What Changed

A new accelerator has been added at Tools/CCF-Connector-Builder-Agent-Accelerator/. It packages a mock Network Log API (Python Azure Function App) and a GitHub Copilot agent workflow for building Microsoft Sentinel CCF pull connectors without writing code.

Contents

  • azuredeploy_NetworkLogAPI.json – ARM template deploying a sample Network Log API as an Azure Function App; the API serves paginated JSON records simulating firewall events, brute-force blocks, and C2 detections with X-API-Key authentication
  • agent-instructions.md – GitHub Copilot (Agent mode) instructions that orchestrate the full deployment and CCF connector generation workflow interactively
  • NetworkLogAPI_API_Documentation.md – structured API reference (auth, pagination, incremental pull via since= parameter, 20-field schema) designed for consumption by the CCF Connector Builder Agent
  • sentinel-connectors/NetworkLogAPI_CCF/ – reference output of the four generated CCF files:
    • NetworkLogAPI_PollingConfig.json (authType: APIKey, pagination: NextPageUrl)
    • NetworkLogAPI_Table.json (custom table: NetworkLogAPINetworkLogs_CL)
    • NetworkLogAPI_DCR.json (KQL transform, workspace destination)
    • NetworkLogAPI_ConnectorDefinition.json (connector UI metadata)

Ingestion Pattern

The accelerator demonstrates a CCF API Poller connector: Sentinel polls the HTTP endpoint on a schedule, follows nextLink pagination, uses a since= query parameter for incremental pulls, and routes data through a DCR KQL transform into a custom Log Analytics table.

Operational Notes

  • No production detection content, parsers, or Analytic Rules are included – this is a development pattern reference, not deployable security content.
  • The ARM template uses an implicit hosting plan to avoid Consumption plan SKU quota issues; deployment recommended in Central US per the documentation.
  • Copilot review flagged that the icon URL references a mutable raw.githubusercontent.com master branch path, which could break on branch rename or file move – the connector definition should pin to a commit SHA for production use.
  • The pattern is reusable: substitute the Network Log API with any REST API to generate a real production connector using the same agent workflow.

Affected Files

Tools/CCF-Connector-Builder-Agent-Accelerator/.gitignore
Tools/CCF-Connector-Builder-Agent-Accelerator/AzureFunctionNetworkLogAPI/function_app.py
Tools/CCF-Connector-Builder-Agent-Accelerator/AzureFunctionNetworkLogAPI/host.json
Tools/CCF-Connector-Builder-Agent-Accelerator/AzureFunctionNetworkLogAPI/requirements.txt
Tools/CCF-Connector-Builder-Agent-Accelerator/NetworkLogAPI_API_Documentation.md
Tools/CCF-Connector-Builder-Agent-Accelerator/README.md
Tools/CCF-Connector-Builder-Agent-Accelerator/agent-instructions.md
Tools/CCF-Connector-Builder-Agent-Accelerator/azuredeploy_NetworkLogAPI.json
(packaging artefacts: NetworkLogAPI.zip)