Update NordStellar connector to version 3.0.1

[mantasg-nordsec]

Change(s):

• NordStellar solution updated from version 3.0.0 to 3.0.1.
• NordStellar_CL DCR transform now sets TimeGenerated to ingestion time instead of the event's original timestamp (date_added/detected_at). Historical events with timestamps older than the Log Analytics ingestion-time limit (~2 days) were previously rejected.
• Added a new EventTime datetime column to the NordStellar_CL table schema, preserving the original event timestamp (detected_at for attack-surface/domain-permutation events, date_added otherwise, envelope time as fallback).
• Fixed AssetType for CONSUMER_CREDENTIAL events: now DOMAIN (the customer-owned domain in asset_value) instead of the credential origin (MALWARE_INFECTION/COMBO_LIST) leaking in from source_type.
• Updated connector description, sample queries, instruction steps, table column descriptions, and ReleaseNotes.md accordingly.
• Package regenerated with the V3 packaging tool (createSolutionV3.ps1); new Package/3.0.1.zip.

Reason for Change(s):

• Customers ingesting historical NordStellar events (e.g. data breaches with date_added months or years in the past) had those events silently dropped because TimeGenerated fell outside the allowed ingestion window. Using ingestion time guarantees delivery while EventTime retains the original timestamp for querying. This aligns the Sentinel connector with the behavior of NordStellar's other SIEM integrations.
• AssetType for CONSUMER_CREDENTIAL events was semantically wrong (showed the leak origin rather than the asset type).

Version Updated:

• Yes — solution version bumped to 3.0.1 (Data file, mainTemplate, ReleaseNotes.md). No detections/analytic rule templates in this solution.

Testing Completed:

• Yes
• arm-ttk validation run locally via the V3 packaging tool (passing; the single IDs Should Be Derived From ResourceIDs failure is the known false positive on tool-generated contentProductId expressions).
• DCR transform KQL validated in Log Analytics against sample events for all affected paths (historical date_added, detected_at, CONSUMER_CREDENTIAL asset mapping); only operators from the supported transformation KQL subset are used.
• 3.0.1 mainTemplate deployed to a test Microsoft Sentinel workspace (with no custom parsers/functions) over an existing 3.0.0 install to validate the upgrade path: connector definition updates to 3.0.1, NordStellar_CL schema gains the EventTime column, and pushed test events land with TimeGenerated = ingestion time and EventTime = original event timestamp.

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the NordStellar Sentinel solution to v3.0.1, adjusting the DCR transform so historical events aren’t dropped due to ingestion-time limits while preserving original event timestamps in a new EventTime column.

Changes:

• Bumped solution and connector versions from 3.0.0 to 3.0.1 across packaging artifacts.
• Updated DCR transform to set TimeGenerated to ingestion time and added EventTime for original timestamps.
• Adjusted CONSUMER_CREDENTIAL mapping (AssetType) and refreshed documentation/sample queries/schema descriptions.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Solutions/NordStellar/ReleaseNotes.md	Adds 3.0.1 release notes describing ingestion-time change, EventTime, and AssetType fix.
Solutions/NordStellar/Package/mainTemplate.json	Bumps versions, updates connector docs/sample queries, updates DCR transform and table schema to include EventTime.
Solutions/NordStellar/Data/Solution_NordStellar.json	Bumps solution version to 3.0.1.
Solutions/NordStellar/Data Connectors/NordStellar_ccf/table.json	Adds EventTime column and updates column descriptions for new semantics.
Solutions/NordStellar/Data Connectors/NordStellar_ccf/connectorDefinition.json	Updates description/sample queries/instructions to reference EventTime and ingestion-time semantics.
Solutions/NordStellar/Data Connectors/NordStellar_ccf/DCR.json	Updates transform KQL to set TimeGenerated to now(), add EventTime, and adjust AssetType mapping.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-atulyadav]

Hi mantasg-nordsec,
I noticed that version 3.0.0 has been removed. Since we maintain the version history, please revert this removal and retain version 3.0.0 in the solution.

Also, please share a screenshot showing that the connector is running successfully.

If possible, please also shorten the release note description to make it more concise. Thanks

[mantasg-nordsec]

Hi v-atulyadav ,

• Restored package 3.0.0
• Shortened release notes
• Fixed URL in connector description
• Added screenshot:

Let me know if there's anything else missing, thanks!