domains / / Azure/Azure-Sentinel
Document Packaging Conventions
When updating Sentinel solution documentation artifacts (workbooks metadata, UI definitions, and connector table schemas), treat them as schema- and regeneration-driven. Ensure values match platform conventions and that any generated text will be correct after regeneration.
When updating Sentinel solution documentation artifacts (workbooks metadata, UI definitions, and connector table schemas), treat them as schema- and regeneration-driven. Ensure values match platform conventions and that any generated text will be correct after regeneration.
Apply these rules: 1) Follow required schema/doc fields
- For table/schema JSON, include a
descriptionfor every table insideschema. - Add
retentionInDays(or the required retention property) under eachpropertiesblock.
Example (pattern):
{
"properties": {
"retentionInDays": 180,
"schema": {
"name": "ExampleTable_CL",
"description": "Describes what ExampleTable contains and how it is used in Sentinel.",
"columns": [
{ "name": "ExampleColumn", "type": "string", "description": "Meaning of the column." }
]
}
}
}
2) Use the correct relative paths/URIs
- For workbook metadata fields like
templateRelativePath, use the documented convention (e.g., bare filename relative to the solution’sWorkbooks/folder), not an arbitrary repo path. - For UI-referenced assets (logos/images), ensure the URL matches an existing repo path at runtime (and follow any workbook-image convention your repo uses).
3) Don’t hand-edit autogenerated UI boilerplate
- If UI sections are emitted by packaging tooling, edit the underlying source/templates rather than patching the generated
createUiDefinition.json(manual edits will be overwritten on regeneration).
4) Prevent UI text truncation by fixing the source descriptions
- If
createUiDefinition.jsontruncates analytic rule text, update the source analytic description in the template/YAML and regenerate the package. - Keep descriptions as complete sentences and within the platform’s effective UI length constraints (commonly enforced by the generator/UI).
Net effect: your PR improves the correctness of end-user-facing documentation (UI text, schema descriptions, and metadata paths) and avoids “false-positive” validation failures caused by regeneration, length limits, or nonconforming paths/URIs.