Critical-Fix on sentinelchangelog.nethttp://sentinelchangelog.net/tags/critical-fix/Recent content in Critical-Fix on sentinelchangelog.netHugo -- 0.157.0enThu, 09 Jul 2026 22:44:23 +0000SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)http://sentinelchangelog.net/posts/2026-07-09-pr-14615/Thu, 09 Jul 2026 22:44:23 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14615/The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.Azure Firewall ASIM DNS Parsers: Silent Union Failure Fixed for Resource-Specific Log Modehttp://sentinelchangelog.net/posts/2026-07-09-pr-14609/Thu, 09 Jul 2026 22:21:33 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14609/When Azure Firewall is configured to send logs only to the resource-specific AZFWDnsQuery table, the AzureDiagnostics branch of both ASimDnsAzureFirewall and vimDnsAzureFirewall parsers was aborting with a scalar resolution error, dropping all DNS query data from those branches entirely.Agent 365: Microsoft Agent Identities Connector Page KQL Parse Error Patched by Removing Data Type Declarationshttp://sentinelchangelog.net/posts/2026-07-09-pr-14627/Thu, 09 Jul 2026 04:22:44 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14627/The EntraNHIAssets connector definition drops all four data type entries to eliminate an empty-subquery KQL parse error on the connector page — though reviewers flag this may break connector metadata contracts.Azure WAF Log4j Detection Restored: Field Reference Errors Silenced the Rule Since v1.0.5http://sentinelchangelog.net/posts/2026-07-07-pr-14632/Tue, 07 Jul 2026 13:22:48 +0000http://sentinelchangelog.net/posts/2026-07-07-pr-14632/A broken column_ifexists reference caused the Azure WAF Log4j detection rule to silently miss exploit traffic in details_message and details_msg fields – any deployment running v1.0.5 had a gap in Log4Shell (CVE-2021-44228) coverage via WAF logs.WithSecure Elements CCF Connector: Zero-Ingestion Fix for Broken OAuth2 Auth and Invalid Query Parametershttp://sentinelchangelog.net/posts/2026-07-07-pr-14619/Tue, 07 Jul 2026 12:06:39 +0000http://sentinelchangelog.net/posts/2026-07-07-pr-14619/The WithSecureElementsCCF connector has been non-functional since initial release – both the OAuth2 token request and the security-events API call failed with HTTP 400 errors, meaning no WithSecure endpoint security events have been ingested into any Sentinel deployment running this connector.Checkmarx Audit Ingestion Playbook: Pagination Fix, Deployment Simplification, and RBAC Enforcementhttp://sentinelchangelog.net/posts/2026-07-02-pr-14505/Thu, 02 Jul 2026 08:55:43 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14505/The AS-Checkmarx-Audit-Ingestion Playbook receives pagination loop fixes and a collapsed single-deployment model – teams running the old multi-step deployment may have incomplete audit event ingestion.DocuSign Connector: Az Module Upgrade Restores PowerShell 7.2+ Function App Compatibilityhttp://sentinelchangelog.net/posts/2026-07-02-pr-14572/Thu, 02 Jul 2026 04:18:50 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14572/The DocuSign Security Events Function App connector was failing to load Az module cmdlets on PowerShell 7.2+ runtimes; bumping the dependency from Az 5.* to 11.* restores ingestion.Cisco Umbrella CCF Connector GA Promotion Fixes Template Variable Rendering in UI Querieshttp://sentinelchangelog.net/posts/2026-07-01-pr-14603/Wed, 01 Jul 2026 19:55:19 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14603/The Cisco Umbrella CCF connector graduates to GA while also resolving broken template variable references that caused Content Hub connectivity checks and sample queries to malfunction.Lookout Connector v3.0.6: Silent Ingestion Stop After 24h and Four DCR Field Mapping Blind Spots Fixedhttp://sentinelchangelog.net/posts/2026-07-01-pr-14564/Wed, 01 Jul 2026 06:13:06 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14564/A CCF cursor expiry caused the Lookout streaming connector to silently stop ingesting data after roughly 24 hours, and four incorrect DCR field paths meant ThreatId, ThreatAction, DeviceEmail, and SmishingAlertId were null in every ingested record.Semperis Lightning Connector: TLS Certificate Verification Restored Across All API Callshttp://sentinelchangelog.net/posts/2026-06-30-pr-14539/Tue, 30 Jun 2026 07:59:33 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14539/The Semperis Lightning data connector was making all outbound API requests with TLS verification disabled (verify=False), exposing token acquisition and all data collection calls to man-in-the-middle attacks; this fix re-enables certificate validation across seven affected modules.Google Workspace Reports: Google Meet Activity Logs Restored After Polling Window Gaphttp://sentinelchangelog.net/posts/2026-06-30-pr-14544/Tue, 30 Jun 2026 06:22:41 +0000http://sentinelchangelog.net/posts/2026-06-30-pr-14544/A missing queryWindowDelayInMin setting caused Google Meet audit events to be silently dropped by the CCF connector - adding a 30-minute delay restores ingestion of events that arrive late from Google API.Cofense Intelligence Connector: SSRF and Credential Leakage Vulnerabilities Patched in DownloadThreatReports Functionhttp://sentinelchangelog.net/posts/2026-06-29-pr-14542/Mon, 29 Jun 2026 09:13:54 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14542/Critical security hardening of the Cofense Intelligence Azure Function eliminates a Server-Side Request Forgery (SSRF) vector and credential leakage risk that allowed callers to redirect authenticated requests to arbitrary or internal hosts.TacitRed Defender TI Playbook: Fixing Content Hub Deployment Failure on Hyphenated Workspace Nameshttp://sentinelchangelog.net/posts/2026-06-24-pr-13639/Wed, 24 Jun 2026 09:19:23 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-13639/TacitRed Defender Threat Intelligence v3.0.2 fixes an InvalidTemplate ARM error that blocked Content Hub deployment entirely on any workspace with a hyphenated name, plus resolves a sovereign cloud storage endpoint bug and adds required post-deployment RBAC guidance.QualysVM CCF Connector: Restoring Vulnerability Data Ingestion After API Timeout Blind Spothttp://sentinelchangelog.net/posts/2026-06-24-pr-14541/Wed, 24 Jun 2026 08:17:32 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-14541/Customers with large Qualys environments were receiving zero vulnerability detection data due to chronic API timeouts – this fix raises the CCF timeout to the platform maximum, tightens the query window, and adds a lightweight connectivity check to unblock ingestion.Threat Intelligence (NEW): Broken Connector Mappings and Case-Sensitive Rule Names Fixed Across 36 Analytic Ruleshttp://sentinelchangelog.net/posts/2026-06-23-pr-14300/Tue, 23 Jun 2026 12:08:41 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14300/Two customer-reported issues are resolved: EmailEvents and EmailUrlInfo rules were mapped to the wrong connectors (Office365 instead of MicrosoftThreatProtection), and inconsistent capitalisation in rule names was silently breaking customer Playbook automations.Illumio Insights Graph Connector: DCR Type Mismatches Were Blocking All Ingestionhttp://sentinelchangelog.net/posts/2026-06-19-pr-14518/Fri, 19 Jun 2026 11:11:51 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14518/The IllumioInsightsGraph CCF connector had column type mismatches between the table schema and DCR transform that caused ingestion failures – this fix corrects TimeGenerated from string to datetime and multiple numeric fields from long to int, but introduces overflow risk for byte counters in high-volume environments.Fortinet FortiNDR Cloud Connector: Migration from Deprecated HTTP Data Collector API to Log Ingestion APIhttp://sentinelchangelog.net/posts/2026-06-19-pr-14295/Fri, 19 Jun 2026 09:00:48 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14295/The FortiNDR Cloud Function App connector has been fully rewritten to use the Azure Monitor Log Ingestion API, replacing the retired HTTP Data Collector API – deployments still on v3.0.x have had zero ingestion since the legacy API was