DCR on sentinelchangelog.nethttp://sentinelchangelog.net/tags/dcr/Recent content in DCR on sentinelchangelog.netHugo -- 0.157.0enThu, 09 Jul 2026 22:44:23 +0000SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)http://sentinelchangelog.net/posts/2026-07-09-pr-14615/Thu, 09 Jul 2026 22:44:23 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14615/The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.New Gambit Security Solution: Cloud Security Posture Issues Now Ingestible via CCF Push Connectorhttp://sentinelchangelog.net/posts/2026-07-08-pr-14610/Wed, 08 Jul 2026 08:45:13 +0000http://sentinelchangelog.net/posts/2026-07-08-pr-14610/Gambit Security new Microsoft Sentinel solution adds a CCF Push connector that ingests cloud security posture policy issues into a custom table, with a bundled parser and analytic rule for incident creation on High-severity active findings.Wiz Connector Overhaul: Agentless DCR Push Integration Adds Detections Stream, Eliminates Function App Attack Surfacehttp://sentinelchangelog.net/posts/2026-07-03-pr-14491/Fri, 03 Jul 2026 09:26:17 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14491/Wiz v3.0.1 replaces the legacy Azure Function pull connector with a native DCR push integration, adding a new WizDetectionsV3_CL data stream and removing the need for customer-hosted infrastructure or shared workspace keys.BlueVoyant Claude Compliance Connector: DCR Schema Expanded with Activity Fields, Sensitive request_body Removedhttp://sentinelchangelog.net/posts/2026-07-03-pr-14585/Fri, 03 Jul 2026 07:29:21 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14585/The BlueVoyant Anthropic Claude Compliance CCF connector v1.0.1 expands the DCR schema with dozens of activity-specific fields required for hunting and detection, and removes the request_body column to prevent ingestion of potentially sensitive data.GitHub AzStorage Connector: Expanded api.request Fields Land in New GitHubAuditLogsV3_CL Tablehttp://sentinelchangelog.net/posts/2026-07-02-pr-14561/Thu, 02 Jul 2026 11:15:42 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14561/The GitHub Azure Storage CCF connector gains a new V3 table with 10 additional api.request fields including token_scopes, request_method, request_body, status_code, and url_path, improving visibility into API-level attacker activity in GitHub audit logs.Checkmarx Audit Ingestion Playbook: Pagination Fix, Deployment Simplification, and RBAC Enforcementhttp://sentinelchangelog.net/posts/2026-07-02-pr-14505/Thu, 02 Jul 2026 08:55:43 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14505/The AS-Checkmarx-Audit-Ingestion Playbook receives pagination loop fixes and a collapsed single-deployment model – teams running the old multi-step deployment may have incomplete audit event ingestion.Fortinet FortiNDR Cloud Connector: Migration from Deprecated HTTP Data Collector API to Log Ingestion API with Managed Identityhttp://sentinelchangelog.net/posts/2026-06-29-pr-14558/Mon, 29 Jun 2026 13:21:35 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14558/The Fortinet FortiNDR Cloud Function App connector has been migrated from the deprecated HTTP Data Collector API (using client secret credentials) to the Log Ingestion API using Managed Identity - deployments running the previous version were heading toward a complete ingestion failure as the old API reaches end-of-life.Darktrace CCF Connector: Account Entity Mapping Added to Analytic Rules, Closing SaaS Identity Correlation Gaphttp://sentinelchangelog.net/posts/2026-06-25-pr-14546/Thu, 25 Jun 2026 11:35:07 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14546/Two Darktrace Analytic Rules now map user account names as Account entities for SaaS/identity-based incidents, and the DarktraceIncidents_CL table gains a modelBreaches field exposing the full chain of