Data Connector (CCF Push)

A new CCF push-pattern connector (id: VaronisSaaSAlertsPush) complements the existing Azure Function pull connector.

  • Ingestion mechanism: push via CCF; Varonis pushes DatAlert events directly to Microsoft Sentinel rather than being polled
  • Destination table: VaronisAlerts_CL
  • DCR defined in VaronisSaaS_DCR.json; connector definition in VaronisSaaS_ConnectorDefinition.json
  • Connectivity check: VaronisAlerts_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)
  • Requires Microsoft Entra app registration for push authentication

Analytic Rules (4 added)

Four new Scheduled Analytic Rules, all querying VaronisAlerts_CL with AlertPerResult grouping, 5-minute frequency/period:

RuleSeverityFilter
Varonis - High severity alerts detectedHighAlertSeverity_s == High
Varonis - Medium severity alerts detectedMediumAlertSeverity_s == Medium
Varonis - Low severity alerts detectedLowAlertSeverity_s == Low
Varonis - Informational alerts detectedInformationalAlertSeverity_s == Informational

All four rules share identical structure:

  • Entity mappings: Account (FullName -> UserNames_s, Name -> UserSamAccountNames_s), Host (HostName -> DeviceNames_s)
  • Custom Details: VaronisAlertGuid (AlertId_g), AlertCategory (AlertCategory_s), MitreTactic (MitreTacticName_s), Status (Status_s), EventsCount (EventsCount_d)
  • Alert title override: Varonis alert: ThreatDetectionPolicyName_s (AlertSeverity_s)
  • No incident grouping (AllEntities, disabled) – one incident per alert

MITRE Mapping

TechniqueTacticDescription
T1530CollectionData from Cloud Storage
T1213CollectionData from Information Repositories
T1567ExfiltrationExfiltration Over Web Service

Operational Note

The push connector requires Varonis-side configuration to forward alerts to the Sentinel DCE endpoint. Without that configuration, VaronisAlerts_CL will remain empty and all four Analytic Rules will produce no alerts. The existing Azure Function connector continues to operate independently – both can co-exist.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/VaronisAlerts_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/VaronisSaaS/Analytic Rules/VaronisHighSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisInformationalAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisLowSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Analytic Rules/VaronisMediumSeverityAlertsDetected.yaml
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_ConnectorDefinition.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_DCR.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_DataConnector.json
Solutions/VaronisSaaS/Data Connectors/VaronisSaaS_CCF/VaronisSaaS_Table.json
Solutions/VaronisSaaS/Package/testParameters.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_VaronisSaaS.json, createUiDefinition.json, mainTemplate.json)