deprecated.Vaikora-AzureSecurityCenter: Three Analytic Rules and Playbook Completely Non-Functional Since Initial Deploymenthttp://sentinelchangelog.net/posts/2026-06-18-pr-14366/Thu, 18 Jun 2026 12:25:32 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14366/The v3.0.0 solution was built against a fabricated alert API schema – the playbook crashed on ingestion, all three Analytic Rules queried a table that was never populated, and two install paths wrote to divergent tables, meaning zero Vaikora AI agent threat data reached Microsoft Sentinel from day one.Vaikora-SentinelOne Playbook: Broken IOC Push Restored After HTTP 422 API Rejectionhttp://sentinelchangelog.net/posts/2026-06-18-pr-14364/Thu, 18 Jun 2026 12:25:17 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14364/The v3.0.0 playbook always appended an empty agent_id= parameter, causing the Vaikora API to reject every poll request with HTTP 422, silently halting all IOC delivery to SentinelOne Threat Intelligence since initial deployment.Vaikora-CrowdStrike Playbook: Silent IOC Pipeline Failure Fixed for Monitor All Agents Modehttp://sentinelchangelog.net/posts/2026-06-18-pr-14365/Thu, 18 Jun 2026 09:50:02 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14365/When VaikoraAgentId was left blank to monitor all agents, every HTTP 422 rejection from the Vaikora API silently dropped all IOCs - no high/critical-risk actions ever reached CrowdStrike Falcon.ASIM Parser CI Workflows Fixed: File-Not-Found Errors Were Silently Skipping All Parser Testshttp://sentinelchangelog.net/posts/2026-06-16-pr-14499/Tue, 16 Jun 2026 22:44:02 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14499/The ASIM parser schema and data ingestion test workflows were failing to read parser YAML and sample data files at runtime due to broken URL-based file access; this fix switches to local filesystem reads, restoring test coverage for all modified ASIM parsers.ZeroFox Threat Intelligence: Marketplace Packaging Fix Restores Customer Accesshttp://sentinelchangelog.net/posts/2026-06-15-pr-14461/Mon, 15 Jun 2026 12:23:07 +0000http://sentinelchangelog.net/posts/2026-06-15-pr-14461/Critical solution ID mismatch prevented customers from installing ZeroFox Threat Intelligence connector from marketplace.ASIM Template Validation: Reliability Fix for Flaky Test Results and Performance Optimizationhttp://sentinelchangelog.net/posts/2026-06-12-pr-14469/Fri, 12 Jun 2026 20:19:55 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14469/ASIM parser validation workflow updated to use local repository files instead of raw GitHub URLs, fixing malformed URL issues causing test failures.Imperva Cloud WAF: Critical Parsing Fix Restores Visibility for Complex Eventshttp://sentinelchangelog.net/posts/2026-06-11-pr-14456/Thu, 11 Jun 2026 18:14:11 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-14456/Imperva Cloud WAF connector switched to CommonEventFormatTransformer, fixing data ingestion failures for logs containing embedded quotes and pipes in CEF events.Cisco ETD: Migration to Message Event Logs API with Enhanced Email Security Visibilityhttp://sentinelchangelog.net/posts/2026-06-10-pr-14290/Wed, 10 Jun 2026 10:40:25 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14290/Labeled P0 — assess deployment or pipeline breakage risk explicitly. Complete connector overhaul migrates to new Message Event Logs REST API providing enhanced email visibility beyond convicted messages.Bitdefender GravityZone Parser: Critical Fix for Network Sandboxing Event Parsing Failurehttp://sentinelchangelog.net/posts/2026-06-10-pr-14412/Wed, 10 Jun 2026 06:42:06 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14412/ASIM parser for Bitdefender GravityZone was failing due to missing type cast, preventing ingestion of network sandboxing alerts.Pathlock TDnR Connector: Critical JSON Fix Restores Deployment Capabilityhttp://sentinelchangelog.net/posts/2026-06-09-pr-14426/Tue, 09 Jun 2026 07:47:47 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14426/Invalid JSON in Pathlock TDnR connector definition blocked