Zero Networks: Enhanced Audit Parser and CCF Connectors Expand Microsegmentation Visibility
Zero Networks parser update adds 182 new audit types plus dual CCF connectors for comprehensive microsegmentation telemetry. Read More →
Parsers
ASIM Authentication: New Okta OktaSystemLogs Parser Enables Normalized Identity Event Analysis
New ASIM parser normalizes Okta authentication events from OktaSystemLogs table to standard Authentication schema. Read More →
FortiGate ASIM Authentication Parser: New Visibility for Fortinet Administrative Access Events
New ASIM parser adds normalised authentication monitoring for FortiGate administrator login and logout events. Read More →
Azure Key Vault ASIM Parser: New Audit Event Normalization for Critical Key Management Monitoring
Azure Key Vault audit events can now be analyzed using ASIM schema, enabling standardized detection across vault, secret, key, and certificate operations. Read More →
ASIM Asset Entity Schema: New Schema Foundation for Asset Management
Introduces complete ASIM Asset Entity schema with parsers, empty templates, and CI integration to enable asset-centric security monitoring. Read More →
TheHive Incident Response: New CCF Connector for SOAR Platform Integration
Microsoft Sentinel gains native ingestion from TheHive security incident response platform via CCF connector, enabling case management visibility and response workflow correlation. Read More →
CTM360 HackerView: Connector Ingestion Restored After Complete Deployment Failure
CTM360 HackerView Function App connector was completely broken due to backup flag logic errors, preventing all threat intelligence ingestion until this fix. Read More →
Rapid7 InsightVM: New CCF Connector Expands Vulnerability Management Data Ingestion Options
Rapid7InsightVM solution adds CCF-based data connector for cloud-native ingestion alongside legacy Function App connector, enhancing deployment flexibility for vulnerability management visibility. Read More →
New Trellix Endpoint Security: CCF Connector Unlocks ePO Threat Visibility in Sentinel
New solution delivers Trellix ePO endpoint security events via CCF with OAuth2 authentication and comprehensive threat intelligence data. Read More →
ASIM Registry Event: Added Mandatory Fields for Microsoft 365 Defender Parser Compliance
Updated ASIM Registry Event parser for Microsoft 365 Defender to include mandatory EventSchema and EventResult fields per schema compliance requirements. Read More →
ASIM FileEvent Parser: New AWS CloudTrail S3 Support Added
New FileEvent parser enables normalized S3 object activity monitoring from AWS CloudTrail logs across bucket operations and object lifecycle events. Read More →
ASIM User Management: AWS CloudTrail Parser Enables IAM and Cognito Visibility
New ASIM parser normalizes AWS CloudTrail user management events from IAM and Cognito services into Microsoft Sentinel. Read More →
ASIM AlertEvent: Microsoft Defender XDR Parser Enhanced with Improved Field Mappings
Microsoft Defender XDR AlertEvent parsers updated with optimized KQL logic, corrected field mappings, and enhanced IP address collection. Read More →
ASIM Sudo Authentication Parser: Schema Version 0.1.4 Compliance and Field Mapping Enhancements
ASIM sudo parser updated to schema 0.1.4 with improved field mappings, severity normalization, and code deduplication. Read More →
ASIM SSH Authentication Parser: Improved Invalid User Event Parsing
OpenSSH authentication parser now correctly extracts source IP addresses from “Invalid user” events regardless of port format. Read More →
ASIM Authentication Parser: Linux Su Command Enhanced with Failed Authentication Support
Linux su parser significantly enhanced to capture failed su attempts, correct event classification from Elevation to Logon, and improve field mappings for comprehensive privilege escalation monitoring. Read More →
ASIM Authentication Parser: Palo Alto Cortex Data Lake Performance and Schema Fixes
Palo Alto Cortex Data Lake authentication parser enhanced with schema compliance improvements, performance optimizations, and corrected field mappings for better data fidelity. Read More →
ASIM Authentication Parser: Microsoft 365 Defender Schema Compliance Enhancement
Microsoft 365 Defender authentication parser improved ASIM compliance by removing unnormalized columns and relocating process/hash metadata to AdditionalFields structure. Read More →
ASIM Authentication Parser: Enhanced SSH Authentication Method Detection
SSH authentication parser now accurately identifies logon methods (password, PKI, PAM) and adds improved field mappings for better authentication visibility. Read More →
ASIM NetworkSession Parser: Critical IP Address Mapping Fix for Azure NSG Flow Data
Azure NTANetAnalytics parser now correctly maps source and destination IP addresses from PublicIPs fields when primary IP fields are empty, closing a data fidelity blind spot. Read More →