Auto-generated summaries of every merged PR in the Azure-Sentinel GitHub repo

SAP Solution: Analyzer Marketplace Visibility and Agentless Connector Discovery Fixed

Tools fixes enable proper SAP solution marketplace tracking and make the SAPCC agentless connector visible to the Microsoft Sentinel Solutions Analyzer. Read More →

Lookout Connector: Critical Data Loss Fix for Mobile Threat Event Identifiers

Lookout Mobile Risk API v2 connector was silently dropping unique event identifiers (oid field), breaking all downstream correlation in detections and workbooks. Read More →

Check Point ASIM NetworkSession Parser: DeviceVendor Field Matching Fix

Check Point firewall ASIM parser updated to handle both “Check Point” and “CheckPoint” DeviceVendor field values, fixing parsing failures introduced in PR #12056. Read More →

BitSight Solution: Provider Information Updated to Partner Status

BitSight solution metadata updated to reflect partner provider status, transitioning from Microsoft internal to external partner support. Read More →

Zoom Data Connector: Legacy Azure Function Files Removed from Standalone Location

Legacy Zoom connector files removed from DataConnectors folder — connector has been migrated to Solutions/ZoomReports. Read More →

Corelight: Dashboard Restructure and New Asset Classification Tab for Enhanced Network Visibility

Corelight solution restructured workbooks and added asset classification functionality to improve network asset discovery and security monitoring capabilities. Read More →

Pathlock TD&R: Major Detection Coverage Expansion with 77 New SAP-Focused Analytic Rules

Pathlock Threat Detection & Response adds 77 comprehensive SAP security analytic rules covering ABAP changes, user activities, system modifications, and financial data access. Read More →

CyberArk EPM: Migration to DCR and OAuth Authentication Replaces Deprecated Log Analytics API

CyberArk EPM connector updated to use DCR ingestion and OAuth authentication, addressing deprecation of Log Analytics API and improving security. Read More →

BeyondTrust PM Cloud: Function App Reliability Fix Prevents Timeout on Large Event Backlogs

Critical fix prevents BeyondTrust PM Cloud Function App timer functions from hanging when processing large event backlogs, restoring data ingestion reliability. Read More →

GitHub Audit Log Connector: Azure Storage Integration Addresses API Rate Limits

New Azure Storage-based GitHub Enterprise audit log connector overcomes CCF API rate limitations through Event Grid blob notifications. Read More →

Filewall for Microsoft 365: New Solution Adds Data Exfiltration Detection for Exchange and Files

Complete CCF-based solution delivers real-time monitoring of blocked emails and files across Microsoft 365 services with immediate threat alerting. Read More →

BitSight Solution: Support Tier Changed to Partner

BitSight solution support tier updated from Microsoft to Partner with version downgrade to 3.2.0. Read More →

Microsoft Agent Identities Connector: New Entra Non-Human Identity Asset Visibility (Preview)

Agent 365 solution adds new Microsoft Agent Identities connector for tracking agent blueprints and non-human identity assets across four data tables. Read More →

ASIM Authentication Parsers: Palo Alto Data Fidelity Fix for DvcIpAddr Field

ASIM Authentication parsers for Palo Alto PAN-OS and GlobalProtect now correctly populate DvcIpAddr field, fixing data fidelity gap. Read More →

Cisco Umbrella CCF: Public Preview Expands Data Visibility with 10 New Log Tables

New Codeless Connector Framework introduces comprehensive log coverage across DNS, web traffic, cloud firewall, admin audit, DLP, file events, IPS, VPN and Zero Trust access for enhanced threat detection. Read More →

Oracle Cloud Infrastructure CCF Connector: IAM Permissions Guidance Added

OCI connector UI updated with explicit IAM policy requirements for stream consumption authorization alongside API signing key authentication. Read More →

Slack Audit Solution: Enhanced Detection Logic and Alert Enrichment

Slack Audit analytic rules, hunting queries, and workbook upgraded with improved KQL logic, custom alert details, and enhanced entity mappings for stronger workspace monitoring. Read More →

ASIM Parser Development Automation: GitHub Copilot Skills for Accelerated Detection Engineering

GitHub Copilot agent skills now automate the complete ASIM parser creation workflow, reducing parser development time from days to hours for security engineers. Read More →

42Crunch API Protection: Critical Migration from Legacy HTTP Collector to CCF Push Connector

Migration addresses deprecated HTTP Data Collector API by implementing CCF OAuth2/Entra ID ingestion — deployments on legacy connector face imminent data loss. Read More →

Entra ID Post-Credential Activity Detection: Service Principal Staging and Privileged Role Escalation

Three new hunting queries target Midnight Blizzard-style persistence patterns — service principal credential staging, privileged role assignments to new accounts, and Temporary Access Pass abuse. Read More →