deployment via strict parsers — critical fix for P0 issue.Cisco Meraki Parser: Critical Self-Reference Recursion Fixed After v3.0.5 Packaging Errorhttp://sentinelchangelog.net/posts/2026-06-09-pr-14435/Tue, 09 Jun 2026 06:46:29 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14435/Restores Cisco Meraki parser functionality by fixing table reference error that caused recursive failure and broke all downstream queries.Vaikora Connector: Zero Data Ingestion Fixed After DCR Stream Mapping Failurehttp://sentinelchangelog.net/posts/2026-06-08-pr-14363/Mon, 08 Jun 2026 06:40:01 +0000http://sentinelchangelog.net/posts/2026-06-08-pr-14363/Critical fix restores Vaikora AI agent behavioral data after complete ingestion failure caused by DCR stream column mismatch.Lookout Connector: Critical Data Loss Fix for Mobile Threat Event Identifiershttp://sentinelchangelog.net/posts/2026-06-05-pr-14286/Fri, 05 Jun 2026 10:14:45 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14286/Lookout Mobile Risk API v2 connector was silently dropping unique event identifiers (oid field), breaking all downstream correlation in detections and workbooks.Check Point ASIM NetworkSession Parser: DeviceVendor Field Matching Fixhttp://sentinelchangelog.net/posts/2026-06-05-pr-13776/Fri, 05 Jun 2026 08:25:24 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-13776/Check Point firewall ASIM parser updated to handle both “Check Point” and “CheckPoint” DeviceVendor field values, fixing parsing failures introduced in PR #12056.BeyondTrust PM Cloud: Function App Reliability Fix Prevents Timeout on Large Event Backlogshttp://sentinelchangelog.net/posts/2026-06-05-pr-14386/Fri, 05 Jun 2026 05:11:12 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14386/Critical fix prevents BeyondTrust PM Cloud Function App timer functions from hanging when processing large event backlogs, restoring data ingestion reliability.42Crunch API Protection: Critical Migration from Legacy HTTP Collector to CCF Push Connectorhttp://sentinelchangelog.net/posts/2026-05-29-pr-14210/Fri, 29 May 2026 16:38:05 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14210/Migration addresses deprecated HTTP Data Collector API by implementing CCF OAuth2/Entra ID ingestion — deployments on legacy connector face imminent data loss.Microsoft Entra ID OAuth Consent Query: Fixing Zero-Result Bug in High-Risk Permission Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14334/Wed, 27 May 2026 13:38:30 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14334/Corrects broken hunting query that returned no results due to incorrect property name filter.Fortinet FortiGate Playbook: Function App Authentication Security Hardeninghttp://sentinelchangelog.net/posts/2026-05-25-pr-14316/Mon, 25 May 2026 06:58:27 +0000http://sentinelchangelog.net/posts/2026-05-25-pr-14316/Playbook Function App authentication level upgraded from anonymous to function-level to close security exposure.Function App Security: Access Control Hardening Across Multiple Data Connectorshttp://sentinelchangelog.net/posts/2026-05-18-pr-14284/Mon, 18 May 2026 10:00:54 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14284/Function keys now required for HTTP-triggered functions in Zoom, Zscaler, FortiGate, Cofense, Illumio, and Infoblox connectors—removing anonymous access vulnerability.Abnormal Security CCF Connector: Critical Fix Restores Email Threat Detection After Complete Ingestion Failurehttp://sentinelchangelog.net/posts/2026-05-13-pr-14216/Wed, 13 May 2026 05:15:24 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-14216/Fixes DCR transform errors, table deployment issues, and stream routing that prevented all data ingestion from Abnormal Security’s CCF Push connector since v3.0.0 launch.Vaikora Azure Security Center: Microsoft Marketplace Certification Fixhttp://sentinelchangelog.net/posts/2026-05-07-pr-14211/Thu, 07 May 2026 11:58:41 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14211/Reverts solution ID to match Partner Center offer name after Marketplace certification failure under policy 300.4.1.1.Recorded Future Identity Playbook: ARM Template Deploy Failure Fixedhttp://sentinelchangelog.net/posts/2026-05-07-pr-14197/Thu, 07 May 2026 10:53:02 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14197/Fixes broken deployment of RFI-confirm-EntraID-risky-user playbook that failed with InvalidTemplate error due to stale action references.Cyjax Connector: Security and Code Quality Fixes Appliedhttp://sentinelchangelog.net/posts/2026-05-07-pr-14193/Thu, 07 May 2026 07:12:52 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14193/Addressed lint issues, package vulnerabilities, and code vulnerabilities in Cyjax threat intelligence connector.Cisco Duo Connector: API Throttling Resilience Improved for Log Ingestionhttp://sentinelchangelog.net/posts/2026-05-07-pr-14204/Thu, 07 May 2026 04:48:36 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14204/Doubled retry delay to 120 seconds to address Duo API throttling requirements preventing log collection.Workspace Usage Workbook: IsBillable Column Display Labels Correctedhttp://sentinelchangelog.net/posts/2026-05-07-pr-14214/Thu, 07 May 2026 04:36:13 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14214/Fixed inverted display labels in WorkspaceUsage workbook where billing status showed opposite values.GitHub Actions Security: Fork PR Workflow Hardened Against Supply Chain Attackshttp://sentinelchangelog.net/posts/2026-05-06-pr-14220/Wed, 06 May 2026 13:23:44 +0000http://sentinelchangelog.net/posts/2026-05-06-pr-14220/CI/CD security enhancement prevents automatic execution of untrusted fork code by implementing strict SafeToRun label gating.GitHub Advanced Security Parser Migration: CLv2 Compatibility and Schema Updateshttp://sentinelchangelog.net/posts/2026-05-06-pr-14209/Wed, 06 May 2026 09:39:18 +0000http://sentinelchangelog.net/posts/2026-05-06-pr-14209/Critical fix migrates GitHub parsers and workbooks to support CLv2 ingestion table and updated GitHub alert event schemas, ensuring compatibility across V1 and V2 deployments.VMware vCenter ASIM Parser: DvcId Type Correction Prevents Query Failureshttp://sentinelchangelog.net/posts/2026-05-05-pr-14182/Tue, 05 May 2026 23:34:50 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14182/Fixed critical data type mismatch in VMware vCenter authentication parser that caused DvcId field queries to fail.Solutions Analyzer: Fix Connector Overcount in CCF v2 Solutionshttp://sentinelchangelog.net/posts/2026-05-05-pr-14184/Tue, 05 May 2026 08:00:11 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14184/Solutions Analyzer was double-counting connectors in CCF v2 solutions due to azuredeploy wrapper files creating phantom duplicates.MISP2Sentinel: Critical Table Reference Fix for Upload Indicators APIhttp://sentinelchangelog.net/posts/2026-05-05-pr-14091/Tue, 05 May 2026 07:18:11 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14091/MISP threat intelligence connector was broken due to incorrect table reference — deployments had zero indicator ingestion until this fix.Joe Sandbox Solution: ARM Template Fixes and IOC Handling Improvementshttp://sentinelchangelog.net/posts/2026-05-04-pr-14130/Mon, 04 May 2026 12:39:49 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14130/Joe Sandbox solution updated to v3.0.1 with Azure template fixes, updated storage API versions, and improved IOC processing in playbooks.Azure DevOps Auditing: Fixing Broken Connector After Parameter Mismatchhttp://sentinelchangelog.net/posts/2026-05-04-pr-14090/Mon, 04 May 2026 06:56:16 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14090/Critical configuration fix resolves parameter name mismatch that prevented Azure DevOps audit log ingestion entirely.Upwind Connector: Function App Deployment Fixed After Broken Code Deploymenthttp://sentinelchangelog.net/posts/2026-05-01-pr-14158/Fri, 01 May 2026 06:48:48 +0000http://sentinelchangelog.net/posts/2026-05-01-pr-14158/Upwind connector Function App deployment was failing due to incorrect zip structure and ARM template configuration - fixed with flat zip layout and implicit hosting plan.