associated model alerts – data that was previously absent from incident context.New Panorays Connector: Third-Party Cyber Risk Findings Now Ingestible into Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-06-24-pr-13721/Wed, 24 Jun 2026 05:54:57 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-13721/A new CCF-based connector ingests company security findings from the Panorays API into a custom log table, unlocking visibility into third-party cyber risk posture within Sentinel.Vaikora Connector: Zero Data Ingestion Fixed After DCR Stream Mapping Failurehttp://sentinelchangelog.net/posts/2026-06-08-pr-14363/Mon, 08 Jun 2026 06:40:01 +0000http://sentinelchangelog.net/posts/2026-06-08-pr-14363/Critical fix restores Vaikora AI agent behavioral data after complete ingestion failure caused by DCR stream column mismatch.CyberArk EPM: Migration to DCR and OAuth Authentication Replaces Deprecated Log Analytics APIhttp://sentinelchangelog.net/posts/2026-06-05-pr-14181/Fri, 05 Jun 2026 05:38:19 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14181/CyberArk EPM connector updated to use DCR ingestion and OAuth authentication, addressing deprecation of Log Analytics API and improving security.Bitdefender GravityZone Solution v3.0.1 Adds Incident Analytics for Endpoint and Email Protectionhttp://sentinelchangelog.net/posts/2026-05-28-pr-13299/Thu, 28 May 2026 05:19:38 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-13299/Complete Microsoft Sentinel solution integrating Bitdefender GravityZone multi-vector threat detection with DCR-based ingestion and XDR correlation.New Strider Shield Threat Intelligence Connector for Email Security Monitoringhttp://sentinelchangelog.net/posts/2026-05-15-pr-14155/Fri, 15 May 2026 11:25:39 +0000http://sentinelchangelog.net/posts/2026-05-15-pr-14155/NVISO introduces Strider Shield CCF connector enabling ingestion of email threat intelligence data across five data streams targeting phishing and BEC protection.GitHub Webhook V2 Connector: CLv2 Migration Ensures Continued GitHub Advanced Security Ingestionhttp://sentinelchangelog.net/posts/2026-04-27-pr-14111/Mon, 27 Apr 2026 15:15:18 +0000http://sentinelchangelog.net/posts/2026-04-27-pr-14111/New CLv2-based GitHub Webhook connector replaces deprecated CLv1 API to maintain ingestion of code scanning, Dependabot, and secret scanning alerts.Bitdefender GravityZone: New Push-Based Security Data Connector for Sentinelhttp://sentinelchangelog.net/posts/2026-04-27-pr-14102/Mon, 27 Apr 2026 10:54:01 +0000http://sentinelchangelog.net/posts/2026-04-27-pr-14102/New GravityZone solution brings enterprise endpoint threat data directly to Sentinel via DCR-based push ingestion without bundled detections.SAP ETD Cloud: User Account Correlation Now Available After Data Collection Gaphttp://sentinelchangelog.net/posts/2026-04-21-pr-14089/Tue, 21 Apr 2026 07:43:46 +0000http://sentinelchangelog.net/posts/2026-04-21-pr-14089/SAP ETD alerts now surface user account names and email addresses for incident correlation, filling a critical entity mapping gap that prevented effective identity-based investigations.Data Connector 64 KB Field Truncation: Silent Data Loss Risk Documentedhttp://sentinelchangelog.net/posts/2026-04-08-pr-14008/Wed, 08 Apr 2026 21:06:23 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-14008/Microsoft Sentinel now documents a critical platform limitation where individual fields exceeding 64 KB are silently truncated during ingestion, creating blind spots in large payload analysis.Imperva Cloud WAF: Production Ready CCF Connector with Standard Tableshttp://sentinelchangelog.net/posts/2026-03-31-pr-13948/Tue, 31 Mar 2026 04:32:41 +0000http://sentinelchangelog.net/posts/2026-03-31-pr-13948/Imperva Cloud WAF CCF connector migrates from private preview custom tables to public preview standard tables.New Attack Surface Management Solution: blacklens.io Brings External Threat Visibility to Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-03-26-pr-13375/Thu, 26 Mar 2026 12:48:50 +0000http://sentinelchangelog.net/posts/2026-03-26-pr-13375/blacklens.io Attack Surface Management platform now available in Content Hub with webhook-based alert ingestion and automated incident creation.Checkmarx Audit Log Ingestion Playbook: Security Event Monitoring Integrationhttp://sentinelchangelog.net/posts/2026-03-18-pr-13841/Wed, 18 Mar 2026 07:14:01 +0000http://sentinelchangelog.net/posts/2026-03-18-pr-13841/New playbook for ingesting Checkmarx audit log events into Microsoft Sentinel via DCR/DCE for security event monitoring and compliance.Checkmarx SAST Ingestion Playbook: Static Application Security Testing Integrationhttp://sentinelchangelog.net/posts/2026-03-18-pr-13840/Wed, 18 Mar 2026 07:13:30 +0000http://sentinelchangelog.net/posts/2026-03-18-pr-13840/New playbook for ingesting Checkmarx SAST scan findings into Microsoft Sentinel via DCR/DCE for application vulnerability tracking.TheHive Connector: Field Filtering Fix Restores Complete Event Collectionhttp://sentinelchangelog.net/posts/2026-03-12-pr-13808/Thu, 12 Mar 2026 18:56:37 +0000http://sentinelchangelog.net/posts/2026-03-12-pr-13808/TheHive CCF connector removes excludeFields parameter that was preventing complete event data ingestion.Commvault Connector: Migration from Legacy Sentinel API to Modern Logs Ingestion Architecturehttp://sentinelchangelog.net/posts/2026-03-11-pr-13703/Wed, 11 Mar 2026 09:11:08 +0000http://sentinelchangelog.net/posts/2026-03-11-pr-13703/Commvault Security IQ connector migrated from deprecated Log Analytics API to Azure Monitor Logs Ingestion API with DCE/DCR architecture.Lookout Connector: Critical DCR Transform Fix Restores Mobile Threat Visibilityhttp://sentinelchangelog.net/posts/2026-02-26-pr-13651/Thu, 26 Feb 2026 10:39:34 +0000http://sentinelchangelog.net/posts/2026-02-26-pr-13651/Critical fix resolves undefined symbol error that prevented Lookout connector creation, restoring mobile threat detection capability.Microsoft Sentinel Logstash Plugin: Passwordless Authentication with Managed Identity Supporthttp://sentinelchangelog.net/posts/2026-02-17-pr-13582/Tue, 17 Feb 2026 05:09:56 +0000http://sentinelchangelog.net/posts/2026-02-17-pr-13582/Logstash output plugin enhanced with managed identity authentication for Azure VMs, AKS workload identity, and Azure Arc servers.Visa Threat Intelligence Solution: Initial Package Release with IOC Detection Ruleshttp://sentinelchangelog.net/posts/2026-02-13-pr-13616/Fri, 13 Feb 2026 21:02:02 +0000http://sentinelchangelog.net/posts/2026-02-13-pr-13616/New Visa Threat Intelligence (VTI) solution providing IOC feeds via DCR connector with high-severity detection rules for domains and file hashes.SAP Solution: Agentless Integration Suite Tooling Added for Enhanced ERP Connectivityhttp://sentinelchangelog.net/posts/2026-02-06-pr-13465/Fri, 06 Feb 2026 08:48:09 +0000http://sentinelchangelog.net/posts/2026-02-06-pr-13465/New PowerShell tooling enables agentless SAP data collection via Integration Suite with dual-mode credentials and CSV-based destination management.Oracle Cloud Infrastructure Connector: Group Cursor Support for OCI Streaminghttp://sentinelchangelog.net/posts/2026-02-03-pr-13548/Tue, 03 Feb 2026 21:43:03 +0000http://sentinelchangelog.net/posts/2026-02-03-pr-13548/OCI connector now supports Group Cursor mode alongside Individual Cursor for improved streaming partition consumption flexibility.Miro Solution: New Enterprise Collaboration Security and Compliance Monitoringhttp://sentinelchangelog.net/posts/2025-12-22-pr-13248/Mon, 22 Dec 2025 06:21:47 +0000http://sentinelchangelog.net/posts/2025-12-22-pr-13248/New Miro solution added with