What Changed

The Airlock Digital CCF connector has been promoted to Public Preview at v3.1.0 with three substantive changes affecting data fidelity and operational coverage.

Security Impact (Visibility and Fidelity)

Ingestion was broken in v3.0.x deployments. Two separate defects caused data loss:

  1. Poller timeout too short: The request timeout was 30 seconds. Airlock Digital API responses exceeding this threshold caused fetch timeouts, resulting in missed log batches. The timeout is now 120 seconds.

  2. Pagination token path incorrect: The checkpoint paging path used index notation rather than slice notation. This caused out-of-range errors during pagination, silently truncating multi-page result sets. Deployments running v3.0.x have had incomplete ingestion for any poll interval returning paginated results.

Both defects affect all three custom tables: AirlockDigitalServerActivities_CL, AirlockDigitalExecutionHistories_CL, and AirlockDigitalFileActivitySummary_CL.

Multi-Instance Support

The connector UI has been redesigned from a single ConnectionToggleButton to a DataConnectorsGrid plus ContextPane pattern, enabling simultaneous connections to multiple Airlock Digital servers. Each connection is independently configured with:

  • Base URL and API Key per server
  • Per-connection data type selection (multi-select dropdown: Server Activities, Execution Histories, File Activity Summary)
  • A friendly name stored in a new ConnectorName field appended to all three DCR transform KQL pipelines

The ConnectorName field is now projected into all three output streams, allowing KQL queries to filter or join by originating server.

DCR Schema Change

A friendlyName field (string) has been added to the DCR stream schema for all three streams. Existing hunting queries or Analytic Rules that use project-away or strict column projection against these tables should be reviewed.

Additional Cleanup

  • Removed deprecated graphQueriesTableName property; hardcoded table names are now used directly in graph queries and sample queries.
  • Removed explicit table retention configuration (reverts to workspace default).
  • Suppressed the connectivity check step (no health endpoint available on Airlock Digital servers).

Affected Files

Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_ConnectorDefinition.json
Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_DCR.json
Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/AirlockDigital_PollerConfig.json
Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalExecutionHistories.json
Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalFileActivitySummary.json
Solutions/AirlockDigital/Data Connectors/AirlockDigital_CCF/table_AirlockDigitalServerActivities.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_AirlockDigital.json, mainTemplate.json)