Microsoft Ignite 2026: New Sentinel Connectors Announcement
Microsoft Sentinel helps organizations detect, investigate, and respond to threats across increasingly complex environments. As AI transforms security operations, bringing together the right data and context is more important than ever, giving human defenders and AI agents a more complete view of the environment to reason over and act on. These integrations bring signals from Microsoft and third-party technologies together across the security environment, unlocking richer context for investigations and helping power the new Integrated Security Operations Center (ISOC) in Microsoft Defender, where human defenders and AI agents can reason across the environment with shared context. The connector ecosystem isn’t the only area seeing rapid growth. Microsoft Sentinel continues to add new capabilities, including Nested API support, Azure Blob support, and multi-account support, while AI-powered tools like the connector builder agent are making it easier than ever for developers to build integrations and bring more of their security data into Sentinel. At the same time, Unified Data Management, now in public preview, makes it easier for customers to manage their Microsoft Sentinel data, connectors, tables, and ingestion health in one place. For Microsoft Ignite 2026, we’re excited to showcase recent additions to this growing ecosystem and the partners making them possible. These new and enhanced connectors continue to broaden the security data available to customers, helping human defenders and AI agents gain the context they need across the technology estate. Airlock Digital for Microsoft Sentinel Airlock Digital helps prevent malware, ransomware, and unauthorized software with deny by default application control, allowing only trusted applications, scripts, and processes to run. Its Microsoft Sentinel push integration ingests execution history, browser extension control events, server administrative activity, and policy changes for monitoring and investigation. Included parsers map execution and audit events to Microsoft’s ASIM for analysis alongside other security signals. A customizable workbook supports investigation and monitoring, and teams can create analytics rules using the ingested data. NC Protect Data Connector for Microsoft Sentinel NC Protect Data Connector for Microsoft Sentinel from archTIS brings user activity and protection logs from NC Protect into Sentinel for centralized security analysis. The connector captures user activities and access-related events, while built-in workbooks support investigation and visualization of user behavior. By correlating NC Protect audit data with other security telemetry, the integration helps teams identify suspicious user activity, trigger alerts and response workflows, strengthen auditing, and monitor guest activity across SharePoint and Teams. blacklens.io for Microsoft Sentinel blacklens.io for Microsoft Sentinel brings external and internal attack-surface data, risk-prioritized vulnerabilities, darknet intelligence, and supply-chain risks into Microsoft Sentinel. The connector ingests exposed assets, compromised identities, stolen credentials and session cookies, typosquatting domains, and supplier activity on ransomware leak sites. The solution includes a data connector and analytics rule for creating Sentinel incidents, with configurable notification rules for alert severity and type. Findings are available in Log Analytics for correlation with existing Sentinel signals and can support custom analytics rules, workbooks, automation, and threat investigations. BloodHound Enterprise BloodHound Enterprise (BHE) helps organizations protect critical assets across modern hybrid environments by continuously uncovering identity attack paths and providing actionable remediation guidance. By integrating with Microsoft Sentinel, BHE delivers attack path data and identity security posture insights directly into Sentinel workflows. This helps security teams prioritize remediation efforts based on exposure to critical assets while enriching investigations into identity-based threats, including lateral movement and privilege escalation. Together, BHE and Microsoft Sentinel help security teams connect threat detection to underlying identity risk, speed investigations, and reduce opportunities for attackers. BlueVoyant Anthropic Claude Compliance BlueVoyant Anthropic Claude Compliance brings compliance activity from the Anthropic Claude Compliance API into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector ingests Claude compliance events into Sentinel, giving security, risk, and audit teams centralized visibility into AI usage and related activity. By correlating these compliance signals with identity, endpoint, and other security telemetry, the integration supports threat hunting, investigation of policy violations and anomalous behavior, compliance monitoring, and repeatable audit workflows. Cato Networks for Microsoft Sentinel Cato Networks for Microsoft Sentinel brings security and network events from the Cato SASE Platform into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. The connector pushes events into a dedicated Log Analytics table, making Cato activity available alongside other Sentinel data. By centralizing this telemetry in Sentinel, the integration enables security teams to incorporate Cato events into threat hunting, detection, and visualization workflows alongside broader security signals. Check Point EM ThreatCloud Intelligence Feed Connector for Microsoft Sentinel The Check Point EM ThreatCloud Intelligence Feed Connector brings threat intelligence from Check Point Exposure Management into Microsoft Sentinel. The connector ingests indicators of compromise (IoCs), including malicious IP addresses, domains, URLs, and file hashes, enriched with threat context such as confidence, severity, kill-chain stage, and campaign associations. An included playbook further enriches incident IoCs through ThreatCloud, helping security teams correlate intelligence with existing telemetry, accelerate triage and investigation, and reduce the manual effort required to maintain threat intelligence. Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel brings threat intelligence from Check Point Infinity External Risk Management into Sentinel. The connector ingests malicious IP addresses, domains, URLs, and file hashes, enriched with context such as severity, confidence, and detected activity. By correlating these indicators of compromise (IoCs) with existing logs through analytics rules, hunting queries, and watchlists, the integration helps security teams reduce manual intelligence management, identify matches with external threats, and accelerate threat detection and investigation. Citrix SPA Sentinel App Citrix SPA Sentinel App brings Citrix Secure Private Access and Device Posture service events into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector imports critical logs, policy outcomes, and user activity data, giving security teams greater visibility into application access and device posture activity. An included workbook supports visualization and analysis of Citrix data, helping SOC teams correlate activity with broader security telemetry, investigate security risks, support compliance monitoring, and strengthen threat hunting across their environment. ContraForce Events for Microsoft Sentinel ContraForce Events for Microsoft Sentinel brings security delivery and administrative activity from ContraForce workspaces into Microsoft Sentinel using the Codeless Connector Framework (CCF). ContraForce is an Agentic Security Delivery Platform for service providers and security teams running triage, investigation, and response across Microsoft Defender XDR and Sentinel. The connector ingests incidents, privileged access changes, service account credential activity, and high-impact workspace actions. Three included analytics rules detect privileged access, credential, and high-impact workspace activity, helping teams monitor and investigate the platform supporting their security operations. Corelight for Microsoft Sentinel By transforming all network traffic into rich, comprehensive evidence, Corelight gives security teams using Microsoft Sentinel the visibility to understand exactly what is happening across their enterprise networks. In addition to native integration with Microsoft Sentinel, Corelight integrates with Microsoft Defender for Endpoint, Defender Vulnerability Management, and Entra ID to streamline investigations, accelerate responses, and remediate incidents quickly and easily. The Corelight App for Microsoft Sentinel includes intuitive dashboards, pre-defined workbooks , sample queries, and analytics rules that help make SOC teams more efficient and effective. CTM360 CTM360 brings external threat visibility into Microsoft Sentinel. The integration connects the CTM360 HackerView and CyberBlindspot platforms to Sentinel through REST APIs, so external attack surface and digital risk events flow straight into security operations workflows. HackerView surfaces externally exposed assets and security issues across your attack surface. CyberBlindspot adds organization-specific threat intelligence from surface, deep, and dark web monitoring. With these signals centralized in Sentinel, security teams can analyze external exposures alongside their broader telemetry and speed up detection, investigation, and response. Cyren CrowdStrike IOC Automation Cyren CrowdStrike IOC Automation connects Cyren IP reputation threat intelligence with Microsoft Sentinel and CrowdStrike Falcon to operationalize malicious IP indicators. An included Logