New Solution: meshStack Platform Event Logs Integration for Cloud Governance
meshStack event logging connector enables cloud platform governance monitoring by ingesting developer platform events into Microsoft Sentinel. Read More →
New
New Solution: TacitRed Defender Threat Intelligence Integration
Official TacitRed Defender TI solution from Data443 enables automated sync of compromised credentials to Microsoft Defender Threat Intelligence. Read More →
Microsoft Defender XDR: New Hunting Query for Punycode Lookalike Domain Phishing
Advanced hunting query detects punycode domains using Cyrillic, Greek, and fullwidth ASCII characters to visually impersonate legitimate domains in email and Teams. Read More →
Solution Package Tool: Local Version Bumping Mode Added for Offline Development
CreateSolutionV3 script now supports offline semantic versioning with local version management alongside existing catalog API mode. Read More →
New Solution: JoeSandbox Threat Intelligence and Malware Analysis Platform Integration
Complete JoeSandbox solution deployment enabling automated malware analysis, threat intelligence feed ingestion, and incident enrichment playbooks for Microsoft Sentinel. Read More →
Major Solution Release: Cyble Vision and Tropico Solutions Added Plus Multi-Solution Updates
Large release adds two new threat intelligence solutions (Cyble Vision, Tropico) and updates to 15+ existing solutions across the repository. Read More →
Miro Solution: New Enterprise Collaboration Security and Compliance Monitoring
New Miro solution added with CCF connectors for audit logs and content logs to enable collaboration platform security monitoring. Read More →
Microsoft Entra ID: New Conditional Access Security Insights and Monitoring Workbook
New Conditional Access SISM workbook added to provide comprehensive CA policy monitoring and Zero Trust analytics. Read More →
New Cyble Vision Threat Intelligence Solution: Comprehensive CCF-Based Alert Platform
Massive new Cyble Vision solution providing 40+ specialized detection rules and parsers for diverse threat intelligence feeds from dark web to cloud security. Read More →
SOX IT Compliance Solution Released: IT Change Monitoring for Financial Controls
New compliance monitoring solution provides IT systems change tracking and segregation of duties controls for Sarbanes-Oxley compliance programs. Read More →
SOC Prime Platform: New CCF Connector for Audit Log Visibility
New SOC Prime Platform audit logs data connector added using CCF framework, providing visibility into SOC Prime TDM platform user activities and administrative actions. Read More →
SentinelSOARessentials: New Entity Analyzer Playbooks for Incident Response
Three new entity analyzer playbooks added with HTTP, URL, and incident triggers for automated URL and user entity enrichment. Read More →
Corelight Network Monitoring: Six New Aggregation Parsers for Enhanced Analytics
Added six new aggregation parsers for Corelight sensor data including DNS, HTTP, files, connections, SSL, and weird events with improved CIM mapping. Read More →
Azure Firewall ASIM Parsers: Enhanced Detection Coverage for Six New Log Types
New ASIM normalisation parsers added for six Azure Firewall log tables, expanding detection coverage for network sessions, DNS queries, and web traffic analysis. Read More →
Linux Support for Sentinel Transition Helper: Cross-Platform SOC Analysis Tool
Added Linux-compatible version of Sentinel Transition Helper script using Azure CLI for cross-platform SOC environment analysis. Read More →
New Solutions Analyzer Tool: Automated Connector-to-Table Mapping for Security Operations
Released Solutions Analyzer tool for automated discovery and mapping of connector-to-table relationships across Sentinel solutions with CSV reporting. Read More →
SAP BTP Connector: Mass Onboarding Tools for Multi-Subaccount Deployment
PowerShell automation tools added for scalable SAP BTP subaccount onboarding to Microsoft Sentinel, enabling SOC teams to efficiently connect dozens of BTP subaccounts at once. Read More →
New Quokka Qscout Mobile App Security Solution: Mobile Threat Detection Visibility
CCF connector and detection rule for Quokka Qscout mobile app security analysis platform provides visibility into malicious mobile application findings. Read More →
ZeroFox Enterprise: New CCF Connector Replaces Deprecated CCP Implementation
ZeroFox alert ingestion modernized with CCF-based connector, replacing deprecated CCP framework. Read More →
Microsoft Teams Security: 9 Additional Hunting Queries for Advanced Threat Detection
Extended Teams protection hunting coverage with queries for partner impersonation, admin submissions, and external sender analysis. Read More →