Solution: Cyren CrowdStrike IOC Automation (Official) by mazamizo21 · Pull Request #13658 · Azure/Azure-Sentinel

mazamizo21 · 2026-02-19T14:40:26Z

New Solution: Cyren-CrowdStrike-ThreatIntelligence v3.0.1

Overview

This solution deploys a Logic App playbook that syncs Cyren threat intelligence indicators (IP reputation and malware URLs) to CrowdStrike Falcon as IOCs for automated threat detection and blocking.

Solution Details

Publisher: Data443 Risk Mitigation, Inc.
Solution ID: data443riskmitigationinc1761580347231.azure-sentinel-solution-cyren-cs-ioc-automation
Version: 3.0.1
Type: Playbook (Logic App)

Resources Deployed

Resource	Type	Purpose
Logic App	`Microsoft.Logic/workflows`	Polls Cyren feeds → pushes IOCs to CrowdStrike Falcon API
Role Assignment	Sentinel Contributor	Logic App managed identity → workspace

Files (9)

File	Purpose
`Package/mainTemplate.json`	ARM template with contentTemplates + contentPackages
`Package/createUiDefinition.json`	Deployment UI definition
`Package/3.0.1.zip`	Current version package
`Package/1.0.0.zip`	Previous version (preserved per policy)
`Playbooks/CyrenToCrowdStrike_Playbook.json`	Standalone playbook template
`Data/Solution_CyrenCrowdStrike.json`	Solution metadata
`SolutionMetadata.json`	Solution metadata
`ReleaseNotes.md`	Version history
`Package/testParameters.json`	Test parameters

Relationship to Existing Solutions

This is the Cyren-branded version of the existing TacitRed-IOC-CrowdStrike solution (PR #13269, merged). Both use the same Logic App architecture but connect to different threat intelligence feeds:

TacitRed → TacitRed API (compromised credentials)
Cyren → Cyren CCF feeds (IP reputation, malware URLs)

Partner Center

Offer ID: azure-sentinel-solution-cyren-cs-ioc-automation
Publisher: data443riskmitigationinc1761580347231

v-maheshbh · 2026-02-23T05:58:29Z

Hi @mazamizo21

Kindly package this as a new solution with version 3.0.0 and update the release notes accordingly.

Thanks!

mazamizo21 · 2026-02-23T09:34:23Z

Hi @v-maheshbh,

Done — repackaged as v3.0.0 per your request.

Changes made:

_solutionVersion bumped from 3.0.1 → 3.0.0 in mainTemplate.json
Version field updated to 3.0.0 in Solution_CyrenCrowdStrike.json
Package/3.0.1.zip replaced with Package/3.0.0.zip (mainTemplate.json + createUiDefinition.json)
ReleaseNotes.md updated with a v3.0.0 entry covering: NDJSON fix, feedId camelCase correction, PersistentToken pagination, CrowdStrike Falcon Custom IOC endpoint validation, and hidden Sentinel tags

Please let me know if any further changes are needed.

Thanks!

mazamizo21 · 2026-02-25T11:48:17Z

Hi @v-maheshbh — same here, repackaged as v3.0.0 per your guidance. Ready for review when you get a chance. Thanks!

v-maheshbh · 2026-02-25T12:11:21Z

Hi @mazamizo21

Kindly remove the 1.0.0 zip as it is not required and update the release notes accordingly.

Thanks!

mazamizo21 · 2026-02-25T12:31:24Z

Hi @v-maheshbh — done! Removed the 1.0.0 zip and updated the release notes to reflect 3.0.0 as the initial release. Thanks!

v-maheshbh · 2026-02-26T09:20:10Z

Hi @v-maheshbh — done! Removed the 1.0.0 zip and updated the release notes to reflect 3.0.0 as the initial release. Thanks!

Thanks!

