ZoomReports: Cloud Recording API Polling Optimized to Reduce Data Duplication

What Changed

ZoomReports v3.0.9 modifies the Cloud Recording API polling configuration in the CCF connector:

• Polling interval reduced from 2880 minutes (2 days) to 1440 minutes (1 day)
• Added 1440-minute (1-day) delay via queryWindowDelayInMin parameter
• Maintains 2 QPS rate limiting and existing timeout/retry settings

Security Impact (Visibility & Fidelity)

This change addresses data quality issues affecting Zoom cloud recording visibility. Previously, the 2-day polling window without delay caused duplicate log ingestion, potentially impacting:

• Alert fatigue from duplicate Zoom recording access events
• Inaccurate metrics in hunting queries counting recording downloads
• Detection rule effectiveness when deduplication logic is required

The 1-day polling window with 1-day delay ensures each recording event is captured once, improving data fidelity for security monitoring of Zoom cloud storage access patterns and potential data exfiltration scenarios.

Affected Files

Solutions/ZoomReports/Data Connectors/ZoomReports_ccf/PollingConfig.json
(packaging artefacts: 3.0.9.zip, ReleaseNotes.md, Solution_ZoomReports.json, mainTemplate.json)