Threat Intelligence on sentinelchangelog.nethttp://sentinelchangelog.net/tags/threat-intelligence/Recent content in Threat Intelligence on sentinelchangelog.netHugo -- 0.157.0enFri, 03 Jul 2026 09:26:40 +0000Recorded Future: Defender Portal Migration Breaks Incident Creation -- Playbooks Redesigned Around Analytic Ruleshttp://sentinelchangelog.net/posts/2026-07-03-pr-14199/Fri, 03 Jul 2026 09:26:40 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14199/Recorded Future v3.2.20 removes direct incident creation from four playbooks (now incompatible with the unified Microsoft Defender portal) and introduces new Analytic Rules to restore incident generation from custom log tables.Cofense Intelligence Connector: SSRF and Credential Leakage Vulnerabilities Patched in DownloadThreatReports Functionhttp://sentinelchangelog.net/posts/2026-06-29-pr-14542/Mon, 29 Jun 2026 09:13:54 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14542/Critical security hardening of the Cofense Intelligence Azure Function eliminates a Server-Side Request Forgery (SSRF) vector and credential leakage risk that allowed callers to redirect authenticated requests to arbitrary or internal hosts.New Workbook: Hybrid Attack Kill-Chain Hunting Across Cloud and On-Prem Identityhttp://sentinelchangelog.net/posts/2026-06-29-pr-14575/Mon, 29 Jun 2026 06:09:41 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14575/A new behavior-led hunting workbook registers in Microsoft Sentinel covering end-to-end hybrid identity attack scenarios across 7 MITRE ATT&CK phases, correlating signals from Entra ID, Azure, on-prem AD, and Defender XDR.TacitRed Defender TI Playbook: Fixing Content Hub Deployment Failure on Hyphenated Workspace Nameshttp://sentinelchangelog.net/posts/2026-06-24-pr-13639/Wed, 24 Jun 2026 09:19:23 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-13639/TacitRed Defender Threat Intelligence v3.0.2 fixes an InvalidTemplate ARM error that blocked Content Hub deployment entirely on any workspace with a hyphenated name, plus resolves a sovereign cloud storage endpoint bug and adds required post-deployment RBAC guidance.Threat Intelligence (NEW): Broken Connector Mappings and Case-Sensitive Rule Names Fixed Across 36 Analytic Ruleshttp://sentinelchangelog.net/posts/2026-06-23-pr-14300/Tue, 23 Jun 2026 12:08:41 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14300/Two customer-reported issues are resolved: EmailEvents and EmailUrlInfo rules were mapped to the wrong connectors (Office365 instead of MicrosoftThreatProtection), and inconsistent capitalisation in rule names was silently breaking customer Playbook automations.ZeroFox Threat Intelligence Solution: Metadata Fix to Unblock Content Hub Publishinghttp://sentinelchangelog.net/posts/2026-06-22-pr-14523/Mon, 22 Jun 2026 07:49:45 +0000http://sentinelchangelog.net/posts/2026-06-22-pr-14523/Corrects an invalid solution ID in SolutionMetadata.json that was preventing the ZeroFox Threat Intelligence solution from publishing to Content Hub.JoeSandbox Solution: Sample Queries Updated to Use ThreatIntelIndicators Tablehttp://sentinelchangelog.net/posts/2026-06-22-pr-14451/Mon, 22 Jun 2026 06:09:20 +0000http://sentinelchangelog.net/posts/2026-06-22-pr-14451/JoeSandbox solution v3.0.2 updates sample queries from the legacy ThreatIntelligenceIndicator table to ThreatIntelIndicators — workspaces still on the legacy table may see broken sample queries post-upgrade.Google Threat Intelligence: New GTI Relevance System Alerts Connector and Six Bundled Detectionshttp://sentinelchangelog.net/posts/2026-06-19-pr-14415/Fri, 19 Jun 2026 11:27:14 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14415/A new Function App-based data connector ingests Google Threat Intelligence Relevance System Alerts into Sentinel, unlocking six new Analytic Rules that fire on high-severity, data-leak, initial access broker, and insider threat alert categories surfaced by the GTI platform.Vaikora-SentinelOne Playbook: Broken IOC Push Restored After HTTP 422 API Rejectionhttp://sentinelchangelog.net/posts/2026-06-18-pr-14364/Thu, 18 Jun 2026 12:25:17 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14364/The v3.0.0 playbook always appended an empty agent_id= parameter, causing the Vaikora API to reject every poll request with HTTP 422, silently halting all IOC delivery to SentinelOne Threat Intelligence since initial deployment.Vaikora-CrowdStrike Playbook: Silent IOC Pipeline Failure Fixed for Monitor All Agents Modehttp://sentinelchangelog.net/posts/2026-06-18-pr-14365/Thu, 18 Jun 2026 09:50:02 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14365/When VaikoraAgentId was left blank to monitor all agents, every HTTP 422 rejection from the Vaikora API silently dropped all IOCs - no high/critical-risk actions ever reached CrowdStrike Falcon.ZeroFox Threat Intelligence: Marketplace Packaging Fix Restores Customer Accesshttp://sentinelchangelog.net/posts/2026-06-15-pr-14461/Mon, 15 Jun 2026 12:23:07 +0000http://sentinelchangelog.net/posts/2026-06-15-pr-14461/Critical solution ID mismatch prevented customers from installing ZeroFox Threat Intelligence connector from marketplace.Premium MDTI Connector Removed from Threat Intelligence Solution During MDTI Convergencehttp://sentinelchangelog.net/posts/2026-06-15-pr-14343/Mon, 15 Jun 2026 09:58:43 +0000http://sentinelchangelog.net/posts/2026-06-15-pr-14343/Premium Microsoft Defender Threat Intelligence connector no longer available in Threat Intelligence (NEW) solution v3.0.19 as part of MDTI convergence effort.Cyren Threat Intelligence: Data Fidelity Fix Corrects IP Field Pollution by URL UUIDshttp://sentinelchangelog.net/posts/2026-06-09-pr-14376/Tue, 09 Jun 2026 08:01:41 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14376/DCR transform fix stops storing malware URL UUIDs in IP fields — improves data quality for threat intelligence queries.NordStellar CCF Push Connector: Real-time Threat Intelligence Integration Now Availablehttp://sentinelchangelog.net/posts/2026-05-28-pr-14198/Thu, 28 May 2026 12:05:41 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-14198/New NordStellar solution delivers real-time threat intelligence and exposure monitoring via CCF Push architecture to unified NordStellar_CL table.Google Threat Intelligence Solution: Custom Connector Deployment Prerequisites Clarifiedhttp://sentinelchangelog.net/posts/2026-05-27-pr-14267/Wed, 27 May 2026 06:35:46 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14267/Solution metadata updated to warn customers that Playbooks require manual deployment of the GTI custom Logic Apps connector before use.Cyren Defender Threat Intelligence: New IP and Malware URL Ingestion for Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-05-25-pr-14121/Mon, 25 May 2026 05:24:48 +0000http://sentinelchangelog.net/posts/2026-05-25-pr-14121/Content Hub solution adds Cyren threat intelligence feeds for IP reputation and malware URL indicators via automated Logic App playbook.New Cyren-CrowdStrike Threat Intelligence Solution: Automated IOC Sync for Enhanced Threat Detectionhttp://sentinelchangelog.net/posts/2026-05-20-pr-13658/Wed, 20 May 2026 09:16:04 +0000http://sentinelchangelog.net/posts/2026-05-20-pr-13658/Logic App playbook now available to automatically sync Cyren IP reputation and malware URL indicators to CrowdStrike Falcon for streamlined threat blocking.Illumio Insights Graph: New Network Traffic Analysis and Threat Intelligence Connectorhttp://sentinelchangelog.net/posts/2026-05-19-pr-14035/Tue, 19 May 2026 08:58:22 +0000http://sentinelchangelog.net/posts/2026-05-19-pr-14035/New