What Changed
Data Connector / DCR
The OCI_DataConnector_DCR.json transform was rebuilt. The previous transform stored each ingested event three times: the raw dynamic payloads, approximately 190 flattened columns extracted from those payloads, and normalized aliases duplicating several fields again. Since Log Analytics bills on post-transform bytes, affected deployments incurred roughly 3x the expected ingestion cost with no increase in event volume.
The new transform retains every column referenced by the Parser, Analytic Rules, Hunting Queries, and Workbook, and drops:
- Raw data and oracle dynamic payloads (already fully flattened into named columns)
- HTTP header noise and CloudEvents boilerplate (dataschema_s, specversion_s)
- Duplicated flow-log fields (copies of SrcIpAddr / DstIpAddr)
- Credential-bearing request headers: authorization, Cookie, opc_obo_token, auth_info, opc_principal
- stateChange.current.keyValue public-key blob
Retaining credential-bearing headers and a public-key blob in a 180-day Log Analytics table is a data-exposure risk. This removal is a security improvement, not just cost optimisation.
Table schema: 201 columns reduced to 86. The azuredeploy_OCI_DataConnector_poller_connector.json ARM template embeds the updated DCR and table definitions.
SrcIpAddr Typo Fix (Detection Fidelity)
The DCR transform used the field path identity.ipAddres (missing trailing s). This caused SrcIpAddr to be null for every OCI audit event since CCF connector deployment. Any detection or hunting query filtering or pivoting on source IP against audit-category rows was operating with an empty field. The fix corrects the path to identity.ipAddress with a fallback for events where the field is absent.
Parser — OCILogs v1.1.0
The parser now reads both OCI_Logs_CL (legacy Function App table) and OCI_LogsV2_CL (CCF table), ensuring detection continuity during workspace migration. EventStartTime and EventEndTime for V2 flow-log rows are now derived at read time using unixtime_seconds_todatetime() with a TimeGenerated fallback, restoring time-range accuracy for flow-log-based detections.
Analytic Rules and Hunting Queries (20 files)
All 10 Analytic Rules and 10 Hunting Queries had their requiredDataConnectors block updated to add the CCF connector (OracleCloudInfraConnector / OCI_LogsV2_CL) alongside the legacy connector reference. In CCF-only workspaces, these rules were showing as disconnected in Content Hub because the connector ID referenced only the deprecated Function App connector (OracleCloudInfrastructureLogsConnector). KQL query logic is unchanged across all 20 files.
Deprecated Function App Connector Removed
Legacy Function App connector assets removed from the solution: AzureFunctionOCILogs/, OCILogsConn.zip, OCI_logs_API_FunctionApp.json, azuredeploy_OCI_logs_API_FunctionApp.json, host.json, proxies.json, requirements.txt. The V3 solution ships only the CCF connector.
Affected Files
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIDiscoveryActivity.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIEventRuleDeleted.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIInboundSSHConnection.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIInsecureMetadataEndpoint.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMetadataEndpointIpAccess.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleInstancesLaunched.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleInstancesTerminated.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIMultipleRejects.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCISSHScan.yaml
Solutions/Oracle Cloud Infrastructure/Analytic Rules/OCIUnexpectedUserAgent.yaml
Solutions/Oracle Cloud Infrastructure/Data Connectors/Oracle_Cloud_Infrastructure_CCP/OCI_DataConnector_DCR.json
Solutions/Oracle Cloud Infrastructure/Data Connectors/Oracle_Cloud_Infrastructure_CCP/OCI_DataConnector_DataConnectorDefinition.json
Solutions/Oracle Cloud Infrastructure/Data Connectors/Oracle_Cloud_Infrastructure_CCP/OCI_DataConnector_Table.json
Solutions/Oracle Cloud Infrastructure/Data Connectors/Oracle_Cloud_Infrastructure_CCP/azuredeploy_OCI_DataConnector_poller_connector.json
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIDestinationsIn.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIDestinationsOut.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCILaunchedInstances.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUpdateActivities.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserDeleteActions.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserDeletedUsers.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserNewUsers.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserSources.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserTerminatedInstances.yaml
Solutions/Oracle Cloud Infrastructure/Hunting Queries/OCIUserUpdatedInstances.yaml
Solutions/Oracle Cloud Infrastructure/Package/testParameters.json
Solutions/Oracle Cloud Infrastructure/Parsers/OCILogs.yaml
Solutions/Oracle Cloud Infrastructure/Workbooks/OracleCloudInfrastructureOCI.json
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_OCILogs.json, createUiDefinition.json, mainTemplate.json)