What Changed

Updated Cyera DSPM solution to v3.0.4, addressing critical DCR transformation failures that prevented data collection into Microsoft Sentinel. The fix removes unsupported KQL functions from the Data Collection Rule transform query and enhances ASIM schema compliance for the CyeraAssets_MS_CL table.

Security Impact (Visibility & Fidelity)

Deployments running the previous version experienced complete ingestion failure for the CyeraAssets_MS_CL stream due to DCR InvalidTransformQuery errors. The transform KQL contained functions not supported in DCR context (coalesce(), todynamic(), mv_apply operator), causing the connector to fail at deployment — zero asset data was ingested by affected deployments.

This represents a significant blind spot for Data Security Posture Management: organizations lost visibility into cloud asset discovery, classification status, data risks, and ownership mapping across their multi-cloud environment.

Technical Details

  • Fixed DCR Transform: Removed unsupported functions from Custom-CyeraAssets_MS_CL stream transformation
    • Replaced coalesce() with iif() pattern
    • Eliminated todynamic() usage in favor of native dynamic field handling
    • Simplified AssetOwner field processing without mv_apply
  • ASIM Schema Compliance: All 18 required ASIM fields now properly populated in CyeraAssets_MS_CL table
  • Enhanced Authentication: Azure Functions connector updated to use ManagedIdentityCredential instead of DefaultAzureCredential for improved security posture
  • API Consistency: Added User-Agent headers across all poller configurations for better request tracking

The fix ensures data flows correctly to all 5 custom tables: CyeraAssets_MS_CL, CyeraDataStores_CL, CyeraLabels_CL, CyeraClassifications_CL, and CyeraUsers_CL.

Affected Files

Logos/cyera_logo.svg
Solutions/CyeraDSPM/CHANGELOG.md
Solutions/CyeraDSPM/Data Connectors/CyeraDSPM_CCF/CyeraDSPMLogs_ConnectorDefinitionCCF.json
Solutions/CyeraDSPM/Data Connectors/CyeraDSPM_CCF/CyeraDSPMLogs_DataConnectorPoller.json
Solutions/CyeraDSPM/Data Connectors/CyeraDSPM_CCF/CyeraDSPM_DCR.json
Solutions/CyeraDSPM/Data Connectors/CyeraDSPM_CCF/CyeraDSPM_Table.json
Solutions/CyeraDSPM/Data Connectors/CyeraDSPM_Functions/AzureFunction/CyeraConnector/__init__.py
(packaging artefacts: 3.0.0.zip, CyeraConnector.zip, ReleaseNotes.md, SolutionMetadata.json, mainTemplate.json)