ZeroFox Digital Risk Protection: Complete CCF Migration with Dual Solution Architecture

What Changed

ZeroFox has completely restructured their Microsoft Sentinel integration by splitting the legacy connector into two specialized solutions using the Codeless Connector Framework (CCF). This modernization provides granular data collection across 17 distinct threat intelligence categories and security alert streams.

New Solution Architecture

ZeroFox Alerts (v3.0.0)

Single connector for security alert ingestion
Consolidated alert data stream for incident detection
DCR-based ingestion with custom table schema

ZeroFox Threat Intelligence (v3.0.0)

16 specialized threat intelligence connectors, each with dedicated DCR and custom table:
- Advanced Dark Web: Deep web threat monitoring
- Botnet/Botnet CC: Command and control infrastructure tracking
- Breaches: Data breach intelligence
- Compromised Credentials: Leaked credential monitoring
- Credit Cards: Financial fraud indicators
- Dark Web: General dark web intelligence
- Discord/Telegram: Messaging platform threats
- Disruption: Active threat disruption campaigns
- Email Addresses: Compromised email tracking
- Exploits: Zero-day and exploit intelligence
- Indicators: General IOCs and threat indicators
- Key Incidents: High-impact security events
- National IDs: Identity theft monitoring
- Physical Threats: Kinetic threat intelligence
- Vulnerabilities: CVE and vulnerability data

Security Impact (Visibility & Fidelity)

This architectural modernization significantly expands ZeroFox visibility within Microsoft Sentinel:

Enhanced Data Granularity: Each threat category now flows into dedicated custom tables, enabling precise queries and reducing data noise in security operations.

Improved Detection Surface: The 17 specialized data streams provide comprehensive coverage across digital risk protection domains:

Dark web monitoring for brand and data exposure
Credential compromise detection for account takeover prevention
Botnet tracking for C2 infrastructure identification
Social media threats via Discord/Telegram monitoring
Financial fraud indicators through credit card intelligence
Physical security risks through kinetic threat feeds

CCF Architecture Benefits: Migration to CCF provides automatic scaling, improved reliability, and consistent authentication patterns across all data streams.

Detection Surface Unlocked

Organizations can now build targeted detections for:

Credential stuffing campaigns using compromised credential feeds
Brand impersonation through dark web monitoring
Executive protection via physical threat intelligence
Financial fraud through credit card compromise alerts
Infrastructure targeting via botnet C2 tracking
Social engineering campaigns across messaging platforms

Each data stream includes comprehensive field schemas enabling rich correlation with existing security data sources and MITRE ATT&CK mapping for threat hunting workflows.

Affected Files

Solutions/ZeroFox Threat Intelligence/Data Connectors/Advanced Dark Web/ZeroFoxThreatIntelligence_AdvancedDarkWeb_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Advanced Dark Web/ZeroFoxThreatIntelligence_AdvancedDarkWeb_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Advanced Dark Web/ZeroFoxThreatIntelligence_AdvancedDarkWeb_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Advanced Dark Web/ZeroFoxThreatIntelligence_AdvancedDarkWeb_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet CC/ZeroFoxThreatIntelligence_BotnetCC_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet CC/ZeroFoxThreatIntelligence_BotnetCC_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet CC/ZeroFoxThreatIntelligence_BotnetCC_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet CC/ZeroFoxThreatIntelligence_BotnetCC_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet/ZeroFoxThreatIntelligence_Botnet_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet/ZeroFoxThreatIntelligence_Botnet_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet/ZeroFoxThreatIntelligence_Botnet_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Botnet/ZeroFoxThreatIntelligence_Botnet_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Breaches/ZeroFoxThreatIntelligence_Breaches_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Breaches/ZeroFoxThreatIntelligence_Breaches_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Breaches/ZeroFoxThreatIntelligence_Breaches_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Breaches/ZeroFoxThreatIntelligence_Breaches_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Compromised Credentials/ZeroFoxThreatIntelligence_CompromisedCredentials_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Compromised Credentials/ZeroFoxThreatIntelligence_CompromisedCredentials_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Compromised Credentials/ZeroFoxThreatIntelligence_CompromisedCredentials_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Compromised Credentials/ZeroFoxThreatIntelligence_CompromisedCredentials_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Credit Cards/ZeroFoxThreatIntelligence_CreditCards_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Credit Cards/ZeroFoxThreatIntelligence_CreditCards_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Credit Cards/ZeroFoxThreatIntelligence_CreditCards_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Credit Cards/ZeroFoxThreatIntelligence_CreditCards_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Dark Web/ZeroFoxThreatIntelligence_DarkWeb_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Dark Web/ZeroFoxThreatIntelligence_DarkWeb_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Dark Web/ZeroFoxThreatIntelligence_DarkWeb_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Dark Web/ZeroFoxThreatIntelligence_DarkWeb_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Discord/ZeroFoxThreatIntelligence_Discord_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Discord/ZeroFoxThreatIntelligence_Discord_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Discord/ZeroFoxThreatIntelligence_Discord_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Discord/ZeroFoxThreatIntelligence_Discord_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Disruption/ZeroFoxThreatIntelligence_Disruption_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Disruption/ZeroFoxThreatIntelligence_Disruption_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Disruption/ZeroFoxThreatIntelligence_Disruption_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Disruption/ZeroFoxThreatIntelligence_Disruption_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Email Addresses/ZeroFoxThreatIntelligence_EmailAddresses_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Email Addresses/ZeroFoxThreatIntelligence_EmailAddresses_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Email Addresses/ZeroFoxThreatIntelligence_EmailAddresses_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Email Addresses/ZeroFoxThreatIntelligence_EmailAddresses_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Exploits/ZeroFoxThreatIntelligence_Exploits_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Exploits/ZeroFoxThreatIntelligence_Exploits_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Exploits/ZeroFoxThreatIntelligence_Exploits_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Exploits/ZeroFoxThreatIntelligence_Exploits_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Indicators/ZeroFoxThreatIntelligence_Indicators_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Indicators/ZeroFoxThreatIntelligence_Indicators_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Indicators/ZeroFoxThreatIntelligence_Indicators_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Indicators/ZeroFoxThreatIntelligence_Indicators_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Key Incidents/ZeroFoxThreatIntelligence_KeyIncidents_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Key Incidents/ZeroFoxThreatIntelligence_KeyIncidents_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Key Incidents/ZeroFoxThreatIntelligence_KeyIncidents_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Key Incidents/ZeroFoxThreatIntelligence_KeyIncidents_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/National Ids/ZeroFoxThreatIntelligence_NationalIDs_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/National Ids/ZeroFoxThreatIntelligence_NationalIds_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/National Ids/ZeroFoxThreatIntelligence_NationalIds_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/National Ids/ZeroFoxThreatIntelligence_NationalIds_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Physical Threats/ZeroFoxThreatIntelligence_PhysicalThreats_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Physical Threats/ZeroFoxThreatIntelligence_PhysicalThreats_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Physical Threats/ZeroFoxThreatIntelligence_PhysicalThreats_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Physical Threats/ZeroFoxThreatIntelligence_PhysicalThreats_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Telegram/ZeroFoxThreatIntelligence_Telegram_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Telegram/ZeroFoxThreatIntelligence_Telegram_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Telegram/ZeroFoxThreatIntelligence_Telegram_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Telegram/ZeroFoxThreatIntelligence_Telegram_Table.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Vulnerabilities/ZeroFoxThreatIntelligence_Vulnerabilities_ConnectorDefinition.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Vulnerabilities/ZeroFoxThreatIntelligence_Vulnerabilities_DCR.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Vulnerabilities/ZeroFoxThreatIntelligence_Vulnerabilities_PollerConfig.json
Solutions/ZeroFox Threat Intelligence/Data Connectors/Vulnerabilities/ZeroFoxThreatIntelligence_Vulnerabilities_Table.json
Solutions/ZeroFox Threat Intelligence/Package/testParameters.json
Solutions/ZeroFoxAlerts/Data Connectors/Alerts/ZeroFoxAlerts_ConnectorDefinition.json
Solutions/ZeroFoxAlerts/Data Connectors/Alerts/ZeroFoxAlerts_DCR.json
Solutions/ZeroFoxAlerts/Data Connectors/Alerts/ZeroFoxAlerts_PollerConfig.json
Solutions/ZeroFoxAlerts/Data Connectors/Alerts/ZeroFoxAlerts_Table.json
Solutions/ZeroFoxAlerts/Package/testParameters.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_ZeroFoxAlerts.json, Solution_ZeroFox_Threat_Intelligence.json, createUiDefinition.json, mainTemplate.json)

What Changed#

New Solution Architecture#

Security Impact (Visibility & Fidelity)#

Detection Surface Unlocked#

Affected Files#

What Changed

New Solution Architecture

Security Impact (Visibility & Fidelity)

Detection Surface Unlocked

Affected Files