CCF on sentinelchangelog.net

New Check Point Harmony Email and Collaboration Connector: Four-Stream Email Threat Visibility via CCF

Fri, 10 Jul 2026 06:24:39 +0000

A new Microsoft Sentinel CCF connector ingests Check Point Email Security (Harmony Email and Collaboration) data across four streams covering security events, anti-phishing exceptions, spam exceptions, and audit logs, unlocking visibility into zero-day, phishing, account takeover, DLP, and shadow IT threats via email.

New Netskope Alerts and Events Solution: DLP, Shadow IT, and Malware Threat Visibility via CCF Blob Storage Connector

Fri, 10 Jul 2026 06:05:09 +0000

A new Microsoft Sentinel solution delivers full-stack Netskope Security Cloud visibility including DLP incidents, malware detections, policy enforcement, and Shadow IT via a CCF Blob Storage connector ingesting gzip-compressed positional CSV into a 254-column custom table.

New Atlassian Organization Audit CCF Connector: Cloud Org-Level Audit Events Now Ingestible in Sentinel

Fri, 10 Jul 2026 00:13:02 +0000

A brand-new CCF connector brings Atlassian Cloud organization audit events (user management, authentication, group changes, policy updates) across Jira, Confluence, Bitbucket, Trello, Opsgenie, Statuspage, and Loom into the AtlassianAuditEvents_CL table in Microsoft Sentinel.

SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)

Thu, 09 Jul 2026 22:44:23 +0000

The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.

Infoblox SOC Insights: New CCF Connector Replaces Deprecated Legacy Integration

Thu, 09 Jul 2026 22:19:38 +0000

Infoblox SOC Insights gains a native CCF-based data connector via REST API polling, restoring structured ingestion of BloxOne Threat Defense insights into the InfobloxInsight_CL table after prior connectors were deprecated.

Agent 365: Microsoft Agent Identities Connector Page KQL Parse Error Patched by Removing Data Type Declarations

Thu, 09 Jul 2026 04:22:44 +0000

The EntraNHIAssets connector definition drops all four data type entries to eliminate an empty-subquery KQL parse error on the connector page — though reviewers flag this may break connector metadata contracts.

Cisco Meraki CCF Connector Expands to Cover Rogue AP Detection and Network Inventory

Wed, 08 Jul 2026 21:22:13 +0000

The Cisco Meraki CCF connector (v3.1.0) adds four new ingestion streams - Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events - extending coverage beyond the original ASIM event types to include wireless threat detection and full network inventory visibility.

Panorays Connector: DCR Parameter Chain and Offer ID Fixes Restore Deployability

Wed, 08 Jul 2026 11:09:41 +0000

The Panorays solution had a broken dcrConfig parameter reference chain and invalid offerId that would cause ARM template deployment failures, meaning no vulnerability management data was ingested by affected deployments.

New Gambit Security Solution: Cloud Security Posture Issues Now Ingestible via CCF Push Connector

Wed, 08 Jul 2026 08:45:13 +0000

Gambit Security new Microsoft Sentinel solution adds a CCF Push connector that ingests cloud security posture policy issues into a custom table, with a bundled parser and analytic rule for incident creation on High-severity active findings.

Untitled

Wed, 08 Jul 2026 05:12:41 +0000

test

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/FrendsAuditLogs_CL.json
DataConnectors/Frends iPaaS/FrendsAuditLogs_CL.json
DataConnectors/Frends iPaaS/FrendsAuditLogs_Sentinel_CCF.json
DataConnectors/Frends iPaaS/README.md

Imperva Cloud WAF CCF Connector Graduates to General Availability

Tue, 07 Jul 2026 21:34:27 +0000

The Imperva Cloud WAF CCF connector moves from Public Preview to GA, with connector UI template variables replaced by the literal ImpervaWAFCloud table name - no ingestion logic changes.

New CCF Connector Builder Accelerator: AI-Assisted End-to-End Pull Connector Generation for Microsoft Sentinel

Tue, 07 Jul 2026 13:50:01 +0000

Adds a GitHub Copilot agent accelerator to the Tools/ directory that automates generation of the four CCF connector files (polling config, DCR, table schema, connector definition) from any REST API documentation – lowering the barrier for partners building custom data connectors.

WithSecure Elements CCF Connector: Zero-Ingestion Fix for Broken OAuth2 Auth and Invalid Query Parameters

Tue, 07 Jul 2026 12:06:39 +0000

The WithSecureElementsCCF connector has been non-functional since initial release – both the OAuth2 token request and the security-events API call failed with HTTP 400 errors, meaning no WithSecure endpoint security events have been ingested into any Sentinel deployment running this connector.

Orca Security Alerts: New CCF Push Connector Replaces Deprecated Shared Key Auth with Microsoft Entra ID

Fri, 03 Jul 2026 12:30:33 +0000

A new CCF Push connector for Orca Security Alerts replaces the legacy Log Analytics Shared Key ingestion path with Microsoft Entra ID app authentication via the Logs Ingestion API, eliminating the deprecated shared-key attack surface while retaining backward compatibility.

BlueVoyant Claude Compliance Connector: DCR Schema Expanded with Activity Fields, Sensitive request_body Removed

Fri, 03 Jul 2026 07:29:21 +0000

The BlueVoyant Anthropic Claude Compliance CCF connector v1.0.1 expands the DCR schema with dozens of activity-specific fields required for hunting and detection, and removes the request_body column to prevent ingestion of potentially sensitive data.

ESET PROTECT Platform: New CCF Connector Adds Native Ingestion for Endpoint Inspect and Cloud Office Security Detections

Thu, 02 Jul 2026 19:58:40 +0000

A new Codeless Connector Framework connector and updated parser extend ESET PROTECT Platform coverage to three log streams while maintaining backward compatibility with the legacy Function App connector.

GitHub AzStorage Connector: Expanded api.request Fields Land in New GitHubAuditLogsV3_CL Table

Thu, 02 Jul 2026 11:15:42 +0000

The GitHub Azure Storage CCF connector gains a new V3 table with 10 additional api.request fields including token_scopes, request_method, request_body, status_code, and url_path, improving visibility into API-level attacker activity in GitHub audit logs.

Cisco Umbrella CCF Connector GA Promotion Fixes Template Variable Rendering in UI Queries

Wed, 01 Jul 2026 19:55:19 +0000

The Cisco Umbrella CCF connector graduates to GA while also resolving broken template variable references that caused Content Hub connectivity checks and sample queries to malfunction.

Rapid7 InsightVM CCF Connector Promoted to General Availability

Wed, 01 Jul 2026 19:47:03 +0000

The Rapid7 InsightVM CCF data connector moves out of Public Preview to GA, updating the API version to the stable 2025-09-01 release.

Abnormal Security Solution: Full Detection Coverage Added for CCF Push Connector (v3.1.0)

Wed, 01 Jul 2026 07:53:17 +0000

The Abnormal Security solution now ships four scheduled Analytic Rules, four Hunting Queries, four parsers, a workbook, and a Playbook â closing a complete detection gap that existed since the CCF Push connector was introduced in v3.0.0 with no bundled detections.

New Akamai DDoS Protection CCF Connector: WAF Security Events Now Available in Microsoft Sentinel

Wed, 01 Jul 2026 07:05:34 +0000

A new CCF-based connector ingests Akamai WAF SIEM security events into the AkamaiSIEMEvent table, unlocking web application attack visibility including denied requests, client reputation, rule triggers, and geolocation context for attacker IPs.

WithSecure Elements Connector Migrated to CCF: Function App Infrastructure Eliminated

Wed, 01 Jul 2026 06:14:18 +0000

A new CCF-based WithSecure Elements solution (v4.0.0) replaces the Azure Function connector, removing the Azure Function, Storage Account, and Key Vault dependency stack while the legacy Function App solution is deprecated in place with a transition buffer for existing deployments.

Lookout Connector v3.0.6: Silent Ingestion Stop After 24h and Four DCR Field Mapping Blind Spots Fixed

Wed, 01 Jul 2026 06:13:06 +0000

A CCF cursor expiry caused the Lookout streaming connector to silently stop ingesting data after roughly 24 hours, and four incorrect DCR field paths meant ThreatId, ThreatAction, DeviceEmail, and SmishingAlertId were null in every ingested record.

Darktrace CCF Connector: Setup Guide Link Updated to Customer Portal

Tue, 30 Jun 2026 09:08:17 +0000

Version 3.1.1 fixes a broken documentation link in the connector UI, replacing the prior URL with the Darktrace customer portal guides page (https://customerportal.darktrace.com/guides) after a manual validation failure.

Google Workspace Reports: Google Meet Activity Logs Restored After Polling Window Gap

Tue, 30 Jun 2026 06:22:41 +0000

A missing queryWindowDelayInMin setting caused Google Meet audit events to be silently dropped by the CCF connector - adding a 30-minute delay restores ingestion of events that arrive late from Google API.

