Add Vaikora for O365 solution v3.0.0

[mazamizo21]

Summary

Adds the Vaikora for O365 Microsoft Sentinel solution (v3.0.0) — the Sentinel-side content that pairs with the Vaikora for O365 black-box Azure VM. The VM scans Microsoft 365 mailboxes via the Microsoft Graph API, classifies messages with the CTASD inference engine, and writes quarantine events into the VaikoraO365_Quarantine_CL custom Log Analytics table.

Contents

• 1 Playbook (VaikoraO365ToQuarantine): Sentinel-incident-triggered Logic App that posts a structured notification to a SOC Teams channel and comments on the incident.
• 3 Analytic Rules over VaikoraO365_Quarantine_CL:
  • Vaikora - High score quarantine — fires on ActionId in (4, 5) with Confidence >= 0.8 (Suspected / Phishing classifications, every 15 min).
  • Vaikora - Quarantine rate spike — per-tenant hourly count vs 7-day baseline (3× threshold + min 10 events).
  • Vaikora - Engine offline — absent quarantine telemetry over the last 2h for tenants that were active in the prior 24h.
• 1 Workbook (Vaikora for O365 - Quarantine Dashboard): tenant overview, action breakdown, confidence distribution, top sender domains, top targeted recipients, recent high-risk quarantines.
• Cross-cutting: VaikoraO365 added to .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json; VaikoraO365QuarantineDashboard registered in Workbooks/WorkbooksMetadata.json with dark/light preview images.

Validation

• arm-ttk on Package/3.0.0.zip: Pass=49 Fail=1 Total=50 (the single failure is IDs Should Be Derived From ResourceIDs on the canonical managedApi connection pattern, matching the Microsoft Defender for Office 365 baseline).
• Playbook resource validator: passes — standalone Logic App uses [resourceGroup().location] per playbookResourceChecker.ts.
• Logo SVG: GUID-format ids, lowercase, unique within file. Both Logos/ and Workbooks/Images/Logos/ already present from prior Vaikora-Sentinel merge.
• Workbook deployed to a test workspace and rendered with sample data for the preview images.

Notes for reviewer

• Solution maps to Partner Center offer azure-sentinel-solution-vaikora-o365.
• Content Hub binding follows the Cyren pattern: hidden-Sentinel* tags on both the inner mainTemplate Logic App and the standalone azuredeploy.json, with the inner parameter literally named PlaybookName (per the binding fix on the Cyren-Defender PR thread).
• This is a new connector (no prior solution in upstream/master); ReleaseNotes initial version is 3.0.0.

cc @v-maheshbh @v-shukore