Added Support for Related Infrastructre Playbook and Workbook in Censys by devendra-chavda · Pull Request #13994 · Azure/Azure-Sentinel

devendra-chavda · 2026-04-06T09:08:38Z

Change(s):

Added Support for Related Infrastructre Playbook and Workbook in Censys

Reason for Change(s):

Support for Related Infrastructre usecase

Version Updated:

No

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new “Related Infrastructure” experience to the Censys solution by wiring a new workbook section to a new playbook and custom table, plus updating supporting metadata and sample/test artifacts.

Changes:

Added a new “Related Infrastructure” dashboard section and ARM action trigger to the Censys workbook.
Added a new playbook reference + new custom table sample/test definitions for CensysRelatedInfrastructure_CL.
Updated workbook metadata assets list (new table + additional images) and appended release notes.

Reviewed changes

Copilot reviewed 10 out of 16 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Updates Censys workbook metadata to reference the new custom table and additional images.
Solutions/Censys/Workbooks/Censys.json	Adds a “Related Infrastructure” dashboard section, parameters, and KQL queries to drive the experience.
Solutions/Censys/ReleaseNotes.md	Adds a release note entry for the new playbook/workbook support.
Solutions/Censys/Playbooks/CensysRelatedInfrastructure/README.md	Adds documentation for deploying/configuring the new playbook.
Solutions/Censys/Package/createUiDefinition.json	Updates package UI metadata (skipped review/comments per repo rules for `Solutions//Package/`).
Solutions/Censys/Data/Solution_Censys.json	Adds the new playbook ARM template to the solution manifest.
Sample Data/Custom/CensysRelatedInfrastructure_CL.csv	Adds sample data for the new custom table.
Sample Data/Custom/CensysRelatedAssetsDetails_CL.csv	Removes sample data for the previous related-assets table.
.script/tests/KqlvalidationsTests/CustomTables/CensysRelatedInfrastructure_CL.json	Adds schema definition used by KQL validation tests for the new custom table.
.script/tests/KqlvalidationsTests/CustomTables/CensysRelatedAssetsDetails_CL.json	Removes schema definition for the old custom table.

Copilot · 2026-04-08T05:54:57Z

Solutions/Censys/Workbooks/Censys.json

+                          "durationMs": 86400000
+                        },
+                        "queryType": 1,
+                        "resourceType": "microsoft.operationalinsights/workspaces",


The SubscriptionId parameter is configured as a Resource Graph query (queryType: 1) against the Resources table, but resourceType is set to microsoft.operationalinsights/workspaces (Log Analytics). This mismatch is likely to break the parameter query. Align resourceType with Resource Graph (for consistency with the ResourceGroup parameter) or change the query/queryType to match Log Analytics.

Suggested change

"resourceType": "microsoft.operationalinsights/workspaces",

"resourceType": "microsoft.resourcegraph/resources",

Copilot · 2026-04-08T05:54:58Z

Solutions/Censys/Workbooks/Censys.json

+                  "conditionalVisibilities": [
+                    {
+                      "parameterName": "SubscriptionId",
+                      "comparison": "isNotEqualTo"
+                    },
+                    {
+                      "parameterName": "ResourceGroup",
+                      "comparison": "isNotEqualTo"
+                    },
+                    {
+                      "parameterName": "IndicatorType",
+                      "comparison": "isNotEqualTo"
+                    },
+                    {
+                      "parameterName": "IndicatorValue",
+                      "comparison": "isNotEqualTo"
+                    }


Each conditionalVisibilities entry uses comparison: "isNotEqualTo" but omits the value to compare against. Workbook conditional visibility rules typically require a value (often "" to mean “not empty”). As-is, this can evaluate incorrectly or fail schema validation, causing the Submit link/panels to not appear as intended.

Copilot · 2026-04-08T05:54:58Z

Solutions/Censys/ReleaseNotes.md

@@ -1,3 +1,4 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                 |
 |-------------|--------------------------------|--------------------------------------------------------------------|
+| 3.0.0       | 06-04-2026                     | Added Support for Related Infrastructre Playbook and Workbook   |


The release notes table violates the required release notes format: it appears to have an extra leading empty column (|| ...), and it introduces a duplicate version (3.0.0 appears twice). Update the table to have exactly 3 columns (no leading empty column) and bump the solution version for this change (e.g., 3.0.1), keeping versions unique and ordered newest-first.

Suggested change

| 3.0.0 | 06-04-2026 | Added Support for Related Infrastructre Playbook and Workbook |

| 3.0.1 | 06-04-2026 | Added Support for Related Infrastructre Playbook and Workbook |

Copilot · 2026-04-08T05:54:58Z

Solutions/Censys/ReleaseNotes.md

 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                 |
 |-------------|--------------------------------|--------------------------------------------------------------------|
+| 3.0.0       | 06-04-2026                     | Added Support for Related Infrastructre Playbook and Workbook   |
 | 3.0.0       | 05-03-2026                     | Initial Solution for Censys with Playbooks and Workbook |


Correct spelling of "Infrastructre" to "Infrastructure".

