Fix malformed dataCollectionEndpoint expression in dcrConfig

[chkp-kirilll]

Change(s)

• Reverted incorrectly escaped inner-template ARM expressions from "[[expr]]" back to "[[expr]" (double opening bracket, single closing bracket) across both solutions:
  • Check Point Cyberint Alerts/Package/mainTemplate.json (190 expressions)
  • Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_PollingConfig.json (4 expressions)
  • Check Point Cyberint IOC/Package/mainTemplate.json (7 expressions)
  • Check Point Cyberint IOC/Data Connectors/CyberintArgosIOCLogs_ccp/CyberintArgosIOCLogs_PollingConfig.json (1 expression)
• Bumped solution versions: Alerts 3.1.3, IOC 3.0.5 (mainTemplate, Data/Solution_*.json).
• Updated ReleaseNotes.md for both solutions.
• Repackaged Package/3.1.3.zip and Package/3.0.5.zip.

No functional changes to connector polling logic, DCR/table schemas, playbooks, or UI definitions - the diff is exclusively the removal of one stray ] per affected expression, plus version metadata.

Reason for Change(s)

A fresh install of Check Point Cyberint Alerts Connector (via Codeless Connector Platform) v3.1.2 from the Content Hub fails at the "Connect" step of the data connector wizard :

Deployment template language expression evaluation failed: 'Unable to parse language
expression 'parameters('dcrConfig').dataCollectionEndpoint]': expected token 'EndOfData'
and actual 'RightSquareBracket'.'

Root cause: v3.1.2 shipped inner contentTemplate expressions escaped as "[[expr]]". ARM's escape rule strips only the leading [, so the stored template contains the literal [expr]]. When the Connect wizard deploys the stored ResourcesDataConnector template, ARM parses that as an expression with a trailing ] and fails. The correct convention - used by all published CCP solutions (e.g. 1Password, AWS ELB, 42Crunch) and by the V3 packaging tool - is "[[expr]".

The Cyberint IOC solution v3.0.4 shipped with the same defect in its polling config and would fail identically on a fresh Connect; it is fixed in the same way here.

The defect only affects the Connect-time deployment. Solution installation succeeds (the broken string is stored, not evaluated), and connectors connected under earlier versions keep polling - which is why the regression surfaced only on clean installs.

Version updated

• Check Point Cyberint Alerts: 3.1.3 (mainTemplate _solutionVersion, contentPackage metadata, Data/Solution_Cyberint.json, ReleaseNotes, package zip)
• Check Point Cyberint IOC: 3.0.5 (same set)

Testing completed

• Bug reproduced: the ResourcesDataConnector contentTemplate stored on a workspace by the v3.1.2 package fails az deployment group validate with the exact reported error (expected token 'EndOfData' and actual 'RightSquareBracket').
• Fix verified against live ARM: the corrected inner template - after applying the same [[ → [ unescape ARM performs at install time - passes az deployment group validate against a real Log Analytics workspace with identical parameters (provisioningState: Succeeded).
• Diff audited: all 226 changed template lines differ by exactly one removed ]; no other content changed.
• All modified JSON files parse cleanly.
• Repackaged zips verified to contain the fixed templates and bumped versions.
• Restored escaping is byte-identical in style to the last known-good release (v3.1.0, which connected successfully in production).

Checklist

• Solution version updated
• ReleaseNotes.md updated
• Package zip regenerated
• No secrets or customer-identifying data in the diff

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Fixes malformed nested ARM expression escaping that caused fresh Connect deployments to fail for the Check Point Cyberint Alerts/IOC codeless connectors, and bumps solution versions accordingly.

Changes:

• Reverted inner/nested ARM expression escaping from [[expr]] to [[expr] across templates and polling configs to remove the stray trailing ].
• Bumped solution/package versions (Alerts 3.1.3, IOC 3.0.5) across main templates and solution metadata.
• Updated release notes to document the fix.

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Solutions/Check Point Cyberint IOC/ReleaseNotes.md	Adds 3.0.5 entry documenting the ARM escaping fix.
Solutions/Check Point Cyberint IOC/Package/mainTemplate.json	Bumps versions and fixes nested template escaping that broke Connect-time deployments.
Solutions/Check Point Cyberint IOC/Data/Solution_Cyberint.json	Bumps solution version to 3.0.5.
Solutions/Check Point Cyberint IOC/Data Connectors/CyberintArgosIOCLogs_ccp/CyberintArgosIOCLogs_PollingConfig.json	Fixes escaped parameter expression in polling config.
Solutions/Check Point Cyberint Alerts/ReleaseNotes.md	Adds 3.1.3 entry documenting the ARM escaping fix.
Solutions/Check Point Cyberint Alerts/Package/mainTemplate.json	Bumps versions/descriptions and fixes nested template / playbook expression escaping.
Solutions/Check Point Cyberint Alerts/Data/Solution_Cyberint.json	Bumps solution version to 3.1.3.
Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_PollingConfig.json	Fixes escaped expressions in polling config.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-maheshbh (v-maheshbh)]

Hi chkp-kirilll

Kindly attach the CCF testing screenshot to verify the implemented changes.

Thanks!

[chkp-kirilll]

v-maheshbh (@v-maheshbh) Hi,

ver. 3.1.2

fixed ver. 3.1.3

Other applications also work good