A multi-account CCF candidate for Semperis Lightning

[sravansemperis]

Change(s):

Added Semperis Lightning CCF multi account

Reason for Change(s):

Adding Semperis Lightning CCF multi account (New solution)

Version Updated:

No (Initial Version)

Testing Completed:

Testing done in Semperis tenant

[MitchellGulledge3]

Review notes from live deploy (workspace test)

Two issues showed up when installing this PR’s package (595c9fe) in a Sentinel workspace:

1. zone type mismatch (blocks connection create)

Portal error:

The provided value for the template parameter zone is not valid. Expected a value of type String, Uri, but received a value of type Array.

The Context Pane Dropdown posts zone as an array (e.g. ["na"]). In this PR, zone is declared as a string/securestring and used as parameters('zone'). That fails ARM validation.

Fix: keep zone as type: array and use parameters('zone')[0] in poller names, addOnAttributes.SemperisZone, and API host URLs (same as Auth0/Citrix-style CCF). MULTI-ACCOUNT.md in this PR already documents [0].

2. Ship as an update to the existing Semperis Lightning offer

This PR introduces a new offer (semperis-sentinel-lightning-ccf). Content Hub should treat CCF as a second connector on the existing solution, like Netskope / SailPoint:

Field	Current PR	Needed
offerId	semperis-sentinel-lightning-ccf	azure-sentinel-solution-semperislightning
Connectors	CCF only	Azure Functions (*_CL) and CCF (*V2_CL)
CCF title	multi-instance CCF candidate	Semperis Lightning (via Codeless Connector Framework)
Version	4.0.2	4.1.0 (minor — new connector on existing offer)
TemplateSpec	false	true (matches the live Function App solution)

We validated a merged 4.1.0 package locally (ARM-TTK / solution validators passed) and deployed it to a test workspace. Happy to share the exact file diffs if useful.

I cannot push to sravansemperis/Azure-Sentinel from here — please apply the two changes above on this branch, or grant write / open a follow-up commit.

[MitchellGulledge3]

Follow-up after a successful portal Connect test of the merged 4.1.0 package.

Please apply these changes on this PR (we cannot push to sravansemperis/Azure-Sentinel):

1. Merge CCF into the existing Semperis Lightning offer (publisherId/offerId = semperis / azure-sentinel-solution-semperislightning), same Netskope/SailPoint pattern — Function App + CCF side by side. Do not ship a second Content Hub offer.
2. CCF Dropdown for zone posts an array. Declare zone as array and read parameters('zone')[0] in poller URLs/names.
3. Bump the CCF content item version with the solution (4.1.0). Leaving it at 4.0.2 keeps the old blade cached and reproduces the zone String vs Array validation error.

Tested reference (do not merge this fork PR):
https://github.com/MitchellGulledge3/Azure-Sentinel/tree/semperis-lightning-ccf-multi-account-reference/Solutions/SemperisLightningCCF
MitchellGulledge3#2

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Semperis Lightning Codeless Connector Framework (CCF) multi-instance / multi-account solution package for Microsoft Sentinel, including deployment templates, UI definition, connector configs, and custom table schemas.

Changes:

• Introduces solution metadata + release notes and solution “Data” manifest.
• Adds ARM package artifacts (mainTemplate, createUiDefinition, testParameters) to deploy connector definition, pollers, DCR, and tables.
• Adds connector source assets (poller config, DCR, connector definition, table schemas) plus an “unsupported capabilities” documentation file.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Solutions/SemperisLightningCCF/SolutionMetadata.json	Defines offer/solution metadata (publisher, version, support, categories).
Solutions/SemperisLightningCCF/ReleaseNotes.md	Adds version history/release notes for the solution.
Solutions/SemperisLightningCCF/Package/testParameters.json	Adds ARM TTK-friendly test parameter definitions.
Solutions/SemperisLightningCCF/Package/mainTemplate.json	Adds full deployable ARM template for connector definition, pollers, DCR, and tables.
Solutions/SemperisLightningCCF/Package/createUiDefinition.json	Adds installer UI definition (workspace selection + outputs).
Solutions/SemperisLightningCCF/MULTI-ACCOUNT.md	Adds multi-account setup/notes documentation.
Solutions/SemperisLightningCCF/Data/Solution_SemperisLightningCCF.json	Registers the solution manifest and points to connector assets.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/unsupported-capabilities.json	Documents inactive/partial streams and assumptions (auth/pagination).
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningTier0NodesV2_CL.json	Defines V2 custom table schema for Tier0 nodes.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningTier0AttackersV2_CL.json	Defines V2 custom table schema for Tier0 attackers.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningIndicatorExecutionsV2_CL.json	Defines V2 custom table schema for indicator executions.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningIOEsMetadataV2_CL.json	Defines V2 custom table schema for IOE metadata.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningIOEResultsV2_CL.json	Defines V2 custom table schema for IOE results.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningAttackPathsV2_CL.json	Defines V2 custom table schema for attack paths.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/table_LightningAttackPathLinksV2_CL.json	Defines V2 custom table schema for attack path links.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/SemperisLightning_PollerConfig.json	Defines multi-instance poller resources and addOnAttributes.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/SemperisLightning_DCR.json	Defines DCR stream declarations + transforms for all streams.
Solutions/SemperisLightningCCF/Data Connectors/SemperisLightning_CCF/SemperisLightning_ConnectorDefinition.json	Defines the customizable data connector UX (grid + context pane).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MitchellGulledge3]

Addressed the Copilot review comments on the tested 4.1.0 reference, and included the existing-offer merge (Function App + CCF).

Comment	Change
MULTI-ACCOUNT.md “Do not merge”	Removed. Doc now describes the shippable dual-connector offer.
ReleaseNotes.md table pipes	Normalized the 3.0.0 row; 4.1.0 row documents the merge + zone + RG filter.
createUiDefinition.json contains(rg name)	Both workspace filters now match /resourceGroups/<name>/ (case-insensitive).
testParameters.json “setup”	Changed to “set up”.

Also on that branch (not in this PR yet):

• offerId = azure-sentinel-solution-semperislightning
• Function App + CCF connectors
• zone is array + parameters('zone')[0]
• CCF content version 4.1.0 (portal Connect succeeded)

Please pull these into this PR — we cannot push sravansemperis/Azure-Sentinel:
https://github.com/MitchellGulledge3/Azure-Sentinel/tree/semperis-lightning-ccf-multi-account-reference/Solutions/SemperisLightningCCF
MitchellGulledge3#2