Microsoft Ignite 2026: New Sentinel Connectors Announcement

blacklens.io for Microsoft Sentinel

blacklens.io for Microsoft Sentinel brings external and internal attack-surface data, risk-prioritized vulnerabilities, darknet intelligence, and supply-chain risks into Microsoft Sentinel. The connector ingests exposed assets, compromised identities, stolen credentials and session cookies, typosquatting domains, and supplier activity on ransomware leak sites. The solution includes a data connector and analytics rule for creating Sentinel incidents, with configurable notification rules for alert severity and type. Findings are available in Log Analytics for correlation with existing Sentinel signals and can support custom analytics rules, workbooks, automation, and threat investigations.

BlueVoyant Anthropic Claude Compliance 

BlueVoyant Anthropic Claude Compliance brings compliance activity from the Anthropic Claude Compliance API into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector ingests Claude compliance events into Sentinel, giving security, risk, and audit teams centralized visibility into AI usage and related activity. By correlating these compliance signals with identity, endpoint, and other security telemetry, the integration supports threat hunting, investigation of policy violations and anomalous behavior, compliance monitoring, and repeatable audit workflows.  

Cato Networks for Microsoft Sentinel 

Cato Networks for Microsoft Sentinel brings security and network events from the Cato SASE Platform into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. The connector pushes events into a dedicated Log Analytics table, making Cato activity available alongside other Sentinel data. By centralizing this telemetry in Sentinel, the integration enables security teams to incorporate Cato events into threat hunting, detection, and visualization workflows alongside broader security signals.

Check Point EM ThreatCloud Intelligence Feed Connector for Microsoft Sentinel 

The Check Point EM ThreatCloud Intelligence Feed Connector brings threat intelligence from Check Point Exposure Management into Microsoft Sentinel. The connector ingests indicators of compromise (IoCs), including malicious IP addresses, domains, URLs, and file hashes, enriched with threat context such as confidence, severity, kill-chain stage, and campaign associations. An included playbook further enriches incident IoCs through ThreatCloud, helping security teams correlate intelligence with existing telemetry, accelerate triage and investigation, and reduce the manual effort required to maintain threat intelligence. 

Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel 

Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel brings threat intelligence from Check Point Infinity External Risk Management into Sentinel. The connector ingests malicious IP addresses, domains, URLs, and file hashes, enriched with context such as severity, confidence, and detected activity. By correlating these indicators of compromise (IoCs) with existing logs through analytics rules, hunting queries, and watchlists, the integration helps security teams reduce manual intelligence management, identify matches with external threats, and accelerate threat detection and investigation. 

Citrix SPA Sentinel App

Citrix SPA Sentinel App brings Citrix Secure Private Access and Device Posture service events into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector imports critical logs, policy outcomes, and user activity data, giving security teams greater visibility into application access and device posture activity. An included workbook supports visualization and analysis of Citrix data, helping SOC teams correlate activity with broader security telemetry, investigate security risks, support compliance monitoring, and strengthen threat hunting across their environment.

ContraForce Events for Microsoft Sentinel

ContraForce Events for Microsoft Sentinel brings security delivery and administrative activity from ContraForce workspaces into Microsoft Sentinel using the Codeless Connector Framework (CCF). ContraForce is an Agentic Security Delivery Platform for service providers and security teams running triage, investigation, and response across Microsoft Defender XDR and Sentinel. The connector ingests incidents, privileged access changes, service account credential activity, and high-impact workspace actions. Three included analytics rules detect privileged access, credential, and high-impact workspace activity, helping teams monitor and investigate the platform supporting their security operations.

Corelight for Microsoft Sentinel

By transforming all network traffic into rich, comprehensive evidence, Corelight gives security teams using Microsoft Sentinel the visibility to understand exactly what is happening across their enterprise networks. In addition to native integration with Microsoft Sentinel, Corelight integrates with Microsoft Defender for Endpoint, Defender Vulnerability Management, and Entra ID to streamline investigations, accelerate responses, and remediate incidents quickly and easily. The Corelight App for Microsoft Sentinel includes intuitive dashboards, pre-defined workbooks , sample queries, and analytics rules that help make SOC teams more efficient and effective.

CTM360

CTM360 brings external threat visibility into Microsoft Sentinel. The integration connects the CTM360 HackerView and CyberBlindspot platforms to Sentinel through REST APIs, so external attack surface and digital risk events flow straight into security operations workflows. HackerView surfaces externally exposed assets and security issues across your attack surface. CyberBlindspot adds organization-specific threat intelligence from surface, deep, and dark web monitoring. With these signals centralized in Sentinel, security teams can analyze external exposures alongside their broader telemetry and speed up detection, investigation, and response. 

Cyren CrowdStrike IOC Automation

Cyren CrowdStrike IOC Automation connects Cyren IP reputation threat intelligence with Microsoft Sentinel and CrowdStrike Falcon to operationalize malicious IP indicators. An included Logic App playbook automatically retrieves known malicious IP addresses from Cyren and submits them to CrowdStrike Falcon as custom indicators of compromise (IOCs) for blocking and detection. Scheduled execution keeps the intelligence updated and automates the flow of Cyren IP reputation data into CrowdStrike Falcon for blocking and detection.

Vaikora AI Agent Signals for Microsoft Sentinel

Vaikora AI Agent Signals for Microsoft Sentinel brings behavioral security signals from AI agents into Sentinel for centralized monitoring and response. The connector ingests risk scores, anomaly and threat classifications, policy enforcement decisions, and audit data, including signals for prompt injection attempts and suspicious tool usage. Included analytics rules and a workbook help security teams detect behavioral anomalies, investigate policy violations, and incorporate AI agent risks into existing Sentinel incident workflows.  

DataBahn Agentic Data Control Plane for Microsoft Sentinel

DataBahn’s agentic data control plane integrates with Microsoft Sentinel to provide our shared customers an AI-native data pipeline and orchestration platform that allows them to accelerate enterprise deployments. DataBahn’s pipeline standardizes onboarding and shaping across all data sources while providing operational visibility into data flow and health. Together, the collaboration focuses on reducing onboarding friction, improving normalization consistency, and enabling intentional routing, which helps security teams improve visibility, support threat detection, and streamline investigation and incident response workflows. 

Delinea Platform for Microsoft Sentinel

Delinea Platform Sentinel Solution brings privileged access activity into Sentinel natively through the Content Hub, as a complete SOC package. The connector pulls audit events covering secrets access, authentication, session activity and configuration changes directly into Sentinel. Ready-made workbooks, analytics rules with baseline-driven detection, hunting queries and an automated response playbook let security teams detect bulk secret access, failed sign-in bursts and privilege escalation sooner, investigate without leaving Sentinel and answer auditors with a record of what happened and why it was allowed.

Dynatrace Software Intelligence Platform with Microsoft Sentinel

Dynatrace integrates bidirectionally with Microsoft Sentinel, bringing application attacks, runtime vulnerabilities, Dynatrace Intelligence problems, and audit logs into Sentinel, where analytics rules, workbooks, and playbooks support detection, triage, and response. Sentinel can also send alerts to Dynatrace and enrich detected attacks with Sentinel and Microsoft Defender XDR insights. Bindplane by Dynatrace complements the integration by collecting and routing logs into Sentinel, including normalization to ASIM tables, giving SOC teams runtime and topology context for investigations.

ExtraHop RevealX for Microsoft Sentinel

ExtraHop RevealX for Microsoft Sentinel brings network detection and response (NDR) into Sentinel, giving your SOC visibility into threats that endpoint and log tools miss, including lateral movement and credential abuse hiding in encrypted east-west traffic. RevealX decrypts and analyzes network traffic at line rate, out of band with no impact on the network. The connector sends ExtraHop detections into Sentinel for dashboards, custom alerts, and investigation, so network context enriches your existing SOC workflows instead of sitting in a separate console.

Fire Compass  

FireCompass Risks for Microsoft Sentinel brings validated external risk findings from the FireCompass platform into Microsoft Sentinel through the Codeless Connector Framework. The connector ingests risk data including severity, affected assets, assessment context, impact, and remediation guidance. By making validated exposures available in Sentinel, security teams can correlate external risks with endpoint and network telemetry, track remediation progress, and build analytics rules, workbooks, and hunting queries on top of FireCompass findings. 

Gambit Security Sentinel Solution

Gambit brings resilience context into Microsoft Sentinel. It finds the resilience issues in your environment and syncs them to your Sentinel workspace daily, to help analysts see recovery risk before anything goes wrong. Sentinel correlates those issues with its detections. Your team can then prioritize the attacks most likely to disrupt critical operations: the ones hitting resources that aren’t ready to recover. Sentinel tells you what’s happening. Gambit tells you whether you can recover from it. 

