Any deployment of the Isolate-MDEMachine playbook that followed the existing post-deployment instructions has been silently failing with a Forbidden error at runtime – device isolation never executed. Read More →
The Ruby-based Microsoft Sentinel Logstash output plugin (1.x.x) is now officially deprecated and its documentation separated from the active Java-based version (2.x.x), clarifying which plugin operators should be running. Read More →
Nine ASIM schema YAML files and a parsers list have been removed from the repo as the canonical schema definitions are now hosted on Microsoft Learn, with two new schemas (Agent Event and Asset Entity) documented in the README. Read More →
The GitHub Audit Log Azure Blob Storage connector now includes setup guidance on SAS token signing methods and recommends using Stored Access Policies to enable seamless credential rotation without reissuing tokens. Read More →
The Silverfort AMA connector setup instructions now correctly reference Azure Monitoring Agent instead of the legacy Microsoft Monitoring Agent, and the Python version check command has been corrected. Read More →
Fixes misspelled publisher name from Valimmail to Valimail in the Data Connector configuration UI. Read More →
OCI connector UI updated with explicit IAM policy requirements for stream consumption authorization alongside API signing key authentication. Read More →
Solution metadata updated to warn customers that Playbooks require manual deployment of the GTI custom Logic Apps connector before use. Read More →
12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references. Read More →
Updated Data Connector description in Visa Threat Intelligence solution to resolve certification failure. Read More →
Analytic rule renamed from Cloud PC-specific to cover all Entra-authenticated Windows devices, clarifying detection scope without logic changes. Read More →
Version bump to 2.1.1 with efficiency improvements noted but no connector logic changes. Read More →
Documentation updated for Logstash output plugin to reflect version 2.1.0 with Ruby-to-Java refactor, managed identity support, and closed-source transition. Read More →
Updated Island connector titles and descriptions to reduce confusion between legacy V1 and current V2 connectors. Read More →
Microsoft Sentinel now documents a critical platform limitation where individual fields exceeding 64 KB are silently truncated during ingestion, creating blind spots in large payload analysis. Read More →
Azure Resource Graph connector updated table labels to align with Table Management naming conventions, ensuring consistent query references. Read More →
Detection authoring guidelines now require validation of connectorId values against the official repository allowlist to prevent invalid connector references. Read More →
Clarifies connector description to specify M365 Copilot and Security Copilot coverage alongside general improvements. Read More →
Google Kubernetes Engine connector documentation updated to reference official Microsoft Learn guides instead of personal repositories. Read More →
Documentation update adds support for Logstash versions 8.19.2, 9.0.8, 9.1.10, and 9.2.4-9.2.5. Read More →