CCF connectors for audit logs and content logs to enable collaboration platform security monitoring.Microsoft Copilot Connector — Critical Table Name Update from LLMActivity to CopilotActivityhttp://sentinelchangelog.net/posts/2025-12-16-pr-13272/Tue, 16 Dec 2025 04:58:57 +0000http://sentinelchangelog.net/posts/2025-12-16-pr-13272/Microsoft Copilot connector fixes critical table reference issue, standardizing on official CopilotActivity table name across all components.Ermes Browser Security Connector — Enhanced Data Fidelity and Multi-Tenant Supporthttp://sentinelchangelog.net/posts/2025-12-16-pr-13303/Tue, 16 Dec 2025 04:32:43 +0000http://sentinelchangelog.net/posts/2025-12-16-pr-13303/CCF connector update fixes timestamp extraction, adds configurable API endpoints, and expands log data collection for better event visibility.Lookout Mobile Security: Parser Fixes and Executive Dashboard Enhancementhttp://sentinelchangelog.net/posts/2025-12-15-pr-13148/Mon, 15 Dec 2025 04:59:29 +0000http://sentinelchangelog.net/posts/2025-12-15-pr-13148/Lookout solution updated to v3.0.1 with parser fixes, comprehensive security dashboards, and enhanced analytic rules.SOC Prime Platform: New CCF Connector for Audit Log Visibilityhttp://sentinelchangelog.net/posts/2025-12-10-pr-13186/Wed, 10 Dec 2025 10:28:25 +0000http://sentinelchangelog.net/posts/2025-12-10-pr-13186/New SOC Prime Platform audit logs data connector added using CCF framework, providing visibility into SOC Prime TDM platform user activities and administrative actions.Snowflake Connector: Data Parsing Logic Restored After SQL Query Malformationhttp://sentinelchangelog.net/posts/2025-11-21-pr-13177/Fri, 21 Nov 2025 17:52:35 +0000http://sentinelchangelog.net/posts/2025-11-21-pr-13177/Critical fix to Snowflake connector data parsing logic, switching from array-based extraction to proper JSON field extraction, restoring visibility across all log types.Salesforce Service Cloud Connector: Column Name Bug Fix Plus Multi-Solution Updateshttp://sentinelchangelog.net/posts/2025-11-21-pr-13150/Fri, 21 Nov 2025 08:17:44 +0000http://sentinelchangelog.net/posts/2025-11-21-pr-13150/Fixed critical column name mapping bug in Salesforce Service Cloud CCF connector preventing proper data ingestion.ZeroFox Enterprise: New CCF Connector Replaces Deprecated CCP Implementationhttp://sentinelchangelog.net/posts/2025-11-21-pr-12754/Fri, 21 Nov 2025 06:16:09 +0000http://sentinelchangelog.net/posts/2025-11-21-pr-12754/ZeroFox alert ingestion modernized with CCF-based connector, replacing deprecated CCP framework.Open Systems Connector: aiohttp Security Update 3.10.11→3.12.14 Plus Multi-Solution Changeshttp://sentinelchangelog.net/posts/2025-11-20-pr-13158/Thu, 20 Nov 2025 08:54:08 +0000http://sentinelchangelog.net/posts/2025-11-20-pr-13158/Open Systems connector updated aiohttp dependency addressing potential security vulnerabilities, bundled with extensive solution packaging updates.Check Point Cyberint Alerts: DCR Transform Fix and Customer Name Header Additionhttp://sentinelchangelog.net/posts/2025-11-19-pr-13080/Wed, 19 Nov 2025 10:08:38 +0000http://sentinelchangelog.net/posts/2025-11-19-pr-13080/Check Point Cyberint Alerts connector v3.0.1 fixes DCR formatting and adds customer name header for proper API authentication.Cyera DSPM Solution: New Data Security Posture Management Integrationhttp://sentinelchangelog.net/posts/2025-11-19-pr-12980/Wed, 19 Nov 2025 05:51:35 +0000http://sentinelchangelog.net/posts/2025-11-19-pr-12980/New solution added for Cyera DSPM providing data security monitoring with both CCF and Function App connectors.Varonis Purview: New Push Connector for Microsoft Purview Data Governance Integrationhttp://sentinelchangelog.net/posts/2025-11-18-pr-13110/Tue, 18 Nov 2025 11:37:15 +0000http://sentinelchangelog.net/posts/2025-11-18-pr-13110/New