Holm Security VMP: New CCF Connector Ingests Network and Web Asset Inventory into Sentinel

Fri, 26 Jun 2026 05:11:21 +0000

A new CCF-based Data Connector for the Holm Security Vulnerability Management Platform adds direct ingestion of network and web asset inventory – including IP, hostname, OS, severity, and vulnerability counts – into two custom Log Analytics tables, enabling asset-aware threat hunting and vulnerability correlation in Microsoft Sentinel.

Cybersixgill Actionable Alerts: CCF Connector Added with Unified Parser Bridging Legacy and New Tables

Thu, 25 Jun 2026 11:34:30 +0000

The Cybersixgill Actionable Alerts solution adds a new CCF-based data connector alongside a unified parser that abstracts both the legacy Azure Function table (CyberSixgill_Alerts_CL) and the new CCF table (CyberSixgillAlertsV2_CL), ensuring hunting queries and workbooks continue working regardless of which connector is deployed.

Netskope Web Transactions: 51-Field Schema Expansion Unlocks Threat Protection and Endpoint Posture Visibility

Thu, 25 Jun 2026 09:31:44 +0000

The NetskopeWebTransactions_CL schema gains 51 new fields covering malware detections, endpoint posture, process activity, identity/authorization, and remote geo — all parser column references have also shifted from raw W3C names to DCR-normalised PascalCase, requiring query updates on any existing saved searches or Analytic Rules built against this parser.

OpenAI Connector Promoted to GA — Preview Flag Removed

Wed, 24 Jun 2026 17:12:36 +0000

The OpenAI CCF connector exits preview status; the only change is flipping isPreview from true to false in the connector definition, making it generally available in Content Hub.

QualysVM CCF Connector: Restoring Vulnerability Data Ingestion After API Timeout Blind Spot

Wed, 24 Jun 2026 08:17:32 +0000

Customers with large Qualys environments were receiving zero vulnerability detection data due to chronic API timeouts – this fix raises the CCF timeout to the platform maximum, tightens the query window, and adds a lightweight connectivity check to unblock ingestion.

New Panorays Connector: Third-Party Cyber Risk Findings Now Ingestible into Microsoft Sentinel

Wed, 24 Jun 2026 05:54:57 +0000

A new CCF-based connector ingests company security findings from the Panorays API into a custom log table, unlocking visibility into third-party cyber risk posture within Sentinel.

Trend Micro Cloud App Security: CCF Connector Added with Dual-Schema Parser for Legacy and Modern Ingestion Paths

Wed, 24 Jun 2026 05:24:24 +0000

A new CCF-based Data Connector (TrendMicroCASConnector) is added alongside the existing Azure Functions connector, with the TrendMicroCAS parser updated to union both ingestion paths so all existing detections, hunting queries, and workbooks continue to work without modification.

Halcyon Anti-Ransomware: New CCF v2 Connector and OCSF Parsers Unlock Full Endpoint Telemetry

Tue, 23 Jun 2026 05:05:20 +0000

Halcyon Solution v3.2.0 ships a new CCF-based v2 Data Connector with two dedicated custom tables (HalcyonEventsV2_CL, HalcyonAlertUpdatesV2_CL) ingesting OCSF-formatted endpoint telemetry, plus eight class-scoped parsers that surface process, file, network, DNS, kernel, auth, application, and alert data for immediate query use.

Veeam Backup and Replication CCF Connector Now in Public Preview: Six Security Data Streams Added to Sentinel

Mon, 22 Jun 2026 15:53:21 +0000

The Veeam CCF connector enters Public Preview, bringing six new custom log tables covering malware detection, security compliance, authorization events, Veeam ONE alarms, Coveware ransomware findings, and session telemetry – closing a significant blind spot for backup infrastructure security monitoring.

CrowdStrike Falcon AlertEvent ASIM Parser: Falcon Detections Now Normalised into Unified Alert Schema

Fri, 19 Jun 2026 23:45:23 +0000

A new ASIM AlertEvent parser for CrowdStrike Falcon ingested via CCF normalises detection data from the CrowdStrikeDetections table into the ASIM AlertEvent schema, enabling source-agnostic detection and hunting queries across EDR alert data.

Illumio Insights Graph Connector: DCR Type Mismatches Were Blocking All Ingestion

Fri, 19 Jun 2026 11:11:51 +0000

The IllumioInsightsGraph CCF connector had column type mismatches between the table schema and DCR transform that caused ingestion failures – this fix corrects TimeGenerated from string to datetime and multiple numeric fields from long to int, but introduces overflow risk for byte counters in high-volume environments.

