SOCRadar Solution v3.0.1: Packaging Version Alignment
Version bump from 3.0.0 to 3.0.1 to align the published Content Hub package with the catalog; no detection logic, playbook, or connector changes. Read More →
Changelog
Checkmarx Audit Ingestion Playbook: Pagination Fix, Deployment Simplification, and RBAC Enforcement
The AS-Checkmarx-Audit-Ingestion Playbook receives pagination loop fixes and a collapsed single-deployment model – teams running the old multi-step deployment may have incomplete audit event ingestion. Read More →
Google SecOps Solution: Publisher and Offer Identity Update
The Google SecOps Solution package has been re-registered under new marketplace publisher and offer identifiers — no detection logic or connector configuration was changed. Read More →
DocuSign Connector: Az Module Upgrade Restores PowerShell 7.2+ Function App Compatibility
The DocuSign Security Events Function App connector was failing to load Az module cmdlets on PowerShell 7.2+ runtimes; bumping the dependency from Az 5.* to 11.* restores ingestion. Read More →
Cisco Umbrella CCF Connector GA Promotion Fixes Template Variable Rendering in UI Queries
The Cisco Umbrella CCF connector graduates to GA while also resolving broken template variable references that caused Content Hub connectivity checks and sample queries to malfunction. Read More →
Rapid7 InsightVM CCF Connector Promoted to General Availability
The Rapid7 InsightVM CCF data connector moves out of Public Preview to GA, updating the API version to the stable 2025-09-01 release. Read More →
AWS S3 Connector: CloudFormation IaC Templates Added for Repeatable AWS-Side Deployment
Four CloudFormation templates (CloudTrail, CloudWatch, VPC Flow Logs, GuardDuty) and an OIDC trust template now provide enterprise-grade IaC deployment of the AWS-side resources required by the Microsoft Sentinel Amazon Web Services S3 connector, complementing the existing PowerShell setup flow. Read More →
Abnormal Security Solution: Full Detection Coverage Added for CCF Push Connector (v3.1.0)
The Abnormal Security solution now ships four scheduled Analytic Rules, four Hunting Queries, four parsers, a workbook, and a Playbook â closing a complete detection gap that existed since the CCF Push connector was introduced in v3.0.0 with no bundled detections. Read More →
New Akamai DDoS Protection CCF Connector: WAF Security Events Now Available in Microsoft Sentinel
A new CCF-based connector ingests Akamai WAF SIEM security events into the AkamaiSIEMEvent table, unlocking web application attack visibility including denied requests, client reputation, rule triggers, and geolocation context for attacker IPs. Read More →
WithSecure Elements Connector Migrated to CCF: Function App Infrastructure Eliminated
A new CCF-based WithSecure Elements solution (v4.0.0) replaces the Azure Function connector, removing the Azure Function, Storage Account, and Key Vault dependency stack while the legacy Function App solution is deprecated in place with a transition buffer for existing deployments. Read More →
Lookout Connector v3.0.6: Silent Ingestion Stop After 24h and Four DCR Field Mapping Blind Spots Fixed
A CCF cursor expiry caused the Lookout streaming connector to silently stop ingesting data after roughly 24 hours, and four incorrect DCR field paths meant ThreatId, ThreatAction, DeviceEmail, and SmishingAlertId were null in every ingested record. Read More →
QRadar Migration Tool: Summary Row and Delimiter Changes Affect CSV Output Format
The QRadar collector script (v0.4.1) appends a sentinel summary row of all active Log Source Types to the exported rules CSV and switches bracket-list formatting from comma to pipe separators, breaking any downstream parsers expecting the previous format. Read More →
Agent 365 Solution v3.1.2: Microsoft Agent Identities Connector Version Refresh
Bumps the Microsoft Agent Identities (EntraNHIAssets) data connector to version 1.0.1 so Content Hub correctly detects and applies the latest connector configuration on solution update. Read More →
New ASIM NetworkSession Parser for Cisco FTD Extends Network Visibility via AMA Connector
Cisco Firepower Threat Defense (FTD) logs ingested via the Cisco ASA/FTD AMA connector can now be normalised into the ASIM NetworkSession schema, enabling source-agnostic detections and hunting queries to run against FTD firewall and IDS events. Read More →
New ASIM Authentication Parser for Cisco Firepower Threat Defense Closes Syslog Auth Visibility Gap
A new ASIM Authentication parser for Cisco FTD normalises SSH login success and failure events from Syslog into the imAuthentication/ASimAuthentication schema, enabling source-agnostic detection coverage for Cisco firewall authentication activity. Read More →
ASIM Schema Docs Pruned -- Canonical Definitions Moved to Microsoft Learn
Nine ASIM schema YAML files and a parsers list have been removed from the repo as the canonical schema definitions are now hosted on Microsoft Learn, with two new schemas (Agent Event and Asset Entity) documented in the README. Read More →
Trend Micro Cloud App Security: Offer ID Alignment for Marketplace Publishing
Solution metadata offer ID updated to match the Azure Marketplace listing — no detection logic or connector changes. Read More →
Darktrace CCF Connector: Setup Guide Link Updated to Customer Portal
Version 3.1.1 fixes a broken documentation link in the connector UI, replacing the prior URL with the Darktrace customer portal guides page (https://customerportal.darktrace.com/guides) after a manual validation failure. Read More →
Semperis Lightning Connector: TLS Certificate Verification Restored Across All API Calls
The Semperis Lightning data connector was making all outbound API requests with TLS verification disabled (verify=False), exposing token acquisition and all data collection calls to man-in-the-middle attacks; this fix re-enables certificate validation across seven affected modules. Read More →
Google Workspace Reports: Google Meet Activity Logs Restored After Polling Window Gap
A missing queryWindowDelayInMin setting caused Google Meet audit events to be silently dropped by the CCF connector - adding a 30-minute delay restores ingestion of events that arrive late from Google API. Read More →