Google Directory Solution: New Playbook Integration with Extended Security Scope
Initial release of GoogleDirectory solution adds Google Workspace user security management capabilities to Microsoft Sentinel playbook automation. Read More →
Changelog
Function App Security: Access Control Hardening Across Multiple Data Connectors
Function keys now required for HTTP-triggered functions in Zoom, Zscaler, FortiGate, Cofense, Illumio, and Infoblox connectors—removing anonymous access vulnerability. Read More →
AWS Content Quality Overhaul: Standardized Detection Rules and Improved Entity Mappings
Comprehensive quality improvements to 61 AWS Analytic Rules and 35 Hunting Queries with standardized naming conventions, normalized MITRE technique mappings, and updated entity field references from legacy AccountCustomEntity to UserIdentityUserName. Read More →
Microsoft Entra ID Table Rename: Hunting Queries Updated for Current Schema
12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references. Read More →
New Strider Shield Threat Intelligence Connector for Email Security Monitoring
NVISO introduces Strider Shield CCF connector enabling ingestion of email threat intelligence data across five data streams targeting phishing and BEC protection. Read More →
Microsoft Sentinel to Defender Portal Migration Readiness Tool
New PowerShell assessment tool identifies migration blockers for Sentinel-to-Defender portal transitions. Read More →
SailPoint IdentityNow: New CCF Connector with Dual Parser Support (v3.0.1)
SailPoint IdentityNow now supports CCF ingestion with new schema parsers alongside backward compatibility for existing Function App deployments. Read More →
Agent 365 Solution Rebranded from A365 Observability (v3.0.1)
Microsoft renamed the A365 Observability solution to Agent 365 for marketing alignment with no functional changes. Read More →
Elastic Agent CCF Connector: Replacing Deprecated HTTP Collector API
ElasticAgent connector migrated to CCF framework to maintain system monitoring capability as HTTP Collector API approaches deprecation. Read More →
Red Sift Solution: New CCF Data Connector and Email Security Detections
Red Sift adds CCF-based email and authentication monitoring with 5 detection rules for phishing and account compromise scenarios. Read More →
VMware ESXi: ASIM Authentication Parser for Host Access Monitoring
New ASIM parser normalizes VMware ESXi authentication events to enable centralized logon monitoring for hypervisor infrastructure. Read More →
Cisco Secure Endpoint: ASIM AlertEvent Parser for Cloud-Based Threat Detection
New ASIM parser enables normalized threat detection from Cisco Secure Endpoint via CCF ingestion to CiscoSecureEndpointEventsV2_CL table. Read More →
QualysVM Solution: API Version Regression Restored to Current Standards
QualysVM solution packaging corrects downgraded ARM template API versions that could impact deployment reliability. Read More →
Entra ID Attack Chain Detection: 5 New Hunting Queries Target Application Layer Persistence
Five hunting queries expose OAuth consent abuse, privileged escalation, and Conditional Access evasion used in Midnight Blizzard and Storm-0558 campaigns. Read More →
Abnormal Security CCF Connector: Critical Fix Restores Email Threat Detection After Complete Ingestion Failure
Fixes DCR transform errors, table deployment issues, and stream routing that prevented all data ingestion from Abnormal Security’s CCF Push connector since v3.0.0 launch. Read More →
Salesforce Audit Visibility: New CCF Connector for Administrative Change Tracking
New Salesforce Audit Logs connector provides visibility into administrative changes and user authentication events across Salesforce orgs. Read More →
Flare Solution 3.1.0: Enhanced Threat Intelligence Detection Coverage
Flare Solution updates detection logic and adds three new Analytic Rules for improved threat exposure monitoring across chat platforms, lookalike domains, and underground marketplaces. Read More →
Microsoft Entra ID Protection: Enhanced Detection Logic Filters Out Admin Risk Events
Updated CorrelateIPC_Unfamiliar-Atypical rule adds filtering to exclude admin-triggered atypical travel alerts, improving detection precision. Read More →
NXLog Solutions Deprecated: Loss of Multi-Platform Audit Visibility
Five NXLog partner solutions removed from Content Hub, eliminating data connector support for BSM macOS, FIM, Linux Audit, AIX Audit, and DNS monitoring across Unix/Linux environments. Read More →
Zimperium MTD: New CCF Push Connector for Mobile Threat Telemetry
Zimperium Mobile Threat Defense migrates to CCF-based push connector, replacing deprecated Azure Function ingestion before June 2026 deadline. Read More →