionLogsV2_ccp/SpyCloudEnterpriseProtectionLogsV2_DCR.json	Adds DCR stream declarations and KQL transforms for ingestion into LA tables.
Solutions/SpyCloud Enterprise Protection CCF/Analytic Rules/AR_malware_25.yaml	Adds scheduled analytic rule for infostealer malware-related exposures.
Solutions/SpyCloud Enterprise Protection CCF/Analytic Rules/AR_Breached_Users_20.yaml	Adds scheduled analytic rule for plaintext credential exposure.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Registers the connectorId for schema validation tests.
.script/tests/KqlvalidationsTests/CustomTables/spycloud_compassV2_CL.json	Adds KQL validation schema for Compass custom table.
.script/tests/KqlvalidationsTests/CustomTables/Spycloud_MDE_LogsV2_CL.json	Adds KQL validation schema for MDE playbook logs table.
.script/tests/KqlvalidationsTests/CustomTables/SpyCloud_ConditionalAccessLogsV2_CL.json	Adds KQL validation schema for Conditional Access playbook logs table.
.script/tests/KqlvalidationsTests/CustomTables/SpyCloudBreachWatchlistV2_CL.json	Adds KQL validation schema for Watchlist custom table.
.script/tests/KqlvalidationsTests/CustomTables/SpyCloudBreachCatalogV2_CL.json	Adds KQL validation schema for Breach Catalog custom table.
.script/tests/KqlvalidationsTests/CustomFunctions/get_spycloud_compass_data.json	Adds KQL validation schema for Compass parser function.
.script/tests/KqlvalidationsTests/CustomFunctions/get_Spycloud_enriched_data.json	Adds KQL validation schema for enriched parser function.

[RamboV]

Hi @v-shukore, I have resolved the copilot issues. Please review.
Thanks,