Vaikora Azure Security Center: Microsoft Marketplace Certification Fix
Reverts solution ID to match Partner Center offer name after Marketplace certification failure under policy 300.4.1.1. Read More →
Changelog
Recorded Future Identity Playbook: ARM Template Deploy Failure Fixed
Fixes broken deployment of RFI-confirm-EntraID-risky-user playbook that failed with InvalidTemplate error due to stale action references. Read More →
Microsoft Entra ID: Service Principal Credential Manipulation by Rare Actors
Identifies service principal credential additions by actors not observed performing these operations in the previous 90 days, targeting persistence techniques. Read More →
Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Bursts
Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns. Read More →
Microsoft Entra ID: New Hunting Query Detects Post-Compromise Token Abuse via ASN Mismatches
Surfaces rapid ASN changes between interactive and non-interactive sign-ins within 10 minutes, indicating potential post-compromise token misuse. Read More →
Dynatrace Parsers: Critical Timestamp Fix Restores Query Reliability
Data fidelity fix converts Unix epoch millisecond fields to datetime, resolving duplicate typed columns that broke query functionality in Dynatrace parsers. Read More →
Cyjax Connector: Security and Code Quality Fixes Applied
Addressed lint issues, package vulnerabilities, and code vulnerabilities in Cyjax threat intelligence connector. Read More →
Cisco Duo Connector: API Throttling Resilience Improved for Log Ingestion
Doubled retry delay to 120 seconds to address Duo API throttling requirements preventing log collection. Read More →
Workspace Usage Workbook: IsBillable Column Display Labels Corrected
Fixed inverted display labels in WorkspaceUsage workbook where billing status showed opposite values. Read More →
M365 Defender ASIM Parser: TargetUserSessionId Field Restoration Fixes Data Fidelity Gap
Missing TargetUserSessionId field in Microsoft 365 Defender ASIM ProcessEvent parsers has been restored, fixing queries that previously returned null for this session correlation field. Read More →
GitHub Actions Security: Fork PR Workflow Hardened Against Supply Chain Attacks
CI/CD security enhancement prevents automatic execution of untrusted fork code by implementing strict SafeToRun label gating. Read More →
GitHub Advanced Security Parser Migration: CLv2 Compatibility and Schema Updates
Critical fix migrates GitHub parsers and workbooks to support CLv2 ingestion table and updated GitHub alert event schemas, ensuring compatibility across V1 and V2 deployments. Read More →
Azure Firewall Detection Quality Overhaul: Enhanced Alert Context and Reduced Query Costs
Comprehensive quality improvements to 11 Azure Firewall detections and 5 hunting queries add entity mappings, custom details, and query optimizations to reduce false positives and improve incident context. Read More →
Workspace Usage Report Workbook: Query Comparison False Positives Fixed
Workbook no longer flags legitimate rule template and active rule pairs as having different query text due to whitespace sensitivity. Read More →
BloodHound Enterprise: Function App Upgrade Fixes Data Collection and Ingestion Gaps
Deployment source moved to stable Microsoft repo, custom table schemas fixed, and Function App ingestion enhanced for reliable attack path visibility. Read More →
VMware vCenter ASIM Parser: DvcId Type Correction Prevents Query Failures
Fixed critical data type mismatch in VMware vCenter authentication parser that caused DvcId field queries to fail. Read More →
Visa Threat Intelligence: Connector Description Update for Certification
Updated Data Connector description in Visa Threat Intelligence solution to resolve certification failure. Read More →
Claroty: Enhanced IoT/OT Detection with Improved Alert Fidelity
Updated 9 analytic rules and 10 hunting queries with strengthened entity mapping, alert details, and MITRE coverage for OT/IoT network monitoring. Read More →
ZeroFox Digital Risk Protection: Complete CCF Migration with Dual Solution Architecture
ZeroFox splits legacy connector into dedicated Alerts and Threat Intelligence solutions using modern CCF architecture with 17 specialized data streams. Read More →
Solutions Analyzer: Fix Connector Overcount in CCF v2 Solutions
Solutions Analyzer was double-counting connectors in CCF v2 solutions due to azuredeploy wrapper files creating phantom duplicates. Read More →