Solutions on sentinelchangelog.net

Okta SSO Detection Suite: Richer Alert Context, Configurable Thresholds, and Corrected Entity Mappings Across 9 Rules and 10 Hunting Queries

Fri, 10 Jul 2026 09:21:28 +0000

Nine Analytic Rules and ten Hunting Queries for Okta SSO have been overhauled with configurable thresholds, allowlist variables, improved JSON parsing, and corrected entity mappings, closing fidelity gaps that degraded Sentinel entity behaviour and alert context.

New Check Point Harmony Email and Collaboration Connector: Four-Stream Email Threat Visibility via CCF

Fri, 10 Jul 2026 06:24:39 +0000

A new Microsoft Sentinel CCF connector ingests Check Point Email Security (Harmony Email and Collaboration) data across four streams covering security events, anti-phishing exceptions, spam exceptions, and audit logs, unlocking visibility into zero-day, phishing, account takeover, DLP, and shadow IT threats via email.

New Netskope Alerts and Events Solution: DLP, Shadow IT, and Malware Threat Visibility via CCF Blob Storage Connector

Fri, 10 Jul 2026 06:05:09 +0000

A new Microsoft Sentinel solution delivers full-stack Netskope Security Cloud visibility including DLP incidents, malware detections, policy enforcement, and Shadow IT via a CCF Blob Storage connector ingesting gzip-compressed positional CSV into a 254-column custom table.

New Atlassian Organization Audit CCF Connector: Cloud Org-Level Audit Events Now Ingestible in Sentinel

Fri, 10 Jul 2026 00:13:02 +0000

A brand-new CCF connector brings Atlassian Cloud organization audit events (user management, authentication, group changes, policy updates) across Jira, Confluence, Bitbucket, Trello, Opsgenie, Statuspage, and Loom into the AtlassianAuditEvents_CL table in Microsoft Sentinel.

SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)

Thu, 09 Jul 2026 22:44:23 +0000

The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.

Infoblox SOC Insights: New CCF Connector Replaces Deprecated Legacy Integration

Thu, 09 Jul 2026 22:19:38 +0000

Infoblox SOC Insights gains a native CCF-based data connector via REST API polling, restoring structured ingestion of BloxOne Threat Defense insights into the InfobloxInsight_CL table after prior connectors were deprecated.

Agent 365: Microsoft Agent Identities Connector Page KQL Parse Error Patched by Removing Data Type Declarations

Thu, 09 Jul 2026 04:22:44 +0000

The EntraNHIAssets connector definition drops all four data type entries to eliminate an empty-subquery KQL parse error on the connector page — though reviewers flag this may break connector metadata contracts.

Cisco Meraki CCF Connector Expands to Cover Rogue AP Detection and Network Inventory

Wed, 08 Jul 2026 21:22:13 +0000

The Cisco Meraki CCF connector (v3.1.0) adds four new ingestion streams - Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events - extending coverage beyond the original ASIM event types to include wireless threat detection and full network inventory visibility.

Panorays Connector: DCR Parameter Chain and Offer ID Fixes Restore Deployability

Wed, 08 Jul 2026 11:09:41 +0000

The Panorays solution had a broken dcrConfig parameter reference chain and invalid offerId that would cause ARM template deployment failures, meaning no vulnerability management data was ingested by affected deployments.

New Gambit Security Solution: Cloud Security Posture Issues Now Ingestible via CCF Push Connector

Wed, 08 Jul 2026 08:45:13 +0000

Gambit Security new Microsoft Sentinel solution adds a CCF Push connector that ingests cloud security posture policy issues into a custom table, with a bundled parser and analytic rule for incident creation on High-severity active findings.

SIGNL4 Connector Docs Refreshed to Flag Legacy Status and Point to Current Integration Path

Wed, 08 Jul 2026 05:07:16 +0000

The SIGNL4 data connector UI instructions have been rewritten to label the connector as legacy and redirect operators to the native SIGNL4 Microsoft Sentinel connector app, dropping outdated Azure Graph Security API setup steps.

Imperva Cloud WAF CCF Connector Graduates to General Availability

Tue, 07 Jul 2026 21:34:27 +0000

The Imperva Cloud WAF CCF connector moves from Public Preview to GA, with connector UI template variables replaced by the literal ImpervaWAFCloud table name - no ingestion logic changes.

eDCRule Solution: Partner Center Metadata and Logo Corrected for Content Hub Publishing

Tue, 07 Jul 2026 13:50:12 +0000

Fixes publisherId alignment and swaps the logo reference from the Microsoft Sentinel default to the eDC company logo to pass Partner Center validation – no detection content was changed.

Azure WAF Log4j Detection Restored: Field Reference Errors Silenced the Rule Since v1.0.5

Tue, 07 Jul 2026 13:22:48 +0000

A broken column_ifexists reference caused the Azure WAF Log4j detection rule to silently miss exploit traffic in details_message and details_msg fields – any deployment running v1.0.5 had a gap in Log4Shell (CVE-2021-44228) coverage via WAF logs.

WithSecure Elements CCF Connector: Zero-Ingestion Fix for Broken OAuth2 Auth and Invalid Query Parameters

Tue, 07 Jul 2026 12:06:39 +0000

The WithSecureElementsCCF connector has been non-functional since initial release – both the OAuth2 token request and the security-events API call failed with HTTP 400 errors, meaning no WithSecure endpoint security events have been ingested into any Sentinel deployment running this connector.

Azure WAF Log4j Detection: Schema Gap Closed for details_message_s and details_msg_s Fields

Tue, 07 Jul 2026 11:52:51 +0000

The AzureWAFmatching_log4j_vuln Analytic Rule was silently missing CVE-2021-44228 exploit attempts in WAF logs that surfaced details_message_s via AdditionalFields or used the details_msg_s column variant, leaving a schema-dependent blind spot in Log4Shell detection.

Microsoft Entra ID Assets: EntraEligibleMembers Table Pulled Before GA

Mon, 06 Jul 2026 11:07:01 +0000

The EntraEligibleMembers (Preview) table added in v3.3.0 has been removed in this hotfix, eliminating that data source from the connector definition until a stable release.

Three Solutions Packaging Fix: Mulesoft, Trend Micro, and ESET UI Metadata Corrected

Mon, 06 Jul 2026 10:59:56 +0000

Duplicated connector count blocks in solution UI descriptions and a connector count mismatch are corrected across three solutions, with no detection logic or data ingestion changes.

Orca Security Alerts: New CCF Push Connector Replaces Deprecated Shared Key Auth with Microsoft Entra ID

Fri, 03 Jul 2026 12:30:33 +0000

A new CCF Push connector for Orca Security Alerts replaces the legacy Log Analytics Shared Key ingestion path with Microsoft Entra ID app authentication via the Logs Ingestion API, eliminating the deprecated shared-key attack surface while retaining backward compatibility.

ESET PROTECT Platform Connector: Dependency Rollback Including Cryptography Downgrade Warrants Review

Fri, 03 Jul 2026 11:07:29 +0000

The ESET PROTECT Platform Function App connector rolls back several Python dependencies to lower versions, including cryptography from 48.0.0 to 43.0.1, without documented CVE justification – operators should verify no security regressions are introduced.

Recorded Future: Defender Portal Migration Breaks Incident Creation -- Playbooks Redesigned Around Analytic Rules

Fri, 03 Jul 2026 09:26:40 +0000

Recorded Future v3.2.20 removes direct incident creation from four playbooks (now incompatible with the unified Microsoft Defender portal) and introduces new Analytic Rules to restore incident generation from custom log tables.

Wiz Connector Overhaul: Agentless DCR Push Integration Adds Detections Stream, Eliminates Function App Attack Surface

Fri, 03 Jul 2026 09:26:17 +0000

Wiz v3.0.1 replaces the legacy Azure Function pull connector with a native DCR push integration, adding a new WizDetectionsV3_CL data stream and removing the need for customer-hosted infrastructure or shared workspace keys.

BlueVoyant Claude Compliance Connector: DCR Schema Expanded with Activity Fields, Sensitive request_body Removed

Fri, 03 Jul 2026 07:29:21 +0000

The BlueVoyant Anthropic Claude Compliance CCF connector v1.0.1 expands the DCR schema with dozens of activity-specific fields required for hunting and detection, and removes the request_body column to prevent ingestion of potentially sensitive data.

Entra ID Brute-Force Detection: Sort Order Fix Corrects Anomaly Decomposition Input

Fri, 03 Jul 2026 06:43:54 +0000

The BruteForceAgainstanEntraAuthenticatedWindowsDevice Analytic Rule was building unsorted time-series arrays for series_decompose_anomalies, meaning anomaly detection results could be incorrect or inconsistent across executions – this fix enforces chronological ordering and stable serialization before make_list.

ESET PROTECT Platform: New CCF Connector Adds Native Ingestion for Endpoint Inspect and Cloud Office Security Detections

Thu, 02 Jul 2026 19:58:40 +0000

A new Codeless Connector Framework connector and updated parser extend ESET PROTECT Platform coverage to three log streams while maintaining backward compatibility with the legacy Function App connector.

MuleSoft Anypoint Connector: Data Connector Count Display Fix in Content Hub UI

Thu, 02 Jul 2026 19:57:57 +0000

A packaging-only update to the MuleSoft Solution corrects a connector count mismatch visible in the Content Hub UI.

GitHub AzStorage Connector: Expanded api.request Fields Land in New GitHubAuditLogsV3_CL Table

Thu, 02 Jul 2026 11:15:42 +0000

The GitHub Azure Storage CCF connector gains a new V3 table with 10 additional api.request fields including token_scopes, request_method, request_body, status_code, and url_path, improving visibility into API-level attacker activity in GitHub audit logs.

SOCRadar Solution v3.0.1: Packaging Version Alignment

Thu, 02 Jul 2026 09:22:50 +0000

Version bump from 3.0.0 to 3.0.1 to align the published Content Hub package with the catalog; no detection logic, playbook, or connector changes.

Google SecOps Solution: Publisher and Offer Identity Update

Thu, 02 Jul 2026 08:25:17 +0000

The Google SecOps Solution package has been re-registered under new marketplace publisher and offer identifiers — no detection logic or connector configuration was changed.

Cisco Umbrella CCF Connector GA Promotion Fixes Template Variable Rendering in UI Queries

Wed, 01 Jul 2026 19:55:19 +0000

The Cisco Umbrella CCF connector graduates to GA while also resolving broken template variable references that caused Content Hub connectivity checks and sample queries to malfunction.

Rapid7 InsightVM CCF Connector Promoted to General Availability

Wed, 01 Jul 2026 19:47:03 +0000

The Rapid7 InsightVM CCF data connector moves out of Public Preview to GA, updating the API version to the stable 2025-09-01 release.

Abnormal Security Solution: Full Detection Coverage Added for CCF Push Connector (v3.1.0)

Wed, 01 Jul 2026 07:53:17 +0000

The Abnormal Security solution now ships four scheduled Analytic Rules, four Hunting Queries, four parsers, a workbook, and a Playbook â closing a complete detection gap that existed since the CCF Push connector was introduced in v3.0.0 with no bundled detections.

New Akamai DDoS Protection CCF Connector: WAF Security Events Now Available in Microsoft Sentinel

Wed, 01 Jul 2026 07:05:34 +0000

A new CCF-based connector ingests Akamai WAF SIEM security events into the AkamaiSIEMEvent table, unlocking web application attack visibility including denied requests, client reputation, rule triggers, and geolocation context for attacker IPs.

WithSecure Elements Connector Migrated to CCF: Function App Infrastructure Eliminated

Wed, 01 Jul 2026 06:14:18 +0000

A new CCF-based WithSecure Elements solution (v4.0.0) replaces the Azure Function connector, removing the Azure Function, Storage Account, and Key Vault dependency stack while the legacy Function App solution is deprecated in place with a transition buffer for existing deployments.

Lookout Connector v3.0.6: Silent Ingestion Stop After 24h and Four DCR Field Mapping Blind Spots Fixed

Wed, 01 Jul 2026 06:13:06 +0000

A CCF cursor expiry caused the Lookout streaming connector to silently stop ingesting data after roughly 24 hours, and four incorrect DCR field paths meant ThreatId, ThreatAction, DeviceEmail, and SmishingAlertId were null in every ingested record.

Agent 365 Solution v3.1.2: Microsoft Agent Identities Connector Version Refresh

Wed, 01 Jul 2026 06:03:43 +0000

Bumps the Microsoft Agent Identities (EntraNHIAssets) data connector to version 1.0.1 so Content Hub correctly detects and applies the latest connector configuration on solution update.

Trend Micro Cloud App Security: Offer ID Alignment for Marketplace Publishing

Tue, 30 Jun 2026 11:33:10 +0000

Solution metadata offer ID updated to match the Azure Marketplace listing — no detection logic or connector changes.

Darktrace CCF Connector: Setup Guide Link Updated to Customer Portal

Tue, 30 Jun 2026 09:08:17 +0000

Version 3.1.1 fixes a broken documentation link in the connector UI, replacing the prior URL with the Darktrace customer portal guides page (https://customerportal.darktrace.com/guides) after a manual validation failure.

Semperis Lightning Connector: TLS Certificate Verification Restored Across All API Calls

Tue, 30 Jun 2026 07:59:33 +0000

The Semperis Lightning data connector was making all outbound API requests with TLS verification disabled (verify=False), exposing token acquisition and all data collection calls to man-in-the-middle attacks; this fix re-enables certificate validation across seven affected modules.

Google Workspace Reports: Google Meet Activity Logs Restored After Polling Window Gap

Tue, 30 Jun 2026 06:22:41 +0000

A missing queryWindowDelayInMin setting caused Google Meet audit events to be silently dropped by the CCF connector - adding a 30-minute delay restores ingestion of events that arrive late from Google API.

Fortinet FortiNDR Cloud Connector: Migration from Deprecated HTTP Data Collector API to Log Ingestion API with Managed Identity

Mon, 29 Jun 2026 13:21:35 +0000

The Fortinet FortiNDR Cloud Function App connector has been migrated from the deprecated HTTP Data Collector API (using client secret credentials) to the Log Ingestion API using Managed Identity - deployments running the previous version were heading toward a complete ingestion failure as the old API reaches end-of-life.

Cofense Intelligence Connector: SSRF and Credential Leakage Vulnerabilities Patched in DownloadThreatReports Function

Mon, 29 Jun 2026 09:13:54 +0000

Critical security hardening of the Cofense Intelligence Azure Function eliminates a Server-Side Request Forgery (SSRF) vector and credential leakage risk that allowed callers to redirect authenticated requests to arbitrary or internal hosts.

Microsoft Entra ID Assets Connector: EntraEligibleMembers Table Added (Preview)

Mon, 29 Jun 2026 08:58:57 +0000

The Microsoft Entra ID Assets connector gains a new EntraEligibleMembers table checkbox in the portal, expanding Privileged Identity Management (PIM) visibility for eligible role assignment tracking.

Hybrid Attack Solution: Packaging Fix for Missing Workbook Content ID and Version

Mon, 29 Jun 2026 07:16:25 +0000

Corrects missing content ID and version fields in the Hybrid Attack — Cloud & Identity solution packaging template to resolve a validation failure preventing Content Hub deployment.

New Solution: Hybrid Attack Chain Hunting Across On-Premises, Cloud, and Kubernetes

Mon, 29 Jun 2026 04:21:48 +0000

A new Microsoft Sentinel Solution ships 55+ multi-stage hunting queries designed to detect attacker pivots across on-premises identity, Azure control plane, Kubernetes, and Microsoft Entra ID – covering full kill chains that individual, single-source detections routinely miss.

Holm Security VMP: New CCF Connector Ingests Network and Web Asset Inventory into Sentinel

Fri, 26 Jun 2026 05:11:21 +0000

A new CCF-based Data Connector for the Holm Security Vulnerability Management Platform adds direct ingestion of network and web asset inventory – including IP, hostname, OS, severity, and vulnerability counts – into two custom Log Analytics tables, enabling asset-aware threat hunting and vulnerability correlation in Microsoft Sentinel.

Cybersixgill Actionable Alerts: Packaging Fix for Channel and Step ID Variables (P0)

Thu, 25 Jun 2026 12:15:40 +0000

P0-labeled packaging-only update to the Cybersixgill Actionable Alerts solution that extracts hardcoded channel and step IDs into template variables in mainTemplate.json – no YAML content or detection logic changes.

New Solution: Vaikora for O365 Brings CTASD-Powered Phishing Quarantine Telemetry into Microsoft Sentinel

Thu, 25 Jun 2026 11:56:08 +0000

A brand-new Sentinel solution for Vaikora for O365 (by Data443) adds three Analytic Rules over the VaikoraO365_Quarantine_CL custom table – covering high-confidence phishing/suspected quarantine events, abnormal quarantine volume spikes, and engine-offline detection – plus an incident-response Playbook and a quarantine dashboard Workbook.

Darktrace CCF Connector: Account Entity Mapping Added to Analytic Rules, Closing SaaS Identity Correlation Gap

Thu, 25 Jun 2026 11:35:07 +0000

Two Darktrace Analytic Rules now map user account names as Account entities for SaaS/identity-based incidents, and the DarktraceIncidents_CL table gains a modelBreaches field exposing the full chain of associated model alerts – data that was previously absent from incident context.

Cybersixgill Actionable Alerts: CCF Connector Added with Unified Parser Bridging Legacy and New Tables

Thu, 25 Jun 2026 11:34:30 +0000

The Cybersixgill Actionable Alerts solution adds a new CCF-based data connector alongside a unified parser that abstracts both the legacy Azure Function table (CyberSixgill_Alerts_CL) and the new CCF table (CyberSixgillAlertsV2_CL), ensuring hunting queries and workbooks continue working regardless of which connector is deployed.