Data Connector (CCF Push)
A new CCF push-pattern connector (id: VaronisSaaSAlertsPush) complements the existing Azure Function pull connector.
- Ingestion mechanism: push via CCF; Varonis pushes DatAlert events directly to Microsoft Sentinel rather than being polled
- Destination table: VaronisAlerts_CL
- DCR defined in VaronisSaaS_DCR.json; connector definition in VaronisSaaS_ConnectorDefinition.json
- Connectivity check: VaronisAlerts_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)
- Requires Microsoft Entra app registration for push authentication
Analytic Rules (4 added)
Four new Scheduled Analytic Rules, all querying VaronisAlerts_CL with AlertPerResult grouping, 5-minute frequency/period:
| Rule | Severity | Filter |
|---|---|---|
| Varonis - High severity alerts detected | High | AlertSeverity_s == High |
| Varonis - Medium severity alerts detected | Medium | AlertSeverity_s == Medium |
| Varonis - Low severity alerts detected | Low | AlertSeverity_s == Low |
| Varonis - Informational alerts detected | Informational | AlertSeverity_s == Informational |
All four rules share identical structure:
- Entity mappings: Account (FullName -> UserNames_s, Name -> UserSamAccountNames_s), Host (HostName -> DeviceNames_s)
- Custom Details: VaronisAlertGuid (AlertId_g), AlertCategory (AlertCategory_s), MitreTactic (MitreTacticName_s), Status (Status_s), EventsCount (EventsCount_d)
- Alert title override: Varonis alert: ThreatDetectionPolicyName_s (AlertSeverity_s)
- No incident grouping (AllEntities, disabled) – one incident per alert
MITRE Mapping
| Technique | Tactic | Description |
|---|---|---|
| T1530 | Collection | Data from Cloud Storage |
| T1213 | Collection | Data from Information Repositories |
| T1567 | Exfiltration | Exfiltration Over Web Service |
Operational Note
The push connector requires Varonis-side configuration to forward alerts to the Sentinel DCE endpoint. Without that configuration, VaronisAlerts_CL will remain empty and all four Analytic Rules will produce no alerts. The existing Azure Function connector continues to operate independently – both can co-exist.
Affected Files
.script/tests/KqlvalidationsTests/CustomTables/VaronisAlerts_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/VaronisSaaS/Analytic Rules/VaronisHighSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisInformationalAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisLowSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisMediumSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_ConnectorDefinition.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_DCR.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_DataConnector.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_Table.json
Solutions/VaronisSaaS/Package/testParameters.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_VaronisSaaS.json, createUiDefinition.json, mainTemplate.json)