CCF-based connector ingests Illumio AI-powered threat discovery reports with network flow analysis, geographic context, and MITRE ATT&CK framework integration.New Strider Shield Threat Intelligence Connector for Email Security Monitoringhttp://sentinelchangelog.net/posts/2026-05-15-pr-14155/Fri, 15 May 2026 11:25:39 +0000http://sentinelchangelog.net/posts/2026-05-15-pr-14155/NVISO introduces Strider Shield CCF connector enabling ingestion of email threat intelligence data across five data streams targeting phishing and BEC protection.Flare Solution 3.1.0: Enhanced Threat Intelligence Detection Coveragehttp://sentinelchangelog.net/posts/2026-05-12-pr-14126/Tue, 12 May 2026 09:22:23 +0000http://sentinelchangelog.net/posts/2026-05-12-pr-14126/Flare Solution updates detection logic and adds three new Analytic Rules for improved threat exposure monitoring across chat platforms, lookalike domains, and underground marketplaces.Cyjax Connector: Security and Code Quality Fixes Appliedhttp://sentinelchangelog.net/posts/2026-05-07-pr-14193/Thu, 07 May 2026 07:12:52 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14193/Addressed lint issues, package vulnerabilities, and code vulnerabilities in Cyjax threat intelligence connector.Visa Threat Intelligence: Connector Description Update for Certificationhttp://sentinelchangelog.net/posts/2026-05-05-pr-14206/Tue, 05 May 2026 16:50:36 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14206/Updated Data Connector description in Visa Threat Intelligence solution to resolve certification failure.ZeroFox Digital Risk Protection: Complete CCF Migration with Dual Solution Architecturehttp://sentinelchangelog.net/posts/2026-05-05-pr-14055/Tue, 05 May 2026 08:06:45 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14055/ZeroFox splits legacy connector into dedicated Alerts and Threat Intelligence solutions using modern CCF architecture with 17 specialized data streams.MISP2Sentinel: Critical Table Reference Fix for Upload Indicators APIhttp://sentinelchangelog.net/posts/2026-05-05-pr-14091/Tue, 05 May 2026 07:18:11 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14091/MISP threat intelligence connector was broken due to incorrect table reference — deployments had zero indicator ingestion until this fix.Microsoft Threat Intelligence TAXII Export Connector Moves to General Availabilityhttp://sentinelchangelog.net/posts/2026-05-05-pr-14189/Tue, 05 May 2026 06:00:19 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14189/Microsoft’s TAXII Export connector for Threat Intelligence objects is now GA, removing preview limitations for production TI sharing workflows.Joe Sandbox Solution: ARM Template Fixes and IOC Handling Improvementshttp://sentinelchangelog.net/posts/2026-05-04-pr-14130/Mon, 04 May 2026 12:39:49 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14130/Joe Sandbox solution updated to v3.0.1 with Azure template fixes, updated storage API versions, and improved IOC processing in playbooks.GreyNoise Threat Intelligence: Packaging Fixes and Security Improvementshttp://sentinelchangelog.net/posts/2026-04-30-pr-14032/Thu, 30 Apr 2026 11:13:54 +0000http://sentinelchangelog.net/posts/2026-04-30-pr-14032/Fixed Function App deployment packaging errors and improved security by converting ARM template secrets to secure strings.New Vaikora-CrowdStrike Integration: AI Agent Behavioral Signals to Custom IOCshttp://sentinelchangelog.net/posts/2026-04-30-pr-13984/Thu, 30 Apr 2026 06:47:13 +0000http://sentinelchangelog.net/posts/2026-04-30-pr-13984/Logic App Playbook introduced to poll Vaikora AI agent signals and push high-risk actions as Custom IOCs to CrowdStrike Falcon for automated threat prevention.Visa Threat Intelligence: ARM Template Certification Fixhttp://sentinelchangelog.net/posts/2026-04-29-pr-14167/Wed, 