Tools on sentinelchangelog.nethttp://sentinelchangelog.net/tags/tools/Recent content in Tools on sentinelchangelog.netHugo -- 0.157.0enThu, 09 Jul 2026 22:44:23 +0000SentinelOne V2 CCF Connector: UAM GraphQL Alerts Now Visible in Sentinel (Plus Packaging Fix)http://sentinelchangelog.net/posts/2026-07-09-pr-14615/Thu, 09 Jul 2026 22:44:23 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14615/The SentinelOne solution adds a new CCF-based V2 connector ingesting Unified Alert Management (UAM) alerts from the GraphQL API into SentinelOneAlertsV2_CL, closing a blind spot for Wayfinder, cloud, identity, STAR, and third-party detections that the legacy REST connector never surfaced.New CCF Connector Builder Accelerator: AI-Assisted End-to-End Pull Connector Generation for Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-07-07-pr-14567/Tue, 07 Jul 2026 13:50:01 +0000http://sentinelchangelog.net/posts/2026-07-07-pr-14567/Adds a GitHub Copilot agent accelerator to the Tools/ directory that automates generation of the four CCF connector files (polling config, DCR, table schema, connector definition) from any REST API documentation – lowering the barrier for partners building custom data connectors.QRadar Migration Tool: Summary Row and Delimiter Changes Affect CSV Output Formathttp://sentinelchangelog.net/posts/2026-07-01-pr-14590/Wed, 01 Jul 2026 06:12:26 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14590/The QRadar collector script (v0.4.1) appends a sentinel summary row of all active Log Source Types to the exported rules CSV and switches bracket-list formatting from comma to pipe separators, breaking any downstream parsers expecting the previous format.CCF Solution Packaging Tool Gains Five New Auth Type Handlershttp://sentinelchangelog.net/posts/2026-06-16-pr-14500/Tue, 16 Jun 2026 20:55:58 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14500/The createCCPConnector.ps1 solution packaging script now supports CiscoDuo, CommVault, VisaXpayToken, BarracudaWAF, and EdgeGrid auth types, unblocking connector packaging for products using these authentication schemes.CCF Blob Connector Accelerator: Developer Reference Implementation for Event-Driven Log Ingestionhttp://sentinelchangelog.net/posts/2026-06-12-pr-14313/Fri, 12 Jun 2026 04:45:50 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14313/New tool provides ISV partners with complete end-to-end CCF StorageAccountBlobContainer connector pattern including automated deployment and reference solution.ASIM Schema Tester: Fixing Critical Validation Gap for Common Fieldshttp://sentinelchangelog.net/posts/2026-06-12-pr-14468/Fri, 12 Jun 2026 01:12:32 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14468/Critical fix restores validation of Common schema fields alongside schema-specific fields in ASIM parser testing.Solutions Analyzer v9.8: Connector Discovery Accuracy and Documentation Deep-Linkshttp://sentinelchangelog.net/posts/2026-06-10-pr-14425/Wed, 10 Jun 2026 03:39:39 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14425/Enhanced Solutions Analyzer tooling improves connector discovery accuracy and adds artifact deep-linking for external integrations.SAP Solution: Analyzer Marketplace Visibility and Agentless Connector Discovery Fixedhttp://sentinelchangelog.net/posts/2026-06-05-pr-14395/Fri, 05 Jun 2026 16:44:46 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14395/Tools fixes enable proper SAP solution marketplace tracking and make the SAPCC agentless connector visible to the Microsoft Sentinel Solutions Analyzer.ASIM Parser Development Automation: GitHub Copilot Skills for Accelerated Detection Engineeringhttp://sentinelchangelog.net/posts/2026-05-29-pr-14383/Fri, 29 May 2026 23:39:29 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14383/GitHub Copilot agent skills now automate the complete ASIM parser creation workflow, reducing parser development time from days to hours for security engineers.OpenAI Connector: Migration to ASIM Standard Improves AI Monitoring Normalizationhttp://sentinelchangelog.net/posts/2026-05-20-pr-14277/Wed, 20 May 2026 22:32:31 +0000http://sentinelchangelog.net/posts/2026-05-20-pr-14277/OpenAI chat completions data now ingests to ASimAgentEventLogs standard table, enabling standardized AI usage monitoring and cross-product correlation.Microsoft Sentinel to Defender Portal Migration Readiness Toolhttp://sentinelchangelog.net/posts/2026-05-15-pr-14195/Fri, 15 May 2026 08:53:22 +0000http://sentinelchangelog.net/posts/2026-05-15-pr-14195/New PowerShell assessment tool identifies migration blockers for Sentinel-to-Defender portal transitions.Salesforce Audit Visibility: New CCF Connector for Administrative Change Trackinghttp://sentinelchangelog.net/posts/2026-05-12-pr-14227/Tue, 12 May 2026 16:45:51 +0000http://sentinelchangelog.net/posts/2026-05-12-pr-14227/New Salesforce Audit Logs connector provides visibility into administrative changes and user authentication events across Salesforce orgs.Solutions Analyzer: Fix Connector Overcount in CCF v2 Solutionshttp://sentinelchangelog.net/posts/2026-05-05-pr-14184/Tue, 05 May 2026 08:00:11 +0000http://sentinelchangelog.net/posts/2026-05-05-pr-14184/Solutions Analyzer was double-counting connectors in CCF v2 solutions due to azuredeploy wrapper files creating phantom duplicates.Salesforce Service Cloud Connector: Enhanced Event Log Coverage and Multi-Domain Supporthttp://sentinelchangelog.net/posts/2026-05-04-pr-14180/Mon, 04 May 2026 19:12:27 +0000http://sentinelchangelog.net/posts/2026-05-04-pr-14180/Major connector upgrade introduces comprehensive event field collection and multi-tenant monitoring capabilities.Training Lab: Fixed Detection Rule Deployment Script Resiliencehttp://sentinelchangelog.net/posts/2026-04-28-pr-14118/Tue, 28 Apr 2026 11:53:51 +0000http://sentinelchangelog.net/posts/2026-04-28-pr-14118/Lab deployment script now retries on any table syntax errors, not just OktaV2_CL — prevents silent deployment failures.Microsoft Sentinel Training Lab: Authentication Simplified to UAMI-Onlyhttp://sentinelchangelog.net/posts/2026-04-22-pr-14106/Wed, 22 Apr 2026 14:17:05 +0000http://sentinelchangelog.net/posts/2026-04-22-pr-14106/Training lab removes dual-auth complexity, standardizing on User-Assigned Managed Identity for Microsoft Defender XDR custom detection rule deployment.PowerShell Tool Simplifies CLv1 Table Migration Assessment Before September 2026 Deadlinehttp://sentinelchangelog.net/posts/2026-04-21-pr-14100/Tue, 21 Apr 2026 06:38:03 +0000http://sentinelchangelog.net/posts/2026-04-21-pr-14100/New PowerShell script automates discovery of classic custom log tables and dependency impact assessment for the mandatory HTTP Data Collector API migration.Microsoft Sentinel Training Lab: Federation and Split Transformation Capabilities Expandedhttp://sentinelchangelog.net/posts/2026-04-20-pr-14094/Mon, 20 Apr 2026 15:13:23 +0000http://sentinelchangelog.net/posts/2026-04-20-pr-14094/Two advanced data ingestion exercises added to training lab covering ADLS Gen2 federation and tier-based transformation routing.Sentinel Training Lab: Enhanced Detection Rules and Cost Management Featureshttp://sentinelchangelog.net/posts/2026-04-18-pr-14078/Sat, 18 Apr 2026 05:39:45 +0000http://sentinelchangelog.net/posts/2026-04-18-pr-14078/Comprehensive update to the Sentinel Training Lab with improved detection entity correlation, new cost management capabilities, and standardized naming conventions.QRadar Migration Tool: Streamlining SIEM Detection Rule Migration to Microsoft Sentinelhttp://sentinelchangelog.net/posts/2026-04-16-pr-14015/Thu, 16 Apr 2026 07:04:15 +0000http://sentinelchangelog.net/posts/2026-04-16-pr-14015/New Python-based data collector extracts custom QRadar detection rules and building blocks for migration-ready analysis and conversion to Microsoft Sentinel.Microsoft Sentinel Training Lab: Comprehensive Hands-On Security Operations Environment Now Availablehttp://sentinelchangelog.net/posts/2026-04-10-pr-13848/Fri, 10 Apr 2026 15:05:24 +0000http://sentinelchangelog.net/posts/2026-04-10-pr-13848/New deployment-ready training lab delivers 14 guided exercises with pre-recorded telemetry, detection rules, and automation workflows for practical Microsoft Sentinel skill development.SAP Agentless Connector: Reduced Permission Model for Enhanced Securityhttp://sentinelchangelog.net/posts/2026-04-08-pr-14002/Wed, 08 Apr 2026 06:12:34 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-14002/SAP Reader role permissions significantly reduced for agentless connector, implementing least-privilege access while maintaining monitoring capabilities.SAP Solutions: Production-Ready Status After Preview Removalhttp://sentinelchangelog.net/posts/2026-04-08-pr-13960/Wed, 08 Apr 2026 05:16:54 +0000http://sentinelchangelog.net/posts/2026-04-08-pr-13960/Two SAP solutions transitioned from preview to production-ready status, unlocking stable SAP audit and infrastructure log ingestion.SAP Data Connector: Docker Image Integrity Verification Added to Deployment Scriptshttp://sentinelchangelog.net/posts/2026-04-03-pr-13736/Fri, 03 Apr 2026 09:36:33 +0000http://sentinelchangelog.net/posts/2026-04-03-pr-13736/SAP deployment scripts now verify Docker image digest integrity to prevent container supply chain attacks during installation.Qualys VM: CCF Connector Adds Vulnerability Intelligence Streamhttp://sentinelchangelog.net/posts/2026-04-02-pr-13747/Thu, 02 Apr 2026 20:40:05 +0000http://sentinelchangelog.net/posts/2026-04-02-pr-13747/Qualys VM Knowledge Base solution now includes a Codeless Connector Framework (CCF) implementation for automated vulnerability data ingestion alongside the existing legacy connector.Imperva Cloud WAF: Production Ready CCF Connector with Standard Tableshttp://sentinelchangelog.net/posts/2026-03-31-pr-13948/Tue, 31 Mar 2026 04:32:41 +0000http://sentinelchangelog.net/posts/2026-03-31-pr-13948/Imperva Cloud WAF CCF connector migrates from private preview custom tables to public preview standard tables.AWS ELB Connector: Public Preview CCF Ingestion for ALB, NLB, and GLB Logshttp://sentinelchangelog.net/posts/2026-03-23-pr-13872/Mon, 23 Mar 2026 11:41:03 +0000http://sentinelchangelog.net/posts/2026-03-23-pr-13872/New CCF connector enables ingestion of AWS Elastic Load Balancer access and flow logs into Microsoft Sentinel for network traffic monitoring and threat detection.Alibaba Cloud Networking: New CCF Connector Brings VPC Flow, WAF, and API Gateway Visibilityhttp://sentinelchangelog.net/posts/2026-03-16-pr-13810/Mon, 16 Mar 2026 23:30:01 +0000http://sentinelchangelog.net/posts/2026-03-16-pr-13810/Microsoft Sentinel gains visibility into Alibaba Cloud network infrastructure with a new CCF connector supporting VPC Flow Logs, WAF events, and API Gateway data ingestion via Simple Log Service.Logstash Plugin: Configurable Retransmission Delay Reduces HTTP 429 Throttling Impacthttp://sentinelchangelog.net/posts/2026-03-13-pr-13765/Fri, 13 Mar 2026 12:23:23 +0000http://sentinelchangelog.net/posts/2026-03-13-pr-13765/Microsoft Sentinel Logstash plugin v1.2.1 adds configurable retry delay parameter to mitigate data loss during throttling scenarios.AWS Network Firewall Connector: Fixed Critical Deployment Bug Causing Duplicate Collectorshttp://sentinelchangelog.net/posts/2026-03-11-pr-13589/Wed, 11 Mar 2026 21:39:27 +0000http://sentinelchangelog.net/posts/2026-03-11-pr-13589/Deployment bug fix prevents multiple collector creation for AWS Network Firewall multi-stream connectors.GitHub Workflows: Code Injection Risk Mitigation via Environment Variable Security Fixhttp://sentinelchangelog.net/posts/2026-03-11-pr-13794/Wed, 11 Mar 2026 10:24:36 +0000http://sentinelchangelog.net/posts/2026-03-11-pr-13794/Fixed code injection vulnerabilities in CI workflows by replacing direct GitHub context interpolation with safer environment variable patterns.TheHive Incident Response: New CCF Connector for SOAR Platform Integrationhttp://sentinelchangelog.net/posts/2026-03-05-pr-13756/Thu, 05 Mar 2026 22:15:19 +0000http://sentinelchangelog.net/posts/2026-03-05-pr-13756/Microsoft Sentinel gains native ingestion from TheHive security incident response platform via CCF connector, enabling case management visibility and response workflow correlation.Solution Analyzer v9.0: Enhanced Table Schema Discovery and Documentation Source Prioritizationhttp://sentinelchangelog.net/posts/2026-03-03-pr-13707/Tue, 03 Mar 2026 05:48:50 +0000http://sentinelchangelog.net/posts/2026-03-03-pr-13707/Major enhancement adds comprehensive table schema extraction from DCR configs and Azure Monitor docs, plus improved discovery source hierarchy for better data source visibility.Solutions Analyzer Tools: Kusto Upload, CCF Legacy Support, and Parser Analysis Enhancementshttp://sentinelchangelog.net/posts/2026-02-20-pr-13666/Fri, 20 Feb 2026 22:52:26 +0000http://sentinelchangelog.net/posts/2026-02-20-pr-13666/Major tooling update adds Kusto integration, improves CCF connector classification, and fixes ASIM parser documentation generation.Solution Creation Tools: API Version Update for Saved Searcheshttp://sentinelchangelog.net/posts/2026-02-20-pr-13647/Fri, 20 Feb 2026 12:35:30 +0000http://sentinelchangelog.net/posts/2026-02-20-pr-13647/Updated savedSearches API version from 2022-10-01 to 2025-07-01 in solution metadata generation tool.SAP Solution: Agentless Integration Suite Tooling Added for Enhanced ERP Connectivityhttp://sentinelchangelog.net/posts/2026-02-06-pr-13465/Fri, 06 Feb 2026 08:48:09 +0000http://sentinelchangelog.net/posts/2026-02-06-pr-13465/New PowerShell tooling enables agentless SAP data collection via Integration Suite with dual-mode credentials and CSV-based destination management.New Solution: meshStack Platform Event Logs Integration for Cloud Governancehttp://sentinelchangelog.net/posts/2026-02-05-pr-13324/Thu, 05 Feb 2026 05:22:11 +0000http://sentinelchangelog.net/posts/2026-02-05-pr-13324/meshStack event logging connector enables cloud platform governance monitoring by ingesting developer platform events into Microsoft Sentinel.Solutions Analyzer: Enhanced Documentation with Lake-Only Ingestion and Statistics Featureshttp://sentinelchangelog.net/posts/2026-02-04-pr-13478/Wed, 04 Feb 2026 17:04:53 +0000http://sentinelchangelog.net/posts/2026-02-04-pr-13478/Comprehensive documentation tool update adds lake-only ingestion tracking, collection methods index, and enhanced connector association analysis.Solution Package Tool: Local Version Bumping Mode Added for Offline Developmenthttp://sentinelchangelog.net/posts/2026-02-03-pr-13482/Tue, 03 Feb 2026 09:16:56 +0000http://sentinelchangelog.net/posts/2026-02-03-pr-13482/CreateSolutionV3 script now supports offline semantic versioning with local version management alongside existing catalog API mode.OAuth Data Connectors: Dynamic Redirect URI Support Simplifies Authentication Setuphttp://sentinelchangelog.net/posts/2026-02-03-pr-13165/Tue, 03 Feb 2026 08:52:26 +0000http://sentinelchangelog.net/posts/2026-02-03-pr-13165/Four OAuth-based data connectors now support dynamic redirect URIs, eliminating manual Azure portal configuration requirements.Armis IoT Security Solution: Enhanced Log Ingestion and Data Collection Rule Integrationhttp://sentinelchangelog.net/posts/2025-12-26-pr-13252/Fri, 26 Dec 2025 11:47:14 +0000http://sentinelchangelog.net/posts/2025-12-26-pr-13252/Major enhancement to Armis data connectors implementing Azure Monitor Logs Ingestion API with DCR support for improved data fidelity and performance.Major Solution Release: Cyble Vision and Tropico Solutions Added Plus Multi-Solution Updateshttp://sentinelchangelog.net/posts/2025-12-22-pr-13350/Mon, 22 Dec 2025 18:38:10 +0000http://sentinelchangelog.net/posts/2025-12-22-pr-13350/Large release adds two new threat intelligence solutions (Cyble Vision, Tropico) and updates to 15+ existing solutions across the repository.SAP BTP Tools: Improved Connection Management and Subaccount Naminghttp://sentinelchangelog.net/posts/2025-12-19-pr-13338/Fri, 19 Dec 2025 10:20:49 +0000http://sentinelchangelog.net/posts/2025-12-19-pr-13338/SAP BTP connector tools updated with better subaccount handling, connection naming, and performance optimisations.Microsoft Copilot Connector — Critical Table Name Update from LLMActivity to CopilotActivityhttp://sentinelchangelog.net/posts/2025-12-16-pr-13272/Tue, 16 Dec 2025 04:58:57 +0000http://sentinelchangelog.net/posts/2025-12-16-pr-13272/Microsoft Copilot connector fixes critical table reference issue, standardizing on official CopilotActivity table name across all components.Fortigate ASIM Parser: Field Name Consistency Fix for Network Session Schemahttp://sentinelchangelog.net/posts/2025-12-12-pr-12927/Fri, 12 Dec 2025 09:49:09 +0000http://sentinelchangelog.net/posts/2025-12-12-pr-12927/Field name inconsistencies in Fortigate ASIM parsers corrected to ensure proper schema compliance and data normalization.Critical Cloudflare Analytics Rules: Enhanced URL Entity Mapping and Repository Maintenancehttp://sentinelchangelog.net/posts/2025-12-08-pr-13138/Mon, 08 Dec 2025 06:57:34 +0000http://sentinelchangelog.net/posts/2025-12-08-pr-13138/P0-labeled update improves URL entity mapping in Cloudflare detection rules alongside extensive repository maintenance and validation improvements.Solutions Analyzer Tool: Automated Connector Documentation Generationhttp://sentinelchangelog.net/posts/2025-12-04-pr-13234/Thu, 04 Dec 2025 19:05:29 +0000http://sentinelchangelog.net/posts/2025-12-04-pr-13234/Solutions Analyzer tool enhanced to generate markdown documentation files for all 1000+ connectors in addition to CSV output.ZeroFox CCF Connector: KQL Query Restoration and Multi-Solution Maintenancehttp://sentinelchangelog.net/posts/2025-12-04-pr-13209/Thu, 04 Dec 2025 10:45:58 +0000http://sentinelchangelog.net/posts/2025-12-04-pr-13209/ZeroFox CCF connector receives missing KQL query fixes alongside packaging updates across 8+ solutions.Linux Support for Sentinel Transition Helper: Cross-Platform SOC Analysis Toolhttp://sentinelchangelog.net/posts/2025-12-03-pr-13144/Wed, 03 Dec 2025 08:46:15 +0000http://sentinelchangelog.net/posts/2025-12-03-pr-13144/Added Linux-compatible version of Sentinel Transition Helper script using Azure CLI for cross-platform SOC environment analysis.Security Cleanup: Removing Vulnerable Legacy O365 Teams and RDAP Toolshttp://sentinelchangelog.net/posts/2025-12-03-pr-13217/Wed, 03 Dec 2025 05:45:54 +0000http://sentinelchangelog.net/posts/2025-12-03-pr-13217/Deleted legacy O365 DataCSharp Teams connector and RDAPQuery tool due to vulnerable .NET dependencies and security risks.