solution providing push connector to sync Varonis data resources into Microsoft Purview via Sentinel data lake.GCP Security Command Center: New Detection Suite for Cloud Misconfigurationshttp://sentinelchangelog.net/posts/2025-11-14-pr-13116/Fri, 14 Nov 2025 08:22:41 +0000http://sentinelchangelog.net/posts/2025-11-14-pr-13116/New Solution delivers 5 Analytic Rules and 5 Hunting Queries to detect GCP security misconfigurations including unrestricted API keys, disabled security features, and risky IAM configurations.New Pathlock Threat Detection and Response Solution: SAP Security Integration for Microsoft Sentinelhttp://sentinelchangelog.net/posts/2025-11-11-pr-13076/Tue, 11 Nov 2025 07:41:08 +0000http://sentinelchangelog.net/posts/2025-11-11-pr-13076/Push-based connector integrating Pathlock TDnR SAP security monitoring with Microsoft Sentinel for enhanced SAP application security visibility.CyberArk Audit Security Update: CVE-2024-47081 Fix Plus Multi-Solution Maintenancehttp://sentinelchangelog.net/posts/2025-11-05-pr-13061/Wed, 05 Nov 2025 13:11:45 +0000http://sentinelchangelog.net/posts/2025-11-05-pr-13061/Critical security update for CyberArk Audit requests library addressing credential leak vulnerability, plus comprehensive updates across 8 solutions.OneTrust Data Security Platform Connector: New Privacy and Risk Management Visibilityhttp://sentinelchangelog.net/posts/2025-10-31-pr-13007/Fri, 31 Oct 2025 08:36:47 +0000http://sentinelchangelog.net/posts/2025-10-31-pr-13007/New CCF-based connector for OneTrust enables monitoring of privacy compliance, data governance, and risk management activities in Sentinel workspaces.Multi-Solution Update: Microsoft 365 Filters, GDPR Workbook Enhancements, and New BigID Solutionhttp://sentinelchangelog.net/posts/2025-10-15-pr-12950/Wed, 15 Oct 2025 08:14:10 +0000http://sentinelchangelog.net/posts/2025-10-15-pr-12950/Major update spanning 15+ solutions adds Microsoft 365 filters, GDPR workbook improvements, new BigID DSPM solution, and Netskope v2 with comprehensive parsers.Feedly Connector: Critical Migration from Deprecated API Prevents Complete Data Losshttp://sentinelchangelog.net/posts/2025-10-14-pr-12913/Tue, 14 Oct 2025 06:41:02 +0000http://sentinelchangelog.net/posts/2025-10-14-pr-12913/Migration from deprecated HTTP Data Collector API to Log Ingestion API prevents Feedly threat intelligence blind spot.BigID DSPM Solution: New CCF Connector for Data Security Posture Managementhttp://sentinelchangelog.net/posts/2025-10-14-pr-12929/Tue, 14 Oct 2025 05:25:26 +0000http://sentinelchangelog.net/posts/2025-10-14-pr-12929/New BigID DSPM solution provides CCF connector for ingesting data security posture cases, affected objects, and datasource information into Microsoft Sentinel.Sentinel CCF Packaging Tool: Adding JWT Token Authentication Supporthttp://sentinelchangelog.net/posts/2025-10-09-pr-12906/Thu, 09 Oct 2025 13:10:17 +0000http://sentinelchangelog.net/posts/2025-10-09-pr-12906/CCF packaging tooling now supports JWT token authentication alongside existing methods for connector development.New Cloudflare CCF Solution: Enterprise Log Visibility via Azure Blob Integrationhttp://sentinelchangelog.net/posts/2025-10-09-pr-12898/Thu, 09 Oct 2025 11:50:56 +0000http://sentinelchangelog.net/posts/2025-10-09-pr-12898/New Cloudflare connector solution delivers comprehensive log ingestion through CCF blob integration for enhanced web traffic and security monitoring.Multiple Solutions Added: Palo Alto aiohttp Update Plus New Obsidian and SAP S4 Connectorshttp://sentinelchangelog.net/posts/2025-10-08-pr-12922/Wed, 08 Oct 2025 12:22:56 +0000http://sentinelchangelog.net/posts/2025-10-08-pr-12922/Palo Alto Prisma Cloud dependency security update alongside new Obsidian Datasharing and SAP S4 Cloud Public Edition connector solutions.