Add community Hubspot solution using CCF connector

[pl4nty]

Change(s):

• New community Hubspot solution, using a CCF connector with two tables

Reason for Change(s):

• No Hubspot solution or connector exists

Version Updated:

• Used the versions from this commit

Testing Completed:

• mainTemplate.json is deployed in our Sentinel environment
• Is there a way for users to disable tables with CCF? Some users might want security events but not audit logs

Checked that the validations are passing and have addressed any issues that are present:

• Latest version lint - Do the versions need to use latest? I noticed older versions in this commit
• Resource ID lint - I used createSolutionV3.ps1 to generate mainTemplate.json. Does the template need to be edited manually?

[v-maheshbh]

Hi @pl4nty
Kindly add the release notes with the proper date and a brief comment.
Modify the BasePath to the following structure:
C:\GitHub\Azure-Sentinel\solutions\Solution Name
and ensure that the definition file name and the ID value are identical. please refer to any existing CCF solution for guidance.

Kindly attach the screenshot showing the CCF connector in a connected state, and also include the invocation logs for reference.

Thanks!

[v-maheshbh]

Hi @pl4nty
Kindly review the comment provided above at your earliest convenience.

Thanks!

[pl4nty]

@v-maheshbh apologies, I've been on holiday and won't return for a few weeks

[pl4nty]

Thanks, fixed. Here's the connector screenshot, but I'm not sure how to get invocation logs.

[v-maheshbh]

Hi @pl4nty

Path to check invocation logs for the CCF connector: Function App > Functions > HubSpot > Monitor > Invocation logs

and Kindly verify the dataType value mentioned in the pollerConfig.json file and ensure it matches the table name defined in the connector’s ARM template.

Thanks!

[pl4nty]

Thanks for the logs path, but that looks like it's for Function Apps. This is a CCF connector so there's no Function App visible in the portal.

The dataType without _CL works because it matches the table's object name. But I can change both of them if you prefer.

[pl4nty]

@srsistla thanks for the detailed feedback, I've made those changes. Is retentionInDays required? In our workspace, other CCF tables use the default workspace retention, and we prefer that

[srsistla]

@pl4nty Looks much better to me. Having retentionInDays is more of a "highly recommended" option as we use custom tables and definition of retention period helps in maintenance.

Unfortunately, I do not see the option to approve or merge. @hassanchawiche could you please review and approve? LGTM.

[mprossau]

I am testing out this CCF in my local environment.

I've hit one issue in the dataConnectors for HubspotSecurityActivity.

connectorDefinitionName is set to 'Hubspot'. When I try to connect the connector via the UI, I receive the following error:

Deployment Failed At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.</br>{ "error": { "code": "BadRequest", "message": "The connector definition Hubspot does not exist." } }</br>

I have updated the connectorDefinitionName to Hubtspotdefinition and both connectors now connect.

[pl4nty]

@mprossau thanks for testing, fixed. I guess I should've deleted/recreated the connector instead of just redeploying

[pl4nty]

@hassanchawiche any chance you can take a look at this please?

[v-maheshbh]

Hi @pl4nty

Kindly update the value from 'Community' to 'Partner Supported.

Thanks!

[pl4nty]

@v-maheshbh What does "Partner Supported" mean? My employer (Devicie) won't provide commercial support for this solution, we just want to help the Sentinel community by sharing something we built

[pl4nty]

@v-maheshbh bump

[pl4nty]

[pl4nty]

@v-maheshbh please

[v-maheshbh]

Hi @pl4nty

As this is a community-supported solution, it is not backed by official support and is maintained on a best-effort basis. Support and maintenance typically rely on the contributors.
Kindly confirm whether you will be able to extend support in the future if any issues or updates are required.

Thanks!

[pl4nty]

thanks for taking a look at this! I'm happy to support this in the future

[v-maheshbh]

Hi @pl4nty

The email field is mandatory and currently missing in the support section.
Additionally, please update the name field to the correct and expected value.

Thanks!

[pl4nty]

@v-maheshbh done 😄

[v-maheshbh]

Hi @pl4nty

The support link should be organization/company-specific rather than pointing to the generic Azure Sentinel GitHub issues page. Please update the support.link field to the appropriate support portal, documentation site, or contact page maintained by your organization for this solution.

Thanks!