Microsoft Sentinel to Defender Portal Migration Readiness Tool
New PowerShell assessment tool identifies migration blockers for Sentinel-to-Defender portal transitions. Read More →
Changelog
SailPoint IdentityNow: New CCF Connector with Dual Parser Support (v3.0.1)
SailPoint IdentityNow now supports CCF ingestion with new schema parsers alongside backward compatibility for existing Function App deployments. Read More →
Agent 365 Solution Rebranded from A365 Observability (v3.0.1)
Microsoft renamed the A365 Observability solution to Agent 365 for marketing alignment with no functional changes. Read More →
Elastic Agent CCF Connector: Replacing Deprecated HTTP Collector API
ElasticAgent connector migrated to CCF framework to maintain system monitoring capability as HTTP Collector API approaches deprecation. Read More →
Red Sift Solution: New CCF Data Connector and Email Security Detections
Red Sift adds CCF-based email and authentication monitoring with 5 detection rules for phishing and account compromise scenarios. Read More →
VMware ESXi: ASIM Authentication Parser for Host Access Monitoring
New ASIM parser normalizes VMware ESXi authentication events to enable centralized logon monitoring for hypervisor infrastructure. Read More →
Cisco Secure Endpoint: ASIM AlertEvent Parser for Cloud-Based Threat Detection
New ASIM parser enables normalized threat detection from Cisco Secure Endpoint via CCF ingestion to CiscoSecureEndpointEventsV2_CL table. Read More →
QualysVM Solution: API Version Regression Restored to Current Standards
QualysVM solution packaging corrects downgraded ARM template API versions that could impact deployment reliability. Read More →
Entra ID Attack Chain Detection: 5 New Hunting Queries Target Application Layer Persistence
Five hunting queries expose OAuth consent abuse, privileged escalation, and Conditional Access evasion used in Midnight Blizzard and Storm-0558 campaigns. Read More →
Abnormal Security CCF Connector: Critical Fix Restores Email Threat Detection After Complete Ingestion Failure
Fixes DCR transform errors, table deployment issues, and stream routing that prevented all data ingestion from Abnormal Security’s CCF Push connector since v3.0.0 launch. Read More →
Salesforce Audit Visibility: New CCF Connector for Administrative Change Tracking
New Salesforce Audit Logs connector provides visibility into administrative changes and user authentication events across Salesforce orgs. Read More →
Flare Solution 3.1.0: Enhanced Threat Intelligence Detection Coverage
Flare Solution updates detection logic and adds three new Analytic Rules for improved threat exposure monitoring across chat platforms, lookalike domains, and underground marketplaces. Read More →
Microsoft Entra ID Protection: Enhanced Detection Logic Filters Out Admin Risk Events
Updated CorrelateIPC_Unfamiliar-Atypical rule adds filtering to exclude admin-triggered atypical travel alerts, improving detection precision. Read More →
NXLog Solutions Deprecated: Loss of Multi-Platform Audit Visibility
Five NXLog partner solutions removed from Content Hub, eliminating data connector support for BSM macOS, FIM, Linux Audit, AIX Audit, and DNS monitoring across Unix/Linux environments. Read More →
Zimperium MTD: New CCF Push Connector for Mobile Threat Telemetry
Zimperium Mobile Threat Defense migrates to CCF-based push connector, replacing deprecated Azure Function ingestion before June 2026 deadline. Read More →
Vaikora Azure Security Center: Microsoft Marketplace Certification Fix
Reverts solution ID to match Partner Center offer name after Marketplace certification failure under policy 300.4.1.1. Read More →
Recorded Future Identity Playbook: ARM Template Deploy Failure Fixed
Fixes broken deployment of RFI-confirm-EntraID-risky-user playbook that failed with InvalidTemplate error due to stale action references. Read More →
Microsoft Entra ID: Service Principal Credential Manipulation by Rare Actors
Identifies service principal credential additions by actors not observed performing these operations in the previous 90 days, targeting persistence techniques. Read More →
Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Bursts
Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns. Read More →
Microsoft Entra ID: New Hunting Query Detects Post-Compromise Token Abuse via ASN Mismatches
Surfaces rapid ASN changes between interactive and non-interactive sign-ins within 10 minutes, indicating potential post-compromise token misuse. Read More →