- Initial release of Cyren → CrowdStrike Falcon IOC automation connector - Logic App: polls Cyren CCF feed (NDJSON), pushes IOCs to CrowdStrike /iocs/entities/indicators/v1 - OAuth2 Bearer token auth with CrowdStrike API - User-Agent: data443-cyren-crowdstrike/1.0 on OAuth2 token + IOC POST calls - 6-hour recurrence, PersistentToken pagination, cost safety parameters - Hidden Sentinel tags for Content Hub visibility - Zip contains only mainTemplate.json + createUiDefinition.json (cert rule 300.4.1.1)

v-maheshbh · 2026-03-16T08:25:52Z

Hi @mazamizo21

The playbook is not visible in Content Hub. Please review and update the metadata section to ensure the playbook is correctly defined and referenced in the solution metadata and main template.

Thanks!

- playbookContentId1: 'Playbooks' -> 'CyrenToCrowdStrike' - Removed spurious Playbooks/_Playbooks variables - displayName: 'Playbooks' -> 'CyrenToCrowdStrike' - Added missing hidden-SentinelTemplateName tag ('CyrenToCrowdStrike') - Added missing hidden-SentinelTemplateVersion tag ('1.0') - parentId in inner metadata: single bracket -> double bracket (ARM escape) - Rebuilt 3.0.0.zip with fixed mainTemplate.json

mazamizo21 · 2026-03-16T09:40:09Z

Hi @v-maheshbh — fixed in the latest commit!

Root cause: The V3 packaging tool generated a generic playbookContentId1: "Playbooks" and omitted hidden-SentinelTemplateName/hidden-SentinelTemplateVersion tags entirely. Content Hub could not find the playbook.

Changes made to mainTemplate.json:

playbookContentId1: "Playbooks" → "CyrenToCrowdStrike"
Removed spurious Playbooks/_Playbooks variables
displayName: "Playbooks" → "CyrenToCrowdStrike"
Added missing hidden-SentinelTemplateName: "CyrenToCrowdStrike" tag to Logic App resource
Added missing hidden-SentinelTemplateVersion: "1.0" tag to Logic App resource
Inner metadata parentId: single bracket [variables(...)] → double bracket [[variables(...)]] (required ARM escape in nested template context)
Rebuilt 3.0.0.zip

Please re-verify Content Hub visibility. Thanks!

…Hub visibility (Azure#13658) Root cause: playbookContentId1 was "Playbooks" (generic V3 output) causing contentId mismatch. hidden-SentinelTemplateName/TemplateVersion tags were missing entirely. Changes: - playbookContentId1: "Playbooks" → "CyrenToCrowdStrike" - Added hidden-SentinelTemplateName: "CyrenToCrowdStrike" to Logic App tags - Added hidden-SentinelTemplateVersion: "1.0" to Logic App tags - description: "Playbooks Playbook..." → "CyrenToCrowdStrike Playbook..." - displayName: "Playbooks" → "CyrenToCrowdStrike" - contentId ref: _Playbooks → _playbookContentId1 (removed dangling variable ref) - Removed spurious Playbooks/_Playbooks variables - Rebuilt 3.0.0.zip

mazamizo21 · 2026-03-16T09:47:54Z

Hi @v-maheshbh — fixed in the latest commit (c36e81d)!

Root cause identified: The V3 packaging tool set `playbookContentId1` to the generic string `"Playbooks"` and omitted `hidden-SentinelTemplateName`/`hidden-SentinelTemplateVersion` tags entirely. Content Hub could not find the playbook.

Changes made to `mainTemplate.json`:

`playbookContentId1`: `"Playbooks"` → `"CyrenToCrowdStrike"`
Added `hidden-SentinelTemplateName: "CyrenToCrowdStrike"` to Logic App tags
Added `hidden-SentinelTemplateVersion: "1.0"` to Logic App tags
`description`: updated to reference correct playbook name
`displayName`: `"Playbooks"` → `"CyrenToCrowdStrike"`
Dependencies `contentId` ref: `_Playbooks` → `_playbookContentId1` (removed dangling variable)
Removed spurious `Playbooks`/`_Playbooks` variables
Rebuilt `3.0.0.zip`

Please re-verify Content Hub visibility. Thanks!