Suggested change

| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |

|-------------|--------------------------------|--------------------------------------------------------------------|

| 3.0.0 | 06-04-2026 | Added Support for Related Infrastructre Playbook and Workbook |

| 3.0.0 | 05-03-2026 | Initial Solution for Censys with Playbooks and Workbook |

| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |

|-------------|--------------------------------|-------------------------------------------------------------------|

| 3.0.1 | 06-04-2026 | Added Support for Related Infrastructure Playbook and Workbook |

| 3.0.0 | 05-03-2026 | Initial Solution for Censys with Playbooks and Workbook |

Copilot · 2026-04-08T05:54:58Z

Solutions/Censys/ReleaseNotes.md

@@ -1,3 +1,4 @@
 | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                                 |
 |-------------|--------------------------------|--------------------------------------------------------------------|
+| 3.0.0       | 06-04-2026                     | Added Support for Related Infrastructre Playbook and Workbook   |


PR metadata says “Version Updated: No”, but the changes add functionality (new playbook/workbook support) and also add a new release note row. For Sentinel solutions, new content typically requires a version increment (and corresponding ReleaseNotes + Solution manifest alignment) rather than adding a second entry under the same version.

Copilot · 2026-04-08T05:54:59Z

Solutions/Censys/Data/Solution_Censys.json

        "Playbooks/CensysHostHistory/azuredeploy.json",
        "Playbooks/CensysIncidentEnrichment/azuredeploy.json",
        "Playbooks/CensysIOCLookup/azuredeploy.json",
+        "Playbooks/CensysRelatedInfrastructure/azuredeploy.json",
        "Playbooks/CensysRescan/azuredeploy.json"


Adding a new playbook to the solution manifest should generally be accompanied by a solution version bump and consistent release notes entry for that bumped version (to ensure packaging/update flows can detect and distribute the new content correctly). Right now the release notes attempt to document the change under the existing 3.0.0, which is problematic.

Copilot · 2026-04-08T05:54:59Z

Solutions/Censys/Playbooks/CensysRelatedInfrastructure/README.md

@@ -0,0 +1,45 @@
+# Censys Ad-Hoc IOC Lookup


The README title doesn’t match the playbook being added (CensysRelatedInfrastructure) and can mislead users during deployment. Also, “Azure AD” is outdated terminology in Microsoft docs; consider updating to “Microsoft Entra ID” for consistency with current naming.

Copilot · 2026-04-08T05:54:59Z

Solutions/Censys/Playbooks/CensysRelatedInfrastructure/README.md

+   * PlaybookName: Enter the playbook name here (default: CensysRelatedInfrastructure).
+   * OrganizationID: Your Censys Organization ID from the Censys platform account settings.
+   * KeyVaultName: Name of the Azure Key Vault where the Censys API token is stored.
+   * TenantId: Azure AD Tenant ID where the Key Vault is located.


The README title doesn’t match the playbook being added (CensysRelatedInfrastructure) and can mislead users during deployment. Also, “Azure AD” is outdated terminology in Microsoft docs; consider updating to “Microsoft Entra ID” for consistency with current naming.

Copilot · 2026-04-08T05:54:59Z

Sample Data/Custom/CensysRelatedInfrastructure_CL.csv

@@ -0,0 +1,11 @@
+TenantId,SourceSystem,MG,ManagementGroupName,"TimeGenerated [UTC]",Computer,RawData,"censys_url_s","count_d","fields_s","values_s","ioc_s","values_g",Type,"_ResourceId"


The CSV header includes a UTF-8 BOM character before TenantId (visible as an extra character at the start). This can cause schema/parsing mismatches in tooling that expects exact column names; please remove the BOM so the first header is exactly TenantId.

Suggested change

TenantId,SourceSystem,MG,ManagementGroupName,"TimeGenerated [UTC]",Computer,RawData,"censys_url_s","count_d","fields_s","values_s","ioc_s","values_g",Type,"_ResourceId"

TenantId,SourceSystem,MG,ManagementGroupName,"TimeGenerated [UTC]",Computer,RawData,"censys_url_s","count_d","fields_s","values_s","ioc_s","values_g",Type,"_ResourceId"

Added Support for Related Infrastructre Playbook and Workbook in Censys

ca5f8d2

devendra-chavda requested review from a team as code owners April 6, 2026 09:08

v-atulyadav assigned v-shukore Apr 6, 2026

v-atulyadav added Playbook Playbook specialty review needed Workbook Workbook specialty review needed Solution Solution specialty review needed labels Apr 6, 2026

v-shukore requested a review from Copilot April 8, 2026 05:53

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added Support for Related Infrastructre Playbook and Workbook in Censys#13994

Added Support for Related Infrastructre Playbook and Workbook in Censys#13994
devendra-chavda wants to merge 1 commit intoAzure:masterfrom
devendra-chavda:censys_support_for_related_infra

devendra-chavda commented Apr 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	"resourceType": "microsoft.operationalinsights/workspaces",
	"resourceType": "microsoft.resourcegraph/resources",

	\| 3.0.0 \| 06-04-2026 \| Added Support for Related Infrastructre Playbook and Workbook \|
	\| 3.0.1 \| 06-04-2026 \| Added Support for Related Infrastructre Playbook and Workbook \|

		@@ -0,0 +1,11 @@
		TenantId,SourceSystem,MG,ManagementGroupName,"TimeGenerated [UTC]",Computer,RawData,"censys_url_s","count_d","fields_s","values_s","ioc_s","values_g",Type,"_ResourceId"

Conversation

devendra-chavda commented Apr 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants