Other: CI Config on sentinelchangelog.net

New Netskope Alerts and Events Solution: DLP, Shadow IT, and Malware Threat Visibility via CCF Blob Storage Connector

Fri, 10 Jul 2026 06:05:09 +0000

A new Microsoft Sentinel solution delivers full-stack Netskope Security Cloud visibility including DLP incidents, malware detections, policy enforcement, and Shadow IT via a CCF Blob Storage connector ingesting gzip-compressed positional CSV into a 254-column custom table.

SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)

Thu, 09 Jul 2026 22:44:23 +0000

The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.

Untitled

Wed, 08 Jul 2026 05:12:41 +0000

test

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/FrendsAuditLogs_CL.json
DataConnectors/Frends iPaaS/FrendsAuditLogs_CL.json
DataConnectors/Frends iPaaS/FrendsAuditLogs_Sentinel_CCF.json
DataConnectors/Frends iPaaS/README.md

ESET PROTECT Platform: New CCF Connector Adds Native Ingestion for Endpoint Inspect and Cloud Office Security Detections

Thu, 02 Jul 2026 19:58:40 +0000

A new Codeless Connector Framework connector and updated parser extend ESET PROTECT Platform coverage to three log streams while maintaining backward compatibility with the legacy Function App connector.

AI Agents Hunting Queries Migrated to Unified AgentsInfo Table -- Connector-Split Queries Retired

Thu, 02 Jul 2026 10:38:59 +0000

Seven consolidated AI agent hunting queries now target the unified Defender XDR AgentsInfo table, replacing 26 connector-specific queries split across the A365 and Copilot Studio connectors; existing deployments still running the old AIAgentsInfo-based queries have had no effective hunting coverage since the table split was introduced.

New Solution: Vaikora for O365 Brings CTASD-Powered Phishing Quarantine Telemetry into Microsoft Sentinel

Thu, 25 Jun 2026 11:56:08 +0000

A brand-new Sentinel solution for Vaikora for O365 (by Data443) adds three Analytic Rules over the VaikoraO365_Quarantine_CL custom table – covering high-confidence phishing/suspected quarantine events, abnormal quarantine volume spikes, and engine-offline detection – plus an incident-response Playbook and a quarantine dashboard Workbook.

Darktrace CCF Connector: Account Entity Mapping Added to Analytic Rules, Closing SaaS Identity Correlation Gap

Thu, 25 Jun 2026 11:35:07 +0000

Two Darktrace Analytic Rules now map user account names as Account entities for SaaS/identity-based incidents, and the DarktraceIncidents_CL table gains a modelBreaches field exposing the full chain of associated model alerts – data that was previously absent from incident context.

Cybersixgill Actionable Alerts: CCF Connector Added with Unified Parser Bridging Legacy and New Tables

Thu, 25 Jun 2026 11:34:30 +0000

The Cybersixgill Actionable Alerts solution adds a new CCF-based data connector alongside a unified parser that abstracts both the legacy Azure Function table (CyberSixgill_Alerts_CL) and the new CCF table (CyberSixgillAlertsV2_CL), ensuring hunting queries and workbooks continue working regardless of which connector is deployed.

iboss Solution 3.1.3: New Malware and C2 Analytic Rules for Web Gateway Telemetry

Thu, 25 Jun 2026 06:26:43 +0000

iboss Solution 3.1.3 ships two new Scheduled Analytic Rules that surface malware detections and C2 communications flagged by the iboss gateway, closing a detection gap for organizations relying solely on raw CommonSecurityLog ingestion.

New ASIM WebSession Parser Brings AWS WAF Traffic into Normalized Detection Coverage

Mon, 22 Jun 2026 21:57:23 +0000

AWS WAF web session logs can now be ingested and normalized via the ASIM WebSession schema, enabling source-agnostic detections against WAF allow/block/challenge/captcha decisions from the AWSWAF table.

CrowdStrike Falcon AlertEvent ASIM Parser: Falcon Detections Now Normalised into Unified Alert Schema

Fri, 19 Jun 2026 23:45:23 +0000

A new ASIM AlertEvent parser for CrowdStrike Falcon ingested via CCF normalises detection data from the CrowdStrikeDetections table into the ASIM AlertEvent schema, enabling source-agnostic detection and hunting queries across EDR alert data.

Microsoft Defender XDR: OAuth and Device-Code Phishing Hunting Queries Unblocked After ARM-TTK Pipeline Failure

Thu, 18 Jun 2026 05:58:50 +0000

Two Defender XDR hunting queries targeting OAuth consent and device-code phishing were blocked from pipeline validation due to ARM-TTK hardcoded URI false positives; KQL refactored to construct URLs via strcat(), restoring deployment and preserving detection semantics.

Netskope Security Cloud Joins ASIM AlertEvent Schema â Threats Now Normalised from NetskopeAlerts_CL

Wed, 17 Jun 2026 18:29:45 +0000

A new ASIM AlertEvent parser for Netskope Security Cloud normalises DLP, malware, C2, IPS, compromised credential, UBA, and policy alerts from the NetskopeAlerts_CL table into the standard AlertEvent schema, enabling source-agnostic detections and hunting across Netskope data.

ASIM Parser CI Workflows Fixed: File-Not-Found Errors Were Silently Skipping All Parser Tests

Tue, 16 Jun 2026 22:44:02 +0000

The ASIM parser schema and data ingestion test workflows were failing to read parser YAML and sample data files at runtime due to broken URL-based file access; this fix switches to local filesystem reads, restoring test coverage for all modified ASIM parsers.

ASIM Template Validation: Reliability Fix for Flaky Test Results and Performance Optimization

Fri, 12 Jun 2026 20:19:55 +0000

ASIM parser validation workflow updated to use local repository files instead of raw GitHub URLs, fixing malformed URL issues causing test failures.

ASIM Validator Infrastructure: Schema Testing Migrated to Remote Download Pattern

Fri, 12 Jun 2026 19:59:54 +0000

ASIM parser validation tooling updated to download ASimSchemaTester from GitHub instead of using hardcoded inline function.

UniFi Site Manager: New CCF Solution Adds Network Infrastructure Monitoring and Attack Surface Coverage

Fri, 12 Jun 2026 10:15:11 +0000

Community solution deploys 21 detections for UniFi network security posture, ISP performance degradation, and infrastructure defense evasion tactics.

Utimaco ESKM Integration: Enterprise Key Management Monitoring Arrives in Sentinel

Fri, 12 Jun 2026 07:51:50 +0000

New solution enables Microsoft Sentinel monitoring of Utimaco Enterprise Secure Key Manager KMIP operations and authentication events.

Akamai Guardicore v3.1.0: Function App Eliminated, CCF Migration Simplifies Microsegmentation Monitoring

Fri, 12 Jun 2026 07:01:44 +0000

Akamai Guardicore connector migrates from Azure Functions to Codeless Connector Framework, removing infrastructure overhead while preserving microsegmentation visibility.

Google SecOps Integration: New Detection Pipeline Connects Chronicle to Sentinel

Fri, 12 Jun 2026 07:00:27 +0000

Microsoft Sentinel gains visibility into Google Chronicle security detections through new connector and parsers.

Field Effect MDR Integration: New CCF Connector Delivers Cloud-Based Threat Detection

Thu, 11 Jun 2026 08:21:17 +0000

Field Effect MDR solution adds Microsoft Sentinel ingestion for ARO (Automated Response Operations) alerts via CCF, expanding managed detection coverage.

Solutions Analyzer v9.8: Connector Discovery Accuracy and Documentation Deep-Links

Wed, 10 Jun 2026 03:39:39 +0000

Enhanced Solutions Analyzer tooling improves connector discovery accuracy and adds artifact deep-linking for external integrations.

ASIM Parser Testing: Bitdefender GravityZone Validation Conflict Resolved

Mon, 08 Jun 2026 21:41:50 +0000

Removes duplicate CustomFunction test shim causing KQL validation failures after parser merge.

Lookout Connector: Critical Data Loss Fix for Mobile Threat Event Identifiers

Fri, 05 Jun 2026 10:14:45 +0000

Lookout Mobile Risk API v2 connector was silently dropping unique event identifiers (oid field), breaking all downstream correlation in detections and workbooks.

Filewall for Microsoft 365: New Solution Adds Data Exfiltration Detection for Exchange and Files

Thu, 04 Jun 2026 10:47:14 +0000

Complete CCF-based solution delivers real-time monitoring of blocked emails and files across Microsoft 365 services with immediate threat alerting.

Cisco Umbrella CCF: Public Preview Expands Data Visibility with 10 New Log Tables

Mon, 01 Jun 2026 14:34:58 +0000

New Codeless Connector Framework introduces comprehensive log coverage across DNS, web traffic, cloud firewall, admin audit, DLP, file events, IPS, VPN and Zero Trust access for enhanced threat detection.

ASIM Parser Development Automation: GitHub Copilot Skills for Accelerated Detection Engineering

Fri, 29 May 2026 23:39:29 +0000

GitHub Copilot agent skills now automate the complete ASIM parser creation workflow, reducing parser development time from days to hours for security engineers.

42Crunch API Protection: Critical Migration from Legacy HTTP Collector to CCF Push Connector

Fri, 29 May 2026 16:38:05 +0000

Migration addresses deprecated HTTP Data Collector API by implementing CCF OAuth2/Entra ID ingestion — deployments on legacy connector face imminent data loss.

Bitdefender GravityZone Solution v3.0.1 Adds Incident Analytics for Endpoint and Email Protection

Thu, 28 May 2026 05:19:38 +0000

Complete Microsoft Sentinel solution integrating Bitdefender GravityZone multi-vector threat detection with DCR-based ingestion and XDR correlation.

ASIM AlertEvent Support Added for Bitdefender GravityZone Security Platform

Thu, 28 May 2026 05:16:16 +0000

New parsers enable normalization of Bitdefender GravityZone alert data into Microsoft Sentinel ASIM schema for unified threat detection.

BitSight: Function App to CCF Migration Restores Third-Party Risk Visibility

Wed, 27 May 2026 19:04:26 +0000

Legacy Function App connector replaced with two CCF connectors for independent security statistics and events ingestion.

GitHub Actions Security: npm Scripts Disabled and Workflow Permissions Tightened

Wed, 27 May 2026 06:10:29 +0000

CI hardening prevents npm lifecycle script execution and restricts slash-command dispatch to authorized repository members only.

ASIM AssetEntity Schema: Three New Fields Added in v1.0.0 Release

Tue, 26 May 2026 08:18:37 +0000

ASIM AssetEntity schema upgraded to v1.0.0 with three new fields for enhanced entity correlation and snapshot tracking.

AWS Content Quality Overhaul: Standardized Detection Rules and Improved Entity Mappings

Mon, 18 May 2026 07:30:57 +0000

Comprehensive quality improvements to 61 AWS Analytic Rules and 35 Hunting Queries with standardized naming conventions, normalized MITRE technique mappings, and updated entity field references from legacy AccountCustomEntity to UserIdentityUserName.

Microsoft Entra ID Table Rename: Hunting Queries Updated for Current Schema

Mon, 18 May 2026 05:36:36 +0000

12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references.

Red Sift Solution: New CCF Data Connector and Email Security Detections

Thu, 14 May 2026 10:01:32 +0000

Red Sift adds CCF-based email and authentication monitoring with 5 detection rules for phishing and account compromise scenarios.

Microsoft Entra ID Protection: Enhanced Detection Logic Filters Out Admin Risk Events

Tue, 12 May 2026 08:58:14 +0000

Updated CorrelateIPC_Unfamiliar-Atypical rule adds filtering to exclude admin-triggered atypical travel alerts, improving detection precision.

GitHub Actions Security: Fork PR Workflow Hardened Against Supply Chain Attacks

Wed, 06 May 2026 13:23:44 +0000

CI/CD security enhancement prevents automatic execution of untrusted fork code by implementing strict SafeToRun label gating.

Salesforce Service Cloud Connector: Enhanced Event Log Coverage and Multi-Domain Support

Mon, 04 May 2026 19:12:27 +0000

Major connector upgrade introduces comprehensive event field collection and multi-tenant monitoring capabilities.

GitHub Webhook V2 Connector: CLv2 Migration Ensures Continued GitHub Advanced Security Ingestion

Mon, 27 Apr 2026 15:15:18 +0000

New CLv2-based GitHub Webhook connector replaces deprecated CLv1 API to maintain ingestion of code scanning, Dependabot, and secret scanning alerts.

Vaikora Solution: New AI Agent Governance Connector for Microsoft Sentinel

Mon, 27 Apr 2026 06:25:41 +0000

New CCF connector ingests Vaikora AI agent behavioral signals with 3 detection rules for policy violations, anomalies, and high-risk actions.

ASIM Agent Event Schema: New Normalization Framework for Security Agent Monitoring

Fri, 24 Apr 2026 22:19:31 +0000

Microsoft Sentinel gains ASIM Agent Event schema for normalizing security agent events across all vendor platforms.

Valimail Enforce Solution: New Email Authentication Monitoring for DMARC/SPF/DKIM Configuration Changes

Fri, 24 Apr 2026 05:26:39 +0000

Complete Valimail Enforce monitoring solution delivers real-time detection of email authentication policy weakening and suspicious admin activity affecting domain security posture.

Halcyon Anti-Ransomware: Connector Overhaul from ASIM to OCSF Schema Architecture

Thu, 23 Apr 2026 06:33:39 +0000

Halcyon connector migrated from direct ASIM ingestion to OCSF schema with ASIM transformation parsers, replacing 5 custom tables with unified HalcyonEvents_CL table.

SOCRadar XTI Platform: New Extended Threat Intelligence Solution Launches with Bidirectional Sync

Thu, 23 Apr 2026 05:24:37 +0000

SOCRadar XTI Platform solution now available in Content Hub with automated alarm import, incident sync, and comprehensive threat intelligence monitoring capabilities.

SAP ETD Cloud: User Account Correlation Now Available After Data Collection Gap

Tue, 21 Apr 2026 07:43:46 +0000

SAP ETD alerts now surface user account names and email addresses for incident correlation, filling a critical entity mapping gap that prevented effective identity-based investigations.

D3 Smart SOAR: New Detection for High/Critical Severity Incidents

Thu, 16 Apr 2026 04:54:16 +0000

D3 Smart SOAR solution now includes an Analytic Rule to automatically detect and escalate High or Critical severity incidents from SOAR platform data.

Contrast ADR: CCF Connector Deployment Unlocks Application Attack Visibility

Wed, 15 Apr 2026 04:58:02 +0000

Contrast ADR adds CCF ingestion support with standardized table schemas for production-ready Application Detection and Response monitoring.

Tanium CCF Data Connector: Enhanced Endpoint Visibility with DCR-Based Ingestion

Mon, 13 Apr 2026 12:24:43 +0000

New CCF push connector for Tanium enables endpoint compliance, threat response, and patch data ingestion via DCR streams.

Palo Alto GlobalProtect: New ASIM Authentication Parser for VPN Monitoring

Thu, 09 Apr 2026 16:00:52 +0000

New ASIM parser normalizes GlobalProtect VPN authentication events from CommonSecurityLog table, enabling unified monitoring of gateway and portal authentication across Palo Alto PAN-OS deployments.