Fixing Dragos arm-ttk id from resourceId validation errors

[dragosinc-sentinel]

Required items, please complete

Change(s):

• Updating various resource IDs to conform to best practices for ARM templates

Reason for Change(s):

• Over the past week we merged in our main Dragos Sentinel Solution (see Initial Release of Dragos Sentinel Solution #11582 and Fixing Dragos PublisherId based on partner center submission #11706 )
• Our Partner Center submission failed ARM-TTK validation as we received several errors stating that

  IDs Should Be Derived From ResourceIDs
    [-] IDs Should Be Derived From ResourceIDs (109 ms)
        Property: "id" must use one of the following expressions for an resourceId property:
          extensionResourceId,resourceId,subscriptionResourceId,tenantResourceId,if,parameters,reference,variables,subscription,guid

• We used the Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 script, which apparently has a bug as it produces ARM templates that do not validate. Therefore as part of this PR we followed the guidance listed here: https://github.com/Azure/Azure-Sentinel/tree/e92286da7d185c99c6d30c2cb8c86bbeca1a99ba/Tools/Create-Azure-Sentinel-Solution/V3#ids-should-be-derived-from-resourceids and manually fixed the id offending id properties.
• We also made a small change to our offerId
• We have not released version 3.0.0 through Partner Center so requesting a minor update based on submission feedback.

Version Updated:

• Required only for Detections/Analytic Rule templates
• See guidance below

Testing Completed:

• We manually validated the mainTemplate.json but please refer to Initial Release of Dragos Sentinel Solution #11582 for full testing.

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[dragosinc-sentinel]

Any updates @v-prasadboke ?

[dragosinc-sentinel]

The detections validation PR check is failing but I don't see how it relates to any of the changes that I made. Looking at other runs of this check, it seems to have issues when the PR comes from a branch that is not part of the main Azure/Azure-Sentinel repo as show below:

• https://github.com/Azure/Azure-Sentinel/actions/runs/13023137352/job/36338712110
• https://github.com/Azure/Azure-Sentinel/actions/runs/13036708512/job/36397168179

Can you please advise?

[v-prasadboke]

Hello @dragosinc-sentinel, failure for id is an exception. We can ignore it.

I have packaged the solution now

[v-prasadboke]

Looks good