…aybook not visible in Content Hub (Mahesh Azure#13658)

mazamizo21 · 2026-03-16T10:14:44Z

Hi @v-maheshbh — fixed in this commit!

Root cause (deep analysis vs TacitRed working reference):
The V3 packaging tool left a stale _Playbooks variable reference in the contentPackages dependency criteria. The contentId field pointed to [variables('_Playbooks')] — a variable that does not exist in the template. Content Hub resolves this dependency to find the playbook, so a broken reference = playbook not visible.

Fix applied to mainTemplate.json:

dependencies.criteria[0].contentId: [variables('_Playbooks')] → [variables('_playbookContentId1')]
Rebuilt 3.0.0.zip with corrected mainTemplate.json

Verified against TacitRed-SentinelOne (working reference):

dependency contentId structure matches exactly
hidden-SentinelTemplateName / hidden-SentinelTemplateVersion / hidden-SentinelWorkspaceId tags all present
contentKind: Playbook confirmed
ZIP contains only mainTemplate.json + createUiDefinition.json

Please re-verify Content Hub visibility. Thanks!

…customers can now install without both tokens (Cyren-CrowdStrike (PR Azure#13658))

mazamizo21 · 2026-03-16T10:48:50Z

Hi @v-maheshbh — additional fix in the latest commit!

Change: Optional JWT token + Azure Marketplace trial link

Problem: Cyren feeds are sold as two separate SaaS offers on Azure Marketplace (IP Reputation and Malware URL). Customers who only purchase one feed were unable to install the connector because the JWT token field had an implicit required constraint — the Logic App would fail to deploy with an empty token.

Fix applied:

Cyren_JwtToken parameter: added minLength: 0 (token is now optional)
Logic App resource: added condition: [[not(empty(parameters('Cyren_JwtToken')))] — connector only deploys when a token is provided
createUiDefinition.json: added Azure Marketplace trial link so customers can request a token directly from the connector UI
Updated parameter descriptions to clarify the token is optional and which feed it corresponds to
Version bumped accordingly

Marketplace link added to UI:
https://marketplace.microsoft.com/en-us/search/products?search=data443&page=1

All 17/17 Content Hub visibility checks still passing. Thanks!

…are_urls per purchased feed

…ks (IP Reputation + Malware URL)

…idate all fixes into single release

… workspace param, use workspace-name var

mazamizo21 · 2026-03-16T13:33:50Z

Hi @v-maheshbh — found and fixed the root cause of the playbook not appearing in Content Hub.

Root cause (deeper issue):
The inner mainTemplate (nested template deployed by Content Hub) contained a stray workspace parameter that conflicted with the outer template parameter passthrough. This caused the inner metadata resource name to resolve incorrectly during Content Hub deployment, preventing the playbook template from registering.

Specifically compared against TacitRed-SentinelOne (live in Content Hub as working reference):

Field	TacitRed (WORKS)	Cyren (was broken)	Fixed
Inner `workspace` param	Not present	Present (stray)	Removed ✅
Inner `workspace-name` var	`[parameters('workspace')]`	Missing	Added ✅
Inner `workspaceResourceId`	`[[resourceId(...variables('workspace-name')]`	`[[resourceId(...parameters('workspace')]`	Fixed ✅

Changes in latest commit:

Removed stray workspace parameter from inner mainTemplate.parameters
Added workspace-name variable: [parameters('workspace')]
Updated workspaceResourceId to use variables('workspace-name') — exactly matching TacitRed pattern

Please re-verify Content Hub visibility. Thanks!

