Azure-Sentinel icon indicating copy to clipboard operation
Azure-Sentinel copied to clipboard

Add meshcloud meshStack events log connector solution

Open grubmeshi opened this issue 4 weeks ago • 1 comments

Change(s):

  • Add connector for Azure Sentinel reading meshStack event logs into the an Azure Sentinel enabled LAW.

Reason for Change(s):

  • Vertical/seamless integration of our meshStack product into Azure Sentinel.

Testing Completed:

  • Tested with newly created LAW with Sentinel enabled.
  • Connector works successfuly with meshStack demo instance.
  • LAW is filled with events from meshStack product.

Checked that the validations are passing and have addressed any issues that are present:

  • Installation of manually crafted mainTemplate.json works. Automatic packaging is TODO.

grubmeshi avatar Dec 16 '25 07:12 grubmeshi

@microsoft-github-policy-service agree company="meshcloud GmbH"

grubmeshi avatar Dec 16 '25 07:12 grubmeshi

Hi @grubmeshi, please review the error message regarding the logo validation failure and address it. Additionally, you need to generate the package with version 3.0.0, so please repackage the solution using the V3 tool - https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…. Thanks!

v-shukore avatar Dec 22 '25 12:12 v-shukore

Hi @grubmeshi, please review the error message regarding the logo validation failure and address it. Additionally, you need to generate the package with version 3.0.0, so please repackage the solution using the V3 tool - https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V3/README.…. Thanks!

@v-shukore Thanks for having a look at my changes. I've addressed them all I think. I've also successfully managed to package it on my Linux machine with a little fix to support relative basePath as I did not want to hardcode an absolute path in Solution_meshStack.json. I don't know if that will break CI or cause other problems, but the change (see separate commit) seems reasonable.

Let me know what's missing until this can be finally merged.

grubmeshi avatar Jan 02 '26 15:01 grubmeshi