29 Apr 2026 18:50:40 +0000http://sentinelchangelog.net/posts/2026-04-29-pr-14167/Replaces deprecated concat with uri function in ARM template to meet Azure certification requirements.Vaikora AI Security: New Logic App Playbook for SentinelOne Threat Intelligence Integrationhttp://sentinelchangelog.net/posts/2026-04-29-pr-13985/Wed, 29 Apr 2026 12:39:43 +0000http://sentinelchangelog.net/posts/2026-04-29-pr-13985/Data443 introduces Vaikora AI agent behavioral signal integration with SentinelOne threat intelligence via a 6-hour polling playbook.New Spur Context API Solution: High-Fidelity IP Intelligence for VPN and Proxy Detectionhttp://sentinelchangelog.net/posts/2026-04-29-pr-14148/Wed, 29 Apr 2026 10:42:32 +0000http://sentinelchangelog.net/posts/2026-04-29-pr-14148/New solution provides real-time IP enrichment to detect VPN, residential proxy, and bot automation traffic in incidents and alerts.Cyjax Threat Intelligence Platform: Complete Solution for IOC Ingestion and Investigationhttp://sentinelchangelog.net/posts/2026-04-22-pr-13902/Wed, 22 Apr 2026 09:06:53 +0000http://sentinelchangelog.net/posts/2026-04-22-pr-13902/New comprehensive Microsoft Sentinel integration adds automated IOC collection, incident enrichment, and interactive threat intelligence dashboards for the Cyjax platform.Visa Threat Intelligence: Package Publishing Fix for Content Hub Deploymenthttp://sentinelchangelog.net/posts/2026-04-21-pr-14083/Tue, 21 Apr 2026 21:52:07 +0000http://sentinelchangelog.net/posts/2026-04-21-pr-14083/Resolved package publishing failure by adding missing connector information to UI definition file.Recorded Future Sandbox: Enhanced Region Support and Improved Threat Intelligence Structurehttp://sentinelchangelog.net/posts/2026-04-20-pr-14056/Mon, 20 Apr 2026 05:13:10 +0000http://sentinelchangelog.net/posts/2026-04-20-pr-14056/Recorded Future adds sandbox region configuration parameter and moves threat intelligence evidence details to comply with STIX standard structure.Global Secure Access: Threat Intelligence Detection Restored After URL Regex Failurehttp://sentinelchangelog.net/posts/2026-04-16-pr-14052/Thu, 16 Apr 2026 12:15:17 +0000http://sentinelchangelog.net/posts/2026-04-16-pr-14052/Fixed broken URL threat intelligence detection and expanded workbook coverage for new Entra traffic type.Threat Intelligence Domain-to-SecurityAlert Rule: Fixes Recursive Alert Loop with Self-Exclusion Filterhttp://sentinelchangelog.net/posts/2026-04-10-pr-13977/Fri, 10 Apr 2026 13:07:15 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13977/Threat Intelligence domain mapping rule updated to prevent infinite alert loops by excluding its own alerts from the source data.Visa Threat Intelligence Solution: Package Artifacts Regenerated After Template Validation Failurehttp://sentinelchangelog.net/posts/2026-04-08-pr-13982/Wed, 08 Apr 2026 22:58:22 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-13982/Template validation failure fixed through package regeneration for Visa Threat Intelligence solution v3.0.2.SOC Prime CCF: Three New Detection Rules for Platform Security Eventshttp://sentinelchangelog.net/posts/2026-04-08-pr-13636/Wed, 08 Apr 2026 09:50:43 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-13636/SOC Prime solution adds Analytic Rules detecting platform administration events including tenant deletion and successful logins from malicious IPs.Cyren-SentinelOne Connector: Restoring Threat Intelligence Deployment After ARM Template Failurehttp://sentinelchangelog.net/posts/2026-04-07-pr-13990/Tue, 07 Apr 2026 13:22:30 +0000http://sentinelchangelog.net/posts/2026-04-07-pr-13990/Critical deployment fix for Cyren-SentinelOne connector that was failing ARM template validation in Content Hub, preventing threat intelligence data ingestion.Visa Threat Intelligence Solution: Packaging Metadata Correctedhttp://sentinelchangelog.net/posts/2026-04-03-pr-13881/Fri, 03 Apr 2026 03:06:18 +0000http://sentinelchangelog.net/posts/2026-04-03-pr-13881/Fixed missing connector information in deployment template and updated solution tier to Partner status.Recorded Future: IOC Enrichment Noise Reduction via Risk Score Thresholdinghttp://sentinelchangelog.net/posts/2026-04-02-pr-13545/Thu, 02 Apr 2026 06:26:29 +0000http://sentinelchangelog.net/posts/2026-04-02-pr-13545/Added configurable RiskScoreThreshold parameter to prevent low-risk IOCs from generating incident comments.Cyren-SentinelOne Playbook: Credential Parameter Security Compliance Fixhttp://sentinelchangelog.net/posts/2026-03-30-pr-13945/Mon, 30 Mar 2026 14:09:23 +0000http://sentinelchangelog.net/posts/2026-03-30-pr-13945/Fixed Policy 300.4.1.1 violation by securing credential parameters in the Cyren-SentinelOne threat intelligence integration Playbook.Microsoft Threat Intelligence: Detection Logic Optimization Risks in Domain/URL Mapping Rulehttp://sentinelchangelog.net/posts/2026-03-25-pr-13904/Wed, 25 Mar 2026 11:26:14 +0000http://sentinelchangelog.net/posts/2026-03-25-pr-13904/Analytic rule optimization introduces potential detection gaps by reordering deduplication before indicator validity checks.IPinfo Connectors: Azure Functions Dependency Fix for Linux Runtimehttp://sentinelchangelog.net/posts/2026-03-24-pr-13875/Tue, 24 Mar 2026 10:39:04 +0000http://sentinelchangelog.net/posts/2026-03-24-pr-13875/All IPinfo connector Azure Function packages rebuilt to resolve dependency issues with Linux runtime.Cyren Threat Intelligence: SentinelOne IOC Automation Solution Deployedhttp://sentinelchangelog.net/posts/2026-03-24-pr-13657/Tue, 24 Mar 2026 04:56:32 +0000http://sentinelchangelog.net/posts/2026-03-24-pr-13657/New Content Hub solution automates IOC ingestion from Cyren CCF feeds (IP reputation and malware URLs) into SentinelOne for automated threat detection and response.GreyNoise Threat Intelligence: SDK Update Addresses Function App Runtime Issueshttp://sentinelchangelog.net/posts/2026-03-23-pr-13819/Mon, 23 Mar 2026 09:47:58 +0000http://sentinelchangelog.net/posts/2026-03-23-pr-13819/Updated GreyNoise Python SDK to v3.0.3, fixed module mismatches, and bumped Azure Functions runtime to resolve connector stability issues.CrowdStrike Adversary Intelligence Connector: Function App Deployment Fixhttp://sentinelchangelog.net/posts/2026-03-20-pr-13864/Fri, 20 Mar 2026 07:22:38 +0000http://sentinelchangelog.net/posts/2026-03-20-pr-13864/Version constraint fix restores Function App deployment after Azure Functions runtime compatibility issue.New Censys Solution: Attack Surface Intelligence and Entity Enrichmenthttp://sentinelchangelog.net/posts/2026-03-18-pr-13752/Wed, 18 Mar 2026 13:27:59 +0000http://sentinelchangelog.net/posts/2026-03-18-pr-13752/Adds comprehensive playbook automation for Censys threat intelligence enrichment, providing IP/domain/certificate context during incident investigation.Threat Intelligence: Duo Security IP Detection Updated for ASIM Schema Compliancehttp://sentinelchangelog.net/posts/2026-03-17-pr-13774/Tue, 17 Mar 2026 05:08:53 +0000http://sentinelchangelog.net/posts/2026-03-17-pr-13774/IPEntity_DuoSecurity detection migrated from legacy DuoSecurityAuthentication_CL table to normalized CiscoDuo ASIM schema.Cyren Threat Intelligence: Flexible Deployment with Optional JWT Tokenshttp://sentinelchangelog.net/posts/2026-03-13-pr-13811/Fri, 13 Mar 2026 07:42:33 +0000http://sentinelchangelog.net/posts/2026-03-13-pr-13811/Cyren threat intelligence connectors now support conditional deployment — customers can install either IP reputation or malware URL feeds individually based on their subscription.