QualysVM 3.0.9 - fix Defender portal CCF data connector page KQL parse error#14475
Open
v-krishnachi wants to merge 1 commit into
Open
QualysVM 3.0.9 - fix Defender portal CCF data connector page KQL parse error#14475v-krishnachi wants to merge 1 commit into
v-krishnachi wants to merge 1 commit into
Conversation
v-krishnachi
force-pushed
the
v-krishnachi/qualysvm-3.0.9-graphqueries-fix
branch
from
82b8ae5 to
ba01c94
Compare
…ide KQL parse error
Root cause: When a dataConnectorDefinition (kind: Customizable) is created using API version 2024-01-01-preview or later, the graphQueriesTableName field in connectorUiConfig is dropped during storage by the internal model. This causes {{graphQueriesTableName}} to appear as literal text in the portal instead of the resolved table name, resulting in a 'Query could not be parsed' KQL error when the connector page is opened from security.microsoft.com.
Fix (Option A per the unified connectors team): Remove graphQueriesTableName property and inline the literal table name 'QualysHostDetectionV3_CL' directly into baseQuery, sampleQueries[].query, dataTypes[].name, and dataTypes[].lastDataReceivedQuery.
Customers must reinstall the solution from Content Hub for the corrected definition model to be re-applied; existing connector instances should be deleted and recreated.
Validated via .script/local-validation/build-and-validate.ps1: 13/13 applicable validators passed (TS x10, KQL, ARM-TTK 48 tests, Field Types, Classic App Insights, Hyperlink). 5 skipped due to local runtime gaps (.NET 3.1, trufflehog) - will run in CI.
v-krishnachi
force-pushed
the
v-krishnachi/qualysvm-3.0.9-graphqueries-fix
branch
from
ba01c94 to
7b1f2a6
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Fixes a Defender portal client-side KQL parse error on the QualysVM CCF data connector page by removing graphQueriesTableName placeholder substitution and hardcoding the actual table name, with a corresponding solution version bump.
Changes:
- Inlined
QualysHostDetectionV3_CLeverywhere{{graphQueriesTableName}}was previously used in the connector UI config. - Bumped solution/package versions from
3.0.8to3.0.9and updated publish date metadata. - Added a
3.0.9release notes entry describing the connector definition fix.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_ConnectorDefinition.json | Removes graphQueriesTableName and hardcodes QualysHostDetectionV3_CL to avoid unresolved placeholders reaching the portal. |
| Solutions/QualysVM/Package/mainTemplate.json | Updates packaged template content/version and mirrors the connector-definition table name inlining. |
| Solutions/QualysVM/data/Solution_QualysVM.json | Bumps the solution version to 3.0.9. |
| Solutions/QualysVM/SolutionMetadata.json | Updates lastPublishDate to reflect the new release. |
| Solutions/QualysVM/ReleaseNotes.md | Adds a 3.0.9 entry documenting the change. |
Contributor
|
Hi @v-krishnachi, please resolve branch conflicts to proceed. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a client-side KQL parse error (
Query could not be parsed at '{' on line [5,18]) shown in the Defender portal (security.microsoft.com) when opening the Qualys Vulnerability Management (via Codeless Connector Framework) data connector page.Root cause
When a
dataConnectorDefinition(kind: Customizable) is created withapiVersion: 2024-01-01-previewor later, thegraphQueriesTableNamefield inconnectorUiConfigis dropped during storage by the internal model. The{{graphQueriesTableName}}placeholders insidegraphQueries,sampleQueries, anddataTypesare therefore never substituted and reach the portal as literal text — which the KQL engine then fails to parse.Definitions written before the API change still resolve correctly because they were stored under an older internal model that retained the field. This is a known issue confirmed by the unified connectors team.
Fix proposed by Unified Connectors Team
Removed the
graphQueriesTableNameproperty entirely and inlined the literal table nameQualysHostDetectionV3_CLeverywhere{{graphQueriesTableName}}was used.Files changed
|
Solutions/QualysVM/Data Connectors/QualysVMHostLogs_ccp/QualysVMHostLogs_ConnectorDefinition.json|
Solutions/QualysVM/Package/mainTemplate.json|
Solutions/QualysVM/Package/3.0.9.zip|
Solutions/QualysVM/data/Solution_QualysVM.json|
Solutions/QualysVM/SolutionMetadata.json |Solutions/QualysVM/ReleaseNotes.md`Local validation
Customer follow-up steps (already shared with the connectors team)
dataConnectorDefinitionsresource so the corrected definition is stored.