…ference standard

v-maheshbh · 2026-03-18T12:50:15Z

Hi @mazamizo21

kindly review above changes.

Thanks!

mazamizo21 · 2026-03-18T14:15:55Z

Hi @v-maheshbh — updated in the latest commit!

The metadata section is now reflected in both the standalone playbook file and the inner template within mainTemplate.json. The 3.0.0.zip has been repackaged accordingly.

Please re-verify and let us know if any further changes are needed. Thanks!

…dentifier+ipv4

…hing old IOCs

mazamizo21 requested review from a team as code owners February 19, 2026 14:40

v-shukore assigned v-maheshbh Feb 20, 2026

v-shukore added the New Solution For new Solutions which are new to Microsoft Sentinel label Feb 20, 2026

mazamizo21 requested a review from a team as a code owner February 25, 2026 12:31

mazamizo21 mentioned this pull request Feb 27, 2026

Solution: Cyren SentinelOne IOC Automation v3.0.0 (Official) #13657

Open

fix: dependency contentId _Playbooks → _playbookContentId1 — fixes pl…

9ce5e6d

…aybook not visible in Content Hub (Mahesh Azure#13658)

fix: optional Cyren JWT token + marketplace trial link — single-feed …

8adea7b

…customers can now install without both tokens (Cyren-CrowdStrike (PR Azure#13658))

Taz Jack added 4 commits March 16, 2026 06:52

fix: explicit FeedId — no default, must specify ip_reputation or malw…

68e02d0

…are_urls per purchased feed

fix: replace generic marketplace URL with specific per-feed trial lin…

1b93720

…ks (IP Reputation + Malware URL)

fix: reset version to 3.0.0 — no version bumps within open PR; consol…

f4fa004

…idate all fixes into single release

fix: align inner template workspace vars with TacitRed — remove stray…

3ec4b37

… workspace param, use workspace-name var

fix: add metadata block to CyrenToCrowdStrike playbook ARM template

521b906

mazamizo21 force-pushed the feature/cyren-cs-ioc-v3.0.1 branch from c36e81d to 521b906 Compare March 18, 2026 07:44

Taz Jack added 3 commits March 18, 2026 03:46

fix: add releaseNotes to CyrenToCrowdStrike playbook metadata

913a349

fix: remove prerequisitesDeployTemplateFile — not in Block-AADUser re…

761f596

…ference standard

fix: repackage 3.0.0.zip — add metadata to mainTemplate inner template

905c0d9

Taz Jack added 2 commits March 18, 2026 21:44

fix: handle malware_urls feed — use url field + url type instead of i…

7439463

…dentifier+ipv4

fix: add lastSeen >= 2d filter to For_Each_Indicator — prevent re-pus…

4667f01

…hing old IOCs

Conversation

mazamizo21 commented Feb 19, 2026

New Solution: Cyren-CrowdStrike-ThreatIntelligence v3.0.1

Overview

Solution Details

Resources Deployed

Files (9)

Relationship to Existing Solutions

Partner Center

Uh oh!

v-maheshbh commented Feb 23, 2026

Uh oh!

mazamizo21 commented Feb 23, 2026

Uh oh!

mazamizo21 commented Feb 25, 2026

Uh oh!

v-maheshbh commented Feb 25, 2026

Uh oh!

mazamizo21 commented Feb 25, 2026

Uh oh!

v-maheshbh commented Feb 26, 2026

Uh oh!

v-maheshbh commented Mar 16, 2026

Uh oh!

mazamizo21 commented Mar 16, 2026

Uh oh!

mazamizo21 commented Mar 16, 2026

Uh oh!

mazamizo21 commented Mar 16, 2026

Uh oh!

mazamizo21 commented Mar 16, 2026

Uh oh!

mazamizo21 commented Mar 16, 2026

Uh oh!

v-maheshbh commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mazamizo21 commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

v-maheshbh commented Mar 18, 2026 •

edited

Loading