GitHub Audit Log Azure Storage Connector: SAS Token Guidance Added to Prevent Credential Rotation Gaps

Thu, 18 Jun 2026 20:05:41 +0000

The GitHub Audit Log Azure Blob Storage connector now includes setup guidance on SAS token signing methods and recommends using Stored Access Policies to enable seamless credential rotation without reissuing tokens.

New BlueVoyant CCF Connector Brings Anthropic Claude Compliance Activity into Microsoft Sentinel

Wed, 17 Jun 2026 11:45:57 +0000

BlueVoyant new Solution adds a CCF-based Data Connector that polls the Anthropic Claude Compliance API every 10 minutes and lands compliance events in the custom table BV_ClaudeCompliance_ComplianceActivities_CL, opening a new AI platform audit surface in Sentinel.

MuleSoft CloudHub Logs Connector: Empty Instruction Block Removed to Restore Marketplace Publishing

Wed, 17 Jun 2026 06:53:58 +0000

The MuleSoft CloudHub Logs CCF connector definition had an empty instructions array blocking marketplace validationâthis fix removes it, restoring publishability with no change to ingestion logic or detection coverage.

New AWS Config CCF Connector: Resource Configuration Visibility via Custom API Pull

Wed, 17 Jun 2026 05:03:14 +0000

A new community CCF connector ingests AWS Config configuration item notifications into Microsoft Sentinel via a self-hosted AWS API Gateway/Lambda/DynamoDB backend, populating the AWSConfig_CL table for cloud resource configuration monitoring.

SentinelOne CCF Connector Upgraded to Multi-Instance for MSSP Deployments

Tue, 16 Jun 2026 21:24:47 +0000

The SentinelOne CCF connector now supports multiple simultaneous instances via a grid/context-pane UX, enabling MSSPs to ingest from multiple SentinelOne tenants without deploying duplicate solutions.

CCF Solution Packaging Tool Gains Five New Auth Type Handlers

Tue, 16 Jun 2026 20:55:58 +0000

The createCCPConnector.ps1 solution packaging script now supports CiscoDuo, CommVault, VisaXpayToken, BarracudaWAF, and EdgeGrid auth types, unblocking connector packaging for products using these authentication schemes.

Zimperium MTD Gains Incident Log Ingestion via Two New CCF Tables

Tue, 16 Jun 2026 06:03:25 +0000

The Zimperium Mobile Threat Defense CCF connector now ingests mobile incident data into two new custom tables, extending threat visibility beyond raw threat events to correlated incident and mitigation workflows.

QualysVM Connector Enhanced with QDS Score Parameter

Mon, 15 Jun 2026 06:38:00 +0000

Added QDS score parameter to QualysVM CCF connector, enabling users to include Qualys Detection Scores in vulnerability data collection.

Darktrace CCF Migration: New ActiveAI Security Platform Connector Replaces Legacy REST API

Mon, 15 Jun 2026 03:10:20 +0000

New CCF-based Darktrace connector with enhanced visibility across six data streams and modernized detection logic.

Palo Alto XDR ASIM Parser: Normalizing Cortex XDR Alert Data for Cross-Platform Detection

Fri, 12 Jun 2026 21:43:09 +0000

New ASIM AlertEvent parser brings Palo Alto Cortex XDR alert normalization to Microsoft Sentinel via CCF connector.

UniFi Site Manager: New CCF Solution Adds Network Infrastructure Monitoring and Attack Surface Coverage

Fri, 12 Jun 2026 10:15:11 +0000

Community solution deploys 21 detections for UniFi network security posture, ISP performance degradation, and infrastructure defense evasion tactics.

Utimaco ESKM Integration: Enterprise Key Management Monitoring Arrives in Sentinel

Fri, 12 Jun 2026 07:51:50 +0000

New solution enables Microsoft Sentinel monitoring of Utimaco Enterprise Secure Key Manager KMIP operations and authentication events.

Akamai Guardicore v3.1.0: Function App Eliminated, CCF Migration Simplifies Microsegmentation Monitoring

Fri, 12 Jun 2026 07:01:44 +0000

Akamai Guardicore connector migrates from Azure Functions to Codeless Connector Framework, removing infrastructure overhead while preserving microsegmentation visibility.

CCF Blob Connector Accelerator: Developer Reference Implementation for Event-Driven Log Ingestion

Fri, 12 Jun 2026 04:45:50 +0000

New tool provides ISV partners with complete end-to-end CCF StorageAccountBlobContainer connector pattern including automated deployment and reference solution.