What Changed

New PowerShell tool (Invoke-TableMigrationReview.ps1) added to automate classic custom log table (CLv1) migration planning for Microsoft Sentinel deployments.

Migration Assessment Workflow

The tool performs three-phase analysis:

  • Discovery: Identifies all tables with TableType = CustomLog and TableSubType = Classic via workspace Tables API
  • Impact Assessment: Scans Analytics Rules, Hunting Queries, Parsers, Saved Searches, Workbooks, Playbooks, and DCRs for table references
  • Solution Mapping: Classifies data connectors by type (CCF, AMA, Platform, AzureFunctions, Agent, Legacy) and matches to Content Hub solutions

Critical Context

All classic tables must migrate to DCR-based ingestion before the HTTP Data Collector API retirement on September 14, 2026. Tables fed by Azure Functions-based connectors are the primary migration candidates. Failing to migrate creates a complete ingestion failure post-retirement.

Output Artifacts

Generates CSV reports (tables.csv, impact.csv, solution-matches.csv), machine-readable JSON, and self-contained HTML dashboard for prioritisation planning. Tables with high dependency counts require coordinated updates across multiple content types.

Deployment Requirements

Requires PowerShell 7.0+, Az.Accounts 2.13.0+, and Microsoft Sentinel Reader + Monitoring Reader RBAC permissions for read-only workspace analysis.

Affected Files

Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/agents/Sentinel-CLv1-Impact-Assessment-Assistant.md
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/copilot-instructions.md
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/instructions/powershell.instructions.md
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/Invoke-TableMigrationReview.ps1
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/README.md
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/Templates/Download.png
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/Templates/report.html.template
Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/Update-SolutionMapping.ps1
(packaging artefacts: CLv1-Tables-Impact-Assessment.zip)