http://sentinelchangelog.net/tags/updated/Recent content in Updated on sentinelchangelog.netHugo -- 0.157.0enFri, 10 Jul 2026 16:24:56 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14631/Fri, 10 Jul 2026 16:24:56 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14631/TimeGenerated and Type fields were absent from the Cisco Secure Endpoint ASIM AlertEvent parser output, causing null returns for all rows referencing these now-mandatory schema fields in downstream queries.http://sentinelchangelog.net/posts/2026-07-10-pr-14498/Fri, 10 Jul 2026 09:21:28 +0000http://sentinelchangelog.net/posts/2026-07-10-pr-14498/Nine Analytic Rules and ten Hunting Queries for Okta SSO have been overhauled with configurable thresholds, allowlist variables, improved JSON parsing, and corrected entity mappings, closing fidelity gaps that degraded Sentinel entity behaviour and alert context.http://sentinelchangelog.net/posts/2026-07-09-pr-14651/Thu, 09 Jul 2026 22:19:38 +0000http://sentinelchangelog.net/posts/2026-07-09-pr-14651/Infoblox SOC Insights gains a native CCF-based data connector via REST API polling, restoring structured ingestion of BloxOne Threat Defense insights into the InfobloxInsight_CL table after prior connectors were deprecated.http://sentinelchangelog.net/posts/2026-07-08-pr-14629/Wed, 08 Jul 2026 21:22:13 +0000http://sentinelchangelog.net/posts/2026-07-08-pr-14629/The Cisco Meraki CCF connector (v3.1.0) adds four new ingestion streams - Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events - extending coverage beyond the original ASIM event types to include wireless threat detection and full network inventory visibility.http://sentinelchangelog.net/posts/2026-07-07-pr-14637/Tue, 07 Jul 2026 21:34:27 +0000http://sentinelchangelog.net/posts/2026-07-07-pr-14637/The Imperva Cloud WAF CCF connector moves from Public Preview to GA, with connector UI template variables replaced by the literal ImpervaWAFCloud table name - no ingestion logic changes.http://sentinelchangelog.net/posts/2026-07-07-pr-14611/Tue, 07 Jul 2026 11:52:51 +0000http://sentinelchangelog.net/posts/2026-07-07-pr-14611/The AzureWAFmatching_log4j_vuln Analytic Rule was silently missing CVE-2021-44228 exploit attempts in WAF logs that surfaced details_message_s via AdditionalFields or used the details_msg_s column variant, leaving a schema-dependent blind spot in Log4Shell detection.http://sentinelchangelog.net/posts/2026-07-03-pr-14536/Fri, 03 Jul 2026 11:07:29 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14536/The ESET PROTECT Platform Function App connector rolls back several Python dependencies to lower versions, including cryptography from 48.0.0 to 43.0.1, without documented CVE justification – operators should verify no security regressions are introduced.http://sentinelchangelog.net/posts/2026-07-03-pr-14199/Fri, 03 Jul 2026 09:26:40 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14199/Recorded Future v3.2.20 removes direct incident creation from four playbooks (now incompatible with the unified Microsoft Defender portal) and introduces new Analytic Rules to restore incident generation from custom log tables.http://sentinelchangelog.net/posts/2026-07-03-pr-14491/Fri, 03 Jul 2026 09:26:17 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14491/Wiz v3.0.1 replaces the legacy Azure Function pull connector with a native DCR push integration, adding a new WizDetectionsV3_CL data stream and removing the need for customer-hosted infrastructure or shared workspace keys.http://sentinelchangelog.net/posts/2026-07-03-pr-14585/Fri, 03 Jul 2026 07:29:21 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14585/The BlueVoyant Anthropic Claude Compliance CCF connector v1.0.1 expands the DCR schema with dozens of activity-specific fields required for hunting and detection, and removes the request_body column to prevent ingestion of potentially sensitive data.http://sentinelchangelog.net/posts/2026-07-03-pr-14589/Fri, 03 Jul 2026 06:43:54 +0000http://sentinelchangelog.net/posts/2026-07-03-pr-14589/The BruteForceAgainstanEntraAuthenticatedWindowsDevice Analytic Rule was building unsorted time-series arrays for series_decompose_anomalies, meaning anomaly detection results could be incorrect or inconsistent across executions – this fix enforces chronological ordering and stable serialization before make_list.http://sentinelchangelog.net/posts/2026-07-02-pr-14561/Thu, 02 Jul 2026 11:15:42 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14561/The GitHub Azure Storage CCF connector gains a new V3 table with 10 additional api.request fields including token_scopes, request_method, request_body, status_code, and url_path, improving visibility into API-level attacker activity in GitHub audit logs.http://sentinelchangelog.net/posts/2026-07-02-pr-14594/Thu, 02 Jul 2026 10:38:59 +0000http://sentinelchangelog.net/posts/2026-07-02-pr-14594/Seven consolidated AI agent hunting queries now target the unified Defender XDR AgentsInfo table, replacing 26 connector-specific queries split across the A365 and Copilot Studio connectors; existing deployments still running the old AIAgentsInfo-based queries have had no effective hunting coverage since the table split was introduced.http://sentinelchangelog.net/posts/2026-07-01-pr-14604/Wed, 01 Jul 2026 19:47:03 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14604/The Rapid7 InsightVM CCF data connector moves out of Public Preview to GA, updating the API version to the stable 2025-09-01 release.http://sentinelchangelog.net/posts/2026-07-01-pr-14590/Wed, 01 Jul 2026 06:12:26 +0000http://sentinelchangelog.net/posts/2026-07-01-pr-14590/The QRadar collector script (v0.4.1) appends a sentinel summary row of all active Log Source Types to the exported rules CSV and switches bracket-list formatting from comma to pipe separators, breaking any downstream parsers expecting the previous format.http://sentinelchangelog.net/posts/2026-06-29-pr-14558/Mon, 29 Jun 2026 13:21:35 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14558/The Fortinet FortiNDR Cloud Function App connector has been migrated from the deprecated HTTP Data Collector API (using client secret credentials) to the Log Ingestion API using Managed Identity - deployments running the previous version were heading toward a complete ingestion failure as the old API reaches end-of-life.http://sentinelchangelog.net/posts/2026-06-29-pr-14568/Mon, 29 Jun 2026 08:58:57 +0000http://sentinelchangelog.net/posts/2026-06-29-pr-14568/The Microsoft Entra ID Assets connector gains a new EntraEligibleMembers table checkbox in the portal, expanding Privileged Identity Management (PIM) visibility for eligible role assignment tracking.http://sentinelchangelog.net/posts/2026-06-26-pr-14215/Fri, 26 Jun 2026 17:34:38 +0000http://sentinelchangelog.net/posts/2026-06-26-pr-14215/The ASIM Authentication parser for Salesforce Service Cloud now normalises logs from the V2 and V3 CCF connector tables – environments using the updated codeless connectors were previously producing zero normalised authentication events.http://sentinelchangelog.net/posts/2026-06-25-pr-14554/Thu, 25 Jun 2026 18:49:15 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14554/A broken regex in both the ASimAuthenticationCiscoISE and vimAuthenticationCiscoISE parsers caused EventOriginalType to return null for Cisco ISE syslog messages that include extended timestamp/sequence prefixes, silently dropping event classification for those log variants.http://sentinelchangelog.net/posts/2026-06-25-pr-14559/Thu, 25 Jun 2026 12:15:40 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14559/P0-labeled packaging-only update to the Cybersixgill Actionable Alerts solution that extracts hardcoded channel and step IDs into template variables in mainTemplate.json – no YAML content or detection logic changes.http://sentinelchangelog.net/posts/2026-06-25-pr-14546/Thu, 25 Jun 2026 11:35:07 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14546/Two Darktrace Analytic Rules now map user account names as Account entities for SaaS/identity-based incidents, and the DarktraceIncidents_CL table gains a modelBreaches field exposing the full chain of associated model alerts – data that was previously absent from incident context.http://sentinelchangelog.net/posts/2026-06-25-pr-14492/Thu, 25 Jun 2026 09:31:44 +0000http://sentinelchangelog.net/posts/2026-06-25-pr-14492/The NetskopeWebTransactions_CL schema gains 51 new fields covering malware detections, endpoint posture, process activity, identity/authorization, and remote geo — all parser column references have also shifted from raw W3C names to DCR-normalised PascalCase, requiring query updates on any existing saved searches or Analytic Rules built against this parser.http://sentinelchangelog.net/posts/2026-06-24-pr-14548/Wed, 24 Jun 2026 16:48:14 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-14548/The FortiGate ASIM Authentication parser was silently discarding event:system failed and event:system success log types, creating a blind spot for credential-based attacks and successful system authentications on FortiGate devices.http://sentinelchangelog.net/posts/2026-06-24-pr-14487/Wed, 24 Jun 2026 08:31:21 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-14487/The BitSight legacy Function App connector UI page was updated to align with the Log Ingestion API (DCR) ingestion path, removing the Workspace ID/Key deployment step and replacing it with Entra ID credential requirements.http://sentinelchangelog.net/posts/2026-06-24-pr-14540/Wed, 24 Jun 2026 06:03:17 +0000http://sentinelchangelog.net/posts/2026-06-24-pr-14540/Two new identity graph tables – EntraOwners and EntraSponsors – are now available in the Microsoft Entra ID Assets connector, expanding the identity relationship data surface for investigating account takeover and privilege escalation paths.http://sentinelchangelog.net/posts/2026-06-23-pr-14533/Tue, 23 Jun 2026 06:01:03 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14533/The Trend Micro Vision One Function App connector gains support for the Indonesia (id) API region, resolving a complete ingestion gap for customers deployed on api.id.xdr.trendmicro.com.http://sentinelchangelog.net/posts/2026-06-23-pr-14537/Tue, 23 Jun 2026 05:40:00 +0000http://sentinelchangelog.net/posts/2026-06-23-pr-14537/Three email-focused Hunting Queries had a broken connector reference (OfficeATP instead of MicrosoftThreatProtection), suppressing results for orgs using the Defender XDR connector; three new queries covering RMM-via-Teams, alert correlation with Teams messages, and phish-reporter identity are also added.http://sentinelchangelog.net/posts/2026-06-22-pr-14496/Mon, 22 Jun 2026 21:57:23 +0000http://sentinelchangelog.net/posts/2026-06-22-pr-14496/AWS WAF web session logs can now be ingested and normalized via the ASIM WebSession schema, enabling source-agnostic detections against WAF allow/block/challenge/captcha decisions from the AWSWAF table.http://sentinelchangelog.net/posts/2026-06-22-pr-14428/Mon, 22 Jun 2026 10:12:50 +0000http://sentinelchangelog.net/posts/2026-06-22-pr-14428/The SilkTyphoonNewUMServiceChildProcess Analytic Rule carried a duplicate and mistyped connector entry (SecurityEvents instead of SecurityEvent) that could cause connector validation errors or unexpected behaviour in environments relying on connector dependency resolution.http://sentinelchangelog.net/posts/2026-06-19-pr-14506/Fri, 19 Jun 2026 10:35:25 +0000http://sentinelchangelog.net/posts/2026-06-19-pr-14506/The Checkmarx SAST ingestion Playbook receives pagination fixes, configurable DCE/DCR resource names to support multi-playbook deployments, a corrected severity schema (adding CRITICAL tier), and a reduced default lookback window from 7 to 2 days.http://sentinelchangelog.net/posts/2026-06-18-pr-14472/Thu, 18 Jun 2026 05:58:50 +0000http://sentinelchangelog.net/posts/2026-06-18-pr-14472/Two Defender XDR hunting queries targeting OAuth consent and device-code phishing were blocked from pipeline validation due to ARM-TTK hardcoded URI false positives; KQL refactored to construct URLs via strcat(), restoring deployment and preserving detection semantics.http://sentinelchangelog.net/posts/2026-06-17-pr-14470/Wed, 17 Jun 2026 05:37:45 +0000http://sentinelchangelog.net/posts/2026-06-17-pr-14470/All six BloodHound Enterprise workbooks had parameter dropdown queries silently failing due to missing time context; this fix adds an explicit 30-day timeContext (durationMs: 2592000000) to each parameter, restoring operator visibility into attack paths and posture data.http://sentinelchangelog.net/posts/2026-06-16-pr-14406/Tue, 16 Jun 2026 21:24:47 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14406/The SentinelOne CCF connector now supports multiple simultaneous instances via a grid/context-pane UX, enabling MSSPs to ingest from multiple SentinelOne tenants without deploying duplicate solutions.http://sentinelchangelog.net/posts/2026-06-16-pr-14500/Tue, 16 Jun 2026 20:55:58 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14500/The createCCPConnector.ps1 solution packaging script now supports CiscoDuo, CommVault, VisaXpayToken, BarracudaWAF, and EdgeGrid auth types, unblocking connector packaging for products using these authentication schemes.http://sentinelchangelog.net/posts/2026-06-16-pr-14382/Tue, 16 Jun 2026 06:03:25 +0000http://sentinelchangelog.net/posts/2026-06-16-pr-14382/The Zimperium Mobile Threat Defense CCF connector now ingests mobile incident data into two new custom tables, extending threat visibility beyond raw threat events to correlated incident and mitigation workflows.http://sentinelchangelog.net/posts/2026-06-15-pr-14381/Mon, 15 Jun 2026 06:38:00 +0000http://sentinelchangelog.net/posts/2026-06-15-pr-14381/Added QDS score parameter to QualysVM CCF connector, enabling users to include Qualys Detection Scores in vulnerability data collection.http://sentinelchangelog.net/posts/2026-06-12-pr-14225/Fri, 12 Jun 2026 07:01:44 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14225/Akamai Guardicore connector migrates from Azure Functions to Codeless Connector Framework, removing infrastructure overhead while preserving microsegmentation visibility.http://sentinelchangelog.net/posts/2026-06-12-pr-14468/Fri, 12 Jun 2026 01:12:32 +0000http://sentinelchangelog.net/posts/2026-06-12-pr-14468/Critical fix restores validation of Common schema fields alongside schema-specific fields in ASIM parser testing.http://sentinelchangelog.net/posts/2026-06-11-pr-14465/Thu, 11 Jun 2026 14:26:21 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-14465/Fixes missing workbook metadata in AWS Security Hub solution package without changing detection or ingestion logic.http://sentinelchangelog.net/posts/2026-06-11-pr-13876/Thu, 11 Jun 2026 13:00:36 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-13876/Quality improvements to 10 Azure SQL analytic rules add missing MITRE techniques, alert customization, and standardized query outputs.http://sentinelchangelog.net/posts/2026-06-11-pr-14429/Thu, 11 Jun 2026 09:19:52 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-14429/Two SAP Enterprise Threat Detection rules added to detect feed silence and per-SID data gaps, addressing T1562 defense evasion techniques.http://sentinelchangelog.net/posts/2026-06-11-pr-14430/Thu, 11 Jun 2026 09:18:38 +0000http://sentinelchangelog.net/posts/2026-06-11-pr-14430/SAP BTP analytic rule reworked to use audit.configuration events, providing richer artifact context and improved actor attribution for Cloud Integration deployments.http://sentinelchangelog.net/posts/2026-06-10-pr-14452/Wed, 10 Jun 2026 13:22:48 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14452/Workbook metadata entry added for AWS Security Hub compliance visualization — workbook content deployment follows separately.http://sentinelchangelog.net/posts/2026-06-10-pr-14218/Wed, 10 Jun 2026 10:27:10 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14218/CCF connector schema updated to capture additional attack context with codeLocation, vectorAnalysis, and request_parameters fields for improved threat analysis.http://sentinelchangelog.net/posts/2026-06-10-pr-14425/Wed, 10 Jun 2026 03:39:39 +0000http://sentinelchangelog.net/posts/2026-06-10-pr-14425/Enhanced Solutions Analyzer tooling improves connector discovery accuracy and adds artifact deep-linking for external integrations.http://sentinelchangelog.net/posts/2026-06-09-pr-14376/Tue, 09 Jun 2026 08:01:41 +0000http://sentinelchangelog.net/posts/2026-06-09-pr-14376/DCR transform fix stops storing malware URL UUIDs in IP fields — improves data quality for threat intelligence queries.http://sentinelchangelog.net/posts/2026-06-08-pr-14362/Mon, 08 Jun 2026 09:50:42 +0000http://sentinelchangelog.net/posts/2026-06-08-pr-14362/Digital Shadows analytic rules now use server-provided GreyMatter URLs instead of deprecated portal links, preventing broken URL entities in Sentinel incidents.http://sentinelchangelog.net/posts/2026-06-05-pr-14275/Fri, 05 Jun 2026 05:39:27 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14275/Corelight solution restructured workbooks and added asset classification functionality to improve network asset discovery and security monitoring capabilities.http://sentinelchangelog.net/posts/2026-06-05-pr-14181/Fri, 05 Jun 2026 05:38:19 +0000http://sentinelchangelog.net/posts/2026-06-05-pr-14181/CyberArk EPM connector updated to use DCR ingestion and OAuth authentication, addressing deprecation of Log Analytics API and improving security.http://sentinelchangelog.net/posts/2026-06-02-pr-14396/Tue, 02 Jun 2026 21:22:50 +0000http://sentinelchangelog.net/posts/2026-06-02-pr-14396/ASIM Authentication parsers for Palo Alto PAN-OS and GlobalProtect now correctly populate DvcIpAddr field, fixing data fidelity gap.