Palo Alto XDR ASIM Parser: Normalizing Cortex XDR Alert Data for Cross-Platform Detection
New ASIM AlertEvent parser brings Palo Alto Cortex XDR alert normalization to Microsoft Sentinel via CCF connector. Read More →
Changelog
ASIM Template Validation: Reliability Fix for Flaky Test Results and Performance Optimization
ASIM parser validation workflow updated to use local repository files instead of raw GitHub URLs, fixing malformed URL issues causing test failures. Read More →
ASIM Validator Infrastructure: Schema Testing Migrated to Remote Download Pattern
ASIM parser validation tooling updated to download ASimSchemaTester from GitHub instead of using hardcoded inline function. Read More →
UniFi Site Manager: New CCF Solution Adds Network Infrastructure Monitoring and Attack Surface Coverage
Community solution deploys 21 detections for UniFi network security posture, ISP performance degradation, and infrastructure defense evasion tactics. Read More →
Utimaco ESKM Integration: Enterprise Key Management Monitoring Arrives in Sentinel
New solution enables Microsoft Sentinel monitoring of Utimaco Enterprise Secure Key Manager KMIP operations and authentication events. Read More →
Akamai Guardicore v3.1.0: Function App Eliminated, CCF Migration Simplifies Microsegmentation Monitoring
Akamai Guardicore connector migrates from Azure Functions to Codeless Connector Framework, removing infrastructure overhead while preserving microsegmentation visibility. Read More →
Google SecOps Integration: New Detection Pipeline Connects Chronicle to Sentinel
Microsoft Sentinel gains visibility into Google Chronicle security detections through new connector and parsers. Read More →
CCF Blob Connector Accelerator: Developer Reference Implementation for Event-Driven Log Ingestion
New tool provides ISV partners with complete end-to-end CCF StorageAccountBlobContainer connector pattern including automated deployment and reference solution. Read More →
ASIM Schema Tester: Fixing Critical Validation Gap for Common Fields
Critical fix restores validation of Common schema fields alongside schema-specific fields in ASIM parser testing. Read More →
Imperva Cloud WAF: Critical Parsing Fix Restores Visibility for Complex Events
Imperva Cloud WAF connector switched to CommonEventFormatTransformer, fixing data ingestion failures for logs containing embedded quotes and pipes in CEF events. Read More →
AWS Security Hub Solution v3.0.4: Workbook Metadata Correction
Fixes missing workbook metadata in AWS Security Hub solution package without changing detection or ingestion logic. Read More →
Azure SQL Database Detection Rules: Enhanced MITRE Coverage and Alert Context
Quality improvements to 10 Azure SQL analytic rules add missing MITRE techniques, alert customization, and standardized query outputs. Read More →
SAP ETD: New Telemetry Tampering Detection Rules Target Defense Evasion
Two SAP Enterprise Threat Detection rules added to detect feed silence and per-SID data gaps, addressing T1562 defense evasion techniques. Read More →
SAP BTP: Enhanced Cloud Integration Deployment Detection with Audit Configuration Events
SAP BTP analytic rule reworked to use audit.configuration events, providing richer artifact context and improved actor attribution for Cloud Integration deployments. Read More →
Field Effect MDR Integration: New CCF Connector Delivers Cloud-Based Threat Detection
Field Effect MDR solution adds Microsoft Sentinel ingestion for ARO (Automated Response Operations) alerts via CCF, expanding managed detection coverage. Read More →
MuleSoft CloudHub: CCF Alerts Connector Expands DevOps Monitoring Coverage
New CCF connector adds alert ingestion capability to existing MuleSoft CloudHub logs solution, enabling comprehensive application lifecycle monitoring. Read More →
AWS Security Hub Compliance Workbook Metadata Added to Content Registry
Workbook metadata entry added for AWS Security Hub compliance visualization — workbook content deployment follows separately. Read More →
Cisco ETD: Migration to Message Event Logs API with Enhanced Email Security Visibility
Labeled P0 — assess deployment or pipeline breakage risk explicitly. Complete connector overhaul migrates to new Message Event Logs REST API providing enhanced email visibility beyond convicted messages. Read More →
Contrast ADR: Enhanced Attack Event Schema with Code Location and Vector Analysis Fields
CCF connector schema updated to capture additional attack context with codeLocation, vectorAnalysis, and request_parameters fields for improved threat analysis. Read More →
StealthTalk: New Enterprise Authentication Monitoring Solution with MITRE-Mapped Detection Portfolio
Complete StealthTalk Enterprise solution delivers four analytic rules targeting credential attacks (T1078, T1110, T1098) plus ASIM Authentication parsers and Teams integration. Read More →