Holm Security for Microsoft Sentinel 

Holm Security for Microsoft Sentinel brings asset data from the Holm Security platform into Sentinel via the Holm Security REST API. The connector ingests web and network assets into Microsoft Sentinel, including metadata such as IP addresses, hostnames, operating systems, tags, and vulnerability counts per asset. By incorporating this asset inventory alongside other security telemetry, the integration enables security teams to build dashboards, create custom alerts, and correlate asset information with other data in Microsoft Sentinel. 

Idira Endpoint Privilege Manager for Microsoft Sentinel 

The Idira® Endpoint Privilege Manager by Palo Alto Networks integration for Microsoft Sentinel pulls application events and policy audit activity into Microsoft Sentinel using the Codeless Connector Framework and the Idira Endpoint Privilege Manager REST API. Events land in a dedicated Log Analytics table, so security teams can analyze privilege activity alongside their other telemetry and build detections. 

IPinfo: IP geolocation & intelligence database

IPinfo: IP geolocation & intelligence database brings contextual IP intelligence into Microsoft Sentinel to enrich security logs and investigations. The solution provides data such as IP geolocation, network ownership and routing, proxy and residential proxy detection, ASN information, and other IP classifications. By adding this context to IP addresses observed in Sentinel, the integration helps security teams better understand indicators of compromise, prioritize security events, strengthen threat detection and investigation, and inform network and access management decisions. 

Island Solution for Microsoft Sentinel

Island Solution for Microsoft Sentinel brings user activity and administrative audit events from the Island Enterprise Browser into Microsoft Sentinel for centralized security monitoring. The solution automatically shares events from the Island Management Console with Sentinel and includes data connectors and workbooks for user activity and admin audit logs. By adding browser activity context to existing security telemetry, the integration helps security teams monitor and analyze user and administrative activity and investigate potential security issues.

NetApp Ransomware Resilience for Microsoft Sentinel

NetApp Ransomware Resilience detects and contains ransomware attacks on NetApp ONTAP workloads in real time, then enables fast, clean recovery. Its Microsoft Sentinel integration enriches alerts with data-layer context, including attack type, severity, user and IP, and affected cluster, volume, and SVM. The NetApp SOAR playbook can take actions on ONTAP such as trigger immutable snapshots, block suspicious users or IPs, and take compromised volumes offline. Together, these integrations extend the NetApp Platform’s ability to help security teams triage and respond to ransomware attacks, limit data loss, protect recovery points, and coordinate response across storage and security teams. 

NordStellar for Microsoft Sentinel

NordLayer Intelligence by NordStellar for Microsoft Sentinel brings external threat and exposure findings into Sentinel through the Azure Monitor Logs Ingestion API. The integration provides findings including leaked credentials, breach exposures, malware and info-stealer infections, dark web activity, domain impersonation risks, and external attack surface vulnerabilities. By correlating these findings with other security telemetry in Sentinel, the solution helps teams investigate external threats, identify exposures affecting their organization, and automate triage and response through analytics rules and SOAR playbooks.

Panorays for Microsoft Sentinel

Panorays for Microsoft Sentinel brings third-party security findings from the Panorays platform into Sentinel through the Panorays API. The connector provides security teams with visibility into the security posture of vendors and supply-chain organizations, making third-party risk and vulnerability findings available alongside other security telemetry. By incorporating Panorays findings into Sentinel workflows, the integration helps SOC teams centrally monitor and investigate third-party risks and correlate them with internal security signals.

USTA IoC Threat Stream for Sentinel

USTA IoC Threat Stream for Sentinel brings curated indicators of compromise (IoCs) from the PRODAFT USTA Threat Stream into Microsoft Sentinel Threat Intelligence. The integration provides indicators including malicious URLs, phishing sites, and malware hashes derived from PRODAFT investigations. By making these indicators available for correlation with existing telemetry, hunting queries, and detection rules, the solution helps security teams identify connections to malicious infrastructure, investigate phishing and malware activity, and incorporate external threat intelligence into existing triage and response workflows.

USTA Payment Card Fraud Intelligence Sentinel Connector

USTA Payment Card Fraud Intelligence Sentinel Connector brings compromised payment card intelligence from the PRODAFT USTA Threat Intelligence platform into Microsoft Sentinel. The connector retrieves alerts associated with an organization’s payment card BIN ranges and makes them available within Sentinel for investigation. Included analytics identify newly exposed and non-expired compromised cards, helping security teams centralize payment fraud intelligence, prioritize potentially actionable exposures, and incorporate them into existing investigation and response workflows.

