Add Red Sift solution (Push connector via Codeless Connector Framework)

[earada]

Change(s):

• Add the new Red Sift Microsoft Sentinel solution.
• Add the push connector definition, DCR, and table artifacts for RedSiftAuth_CL and RedSiftEmailForensics_CL.
• Add five analytic rules covering new-IP sign-ins, MFA disabled events, and suspicious email URL activity.

Reason for Change(s):

• Enable ingestion of Red Sift events into Microsoft Sentinel.
• Provide out-of-box detections for identity and email threat scenarios.

Version Updated:

• Yes, initial solution version added. Use the final packaged version here.

Testing Completed:

• Deployed in a test Sentinel workspace and verified ingestion into RedSiftAuth_CL and RedSiftEmailForensics_CL.
• Validated the five analytic rules against ingested sample events.

Checked that the validations are passing and have addressed any issues that are present:

• Need Help

[earada]

@microsoft-github-policy-service agree company="Red Sift"

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Red Sift Microsoft Sentinel solution package, including solution metadata/release notes, solution definition, analytic rules, and validation artifacts to support ingestion and detections for Red Sift auth + email forensics signals.

Changes:

• Added SolutionMetadata.json, ReleaseNotes.md, and Solution_RedSift.json for the new solution.
• Added five Scheduled analytic rules for new-IP logins, MFA disabled, and suspicious email URL scenarios.
• Updated repo validation artifacts (connector ID allowlist + custom table schemas for KQL validation).

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Solutions/Red Sift/SolutionMetadata.json	Introduces marketplace metadata (publisher/offer/support info) for the Red Sift solution
Solutions/Red Sift/ReleaseNotes.md	Adds initial release notes entry for the solution version
Solutions/Red Sift/Package/testParameters.json	(Ignored for review per repo guidance) ARM test parameters for the packaged solution
Solutions/Red Sift/Package/mainTemplate.json	(Ignored for review per repo guidance) Main ARM template for solution packaging/content deployment
Solutions/Red Sift/Package/createUiDefinition.json	(Ignored for review per repo guidance) Portal UI definition for solution deployment experience
Solutions/Red Sift/Data/Solution_RedSift.json	Defines solution composition (connectors/rules), metadata linkage, and versioning for packaging
Solutions/Red Sift/Data Connectors/RedSift_ccp/RedSift_table.json	(Ignored for review per repo guidance) Custom table artifact for RedSiftAuth_CL
Solutions/Red Sift/Data Connectors/RedSift_ccp/RedSift_EmailForensics_table.json	(Ignored for review per repo guidance) Custom table artifact for RedSiftEmailForensics_CL
Solutions/Red Sift/Data Connectors/RedSift_ccp/RedSift_Definition.json	(Ignored for review per repo guidance) Push connector definition for CCF/CCP
Solutions/Red Sift/Data Connectors/RedSift_ccp/RedSift_DCR.json	(Ignored for review per repo guidance) DCR artifact for CCP ingestion + transforms
Solutions/Red Sift/Data Connectors/RedSift_ccp/RedSift_Connector.json	(Ignored for review per repo guidance) Connector instance artifact for push connector
Solutions/Red Sift/Analytic Rules/RedSiftMFADisabled.yaml	Adds detection for MFA disablement events in Red Sift auth telemetry
Solutions/Red Sift/Analytic Rules/RedSiftLoginFromNewIP.yaml	Adds detection for successful logons from previously unseen IPs
Solutions/Red Sift/Analytic Rules/RedSiftEmailUrlWithNewDomain.yaml	Adds detection for email URLs pointing to previously unseen domains
Solutions/Red Sift/Analytic Rules/RedSiftEmailUrlFromNewSource.yaml	Adds detection for URL-bearing email from previously unseen source IPs
Solutions/Red Sift/Analytic Rules/RedSiftEmailUrlFromNewSender.yaml	Adds detection for URL-bearing email from previously unseen senders
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Allows RedSiftPush as a valid connectorId for detection templates
.script/tests/KqlvalidationsTests/CustomTables/RedSiftEmailForensics_CL.json	Adds custom table schema for KQL validation of email forensics queries
.script/tests/KqlvalidationsTests/CustomTables/RedSiftAuth_CL.json	Adds custom table schema for KQL validation of auth queries