Pulumi Cloud Audit Logs for Microsoft Sentinel 

Pulumi Cloud Audit Logs for Microsoft Sentinel brings audit logs from Pulumi, the infrastructure platform for humans and agents, into Microsoft Sentinel through the Codeless Connector Framework (CCF). The connector ingests authentication events, organization membership changes, stack lifecycle operations, policy changes, and access token usage. It also includes three analytics rules that detect failed login attempts, stack deletions, and organization membership changes. Your security team can see what a human or agent did, when, and where across infrastructure as code, secrets, configuration, and policies, which helps speed up security and governance investigations.  

QCrypton PQC Scanner for Microsoft Sentinel 

QCrypton PQC Scanner for Microsoft Sentinel brings post-quantum cryptography readiness findings from Azure environments into Sentinel using the Codeless Connector Framework (CCF). The connector provides visibility into cryptographic assets including Key Vault keys, TLS certificates and configurations, and Entra ID app registration certificates, with quantum posture ratings and risk scores. Included are six analytics rules, a workbook, and a notification playbook to help security teams identify vulnerable cryptographic assets and prioritize post-quantum migration planning. 

SAP LogServ (RISE), S/4HANA Cloud private edition

SAP LogServ (RISE), S/4HANA Cloud private edition extends Microsoft Sentinel security monitoring for SAP RISE environments with infrastructure, database, operating system, and network security logs managed by SAP Enterprise Cloud Services. Deployed alongside the Microsoft Sentinel Solution for SAP applications, it complements application-layer monitoring to provide visibility across the SAP stack and enable cross-layer threat detection and correlation. The solution supports near real-time log collection, built-in analytics and workbooks, ASIM-based security content, and correlation with signals from endpoints, Microsoft Entra ID, and other sources in Microsoft Sentinel.   

MailRisk data connector for Microsoft Sentinel

MailRisk data connector for Microsoft Sentinel brings suspicious email data analyzed by users through Secure Practice MailRisk into Sentinel. The connector ingests enriched email metadata and risk assessment updates from the Secure Practice API, providing potential indicators of compromise identified from reported emails. By incorporating MailRisk data alongside other security telemetry, the integration helps security teams correlate suspicious email activity, search and investigate potential threats, and incorporate user-reported email intelligence into alerting and incident response workflows. 

SecurityScorecard Ratings for Microsoft Sentinel 

SecurityScorecard Ratings for Microsoft Sentinel provides cybersecurity posture ratings based on continuously monitored risk factors and threat intelligence. SecurityScorecard evaluates organizations using an A-F rating, helping security teams identify and track cybersecurity risks. The solution supports use cases including enterprise cyber risk management, third-party risk monitoring, executive reporting, and cyber due diligence. 

SIGNL4 - Mobile Alerting & Response for Microsoft Sentinel and Defender for Cloud

SIGNL4 bridges the gap between security detection and human response with mobile-first alerting and incident management for Microsoft Sentinel and Defender for Cloud. Its two-way integrations allow security teams to acknowledge, escalate, and resolve incidents directly from their mobile devices, with updates automatically synchronized back to Sentinel. Critical Defender for Cloud findings trigger actionable response workflows, while persistent mobile notifications, automated escalations, and on-call scheduling ensure the right people are reached when it matters most. The result is faster incident response, clear accountability, and a fully auditable process - wherever responders are.

SOC Prime Audit CCP

SOC Prime Audit CCP brings SOC Prime Platform audit logs into Microsoft Sentinel for centralized security monitoring and analysis. The connector ingests platform activity including user actions, API calls, and administrative events, providing an audit trail across detection engineering processes. By correlating SOC Prime activity with other security signals in Sentinel, the integration helps security teams investigate platform activity, support compliance monitoring, and incorporate audit telemetry into broader threat detection and response workflows. 

SOCRadar Alerts Azure Sentinel Directional Solution

SOCRadar Threat Intelligence for Microsoft Sentinel enriches security operations by bringing prioritized, context-rich alerts directly into Microsoft Sentinel. Covering SOCRadar’s Extended Threat Intelligence capabilities, including Brand Protection, External Attack Surface Management (ASM), Third-Party Findings, and other security modules, the integration helps organizations monitor external threats and manage investigations within their existing SOC workflows. Bidirectional synchronization also helps keep incident status, severity, and comments aligned between Microsoft Sentinel and SOCRadar.

SpyCloud Enterprise Protection for Microsoft Sentinel  

SpyCloud Enterprise Protection for Microsoft Sentinel brings stolen identity data from infostealer malware, phishing attacks, and third-party breaches into Microsoft Sentinel, helping security teams uncover compromised identities, prioritize high-risk exposures, and accelerate remediation to prevent session hijacking and other targeted identity-based attacks. The solution includes a custom API connector, a Logic Apps playbook for ingesting data into Log Analytics, analytic rules that generate Sentinel incidents from breach and malware data, and additional Logic Apps playbooks for incident automation and enrichment. 

Tenable App for Microsoft Sentinel

Tenable App for Microsoft Sentinel brings asset and vulnerability data from Tenable One Vulnerability Management into Sentinel for centralized security analysis. The integration combines Tenable cyber exposure insights with Sentinel’s collection, detection, and investigation capabilities, making vulnerability context available alongside other security telemetry. By incorporating asset and vulnerability findings into Sentinel workflows, the solution helps security teams correlate exposure data with security signals, investigate risks affecting vulnerable assets, and better prioritize remediation efforts.

Uniqkey Security Events for Microsoft Sentinel

Uniqkey Security Events for Microsoft Sentinel brings authentication, credential access and management, sharing, administrative activity, and platform threat detections into Microsoft Sentinel using the Codeless Connector Framework (CCF). Included analytics rules identify scenarios such as sign-ins from unfamiliar IP addresses, excessive credential access, data exports, and security policy or privilege changes. A workbook visualizes activity and threat detections, helping security teams monitor password-management activity, investigate potential credential risks, and correlate findings with broader security telemetry. 

Utimaco Enterprise Secure Key Manager

Utimaco Enterprise Secure Key Manager (ESKM) integrates with Microsoft Sentinel to provide centralized security monitoring and visibility into cryptographic key management activities through KMIP server logs. The solution enables organizations to monitor key operations, KMIP client activity, and authentication events, helping security teams identify suspicious behavior and investigate potential threats. Built-in analytics rules help detect brute-force authentication attempts, repeated permission-denied events, and key-destruction activity, while hunting queries and a dedicated workbook support deeper investigation of unusual users, source IPs, key retrieval patterns, and after-hours activity. 

valimail-sentinel-enforce

Valimail enables organizations to see who sends email using your domain, protects against domain impersonation, and displays a verified logo in inboxes to increase brand trust. Our Microsoft Sentinel Connector brings Valimail Enforce event data directly into Sentinel, allowing security teams to incorporate our telemetry into unified SIEM workflows, monitor authentication and enforcement trends in real time, and build custom alerts and visualizations based on DMARC events. Once configured, Sentinel continuously ingests Valimail event logs, enriching your broader security intelligence and helping to improve your ability to detect and respond to threats across your environment. 

Varonis for Sentinel Solutions

Varonis for Sentinel Solutions brings enriched, data-centric Varonis alerts into Microsoft Sentinel for triage, investigation, and remediation. Varonis insights are contextualized alongside other security events to provide a unified view of data risk. This allows security teams to view and close Varonis alerts directly within Sentinel, reducing the need to switch interfaces and supporting incident resolution with less manual effort

Whisper for Sentinel

Whisper for Sentinel enriches Microsoft Sentinel incidents and alerts with threat and infrastructure intelligence for IPs, domains, ASNs, and networks. The solution provides threat scores, supporting evidence, infrastructure relationships, and historical context directly within Sentinel. Included enrichment playbooks, analytics rules, hunting queries, and workbooks support investigation of threats including C2 communications, malicious infrastructure, suspicious domains, and BGP anomalies, while retained enrichment data can be queried and correlated with existing logs.

WhoisFreaks Threat Intelligence for Microsoft Sentinel  

The WhoisFreaks solution for Microsoft Sentinel brings domain threat intelligence and newly registered domain (NRD) data into Sentinel using the Codeless Connector Framework (CCF). Customers can connect malware, phishing, and spam threat feeds, along with gTLD and ccTLD NRD feeds with or without WHOIS data. Included analytics rule templates help identify high-confidence malicious domains, newly registered domains appearing in threat feeds, threat-listed parked domains, and unusual NRD volumes that may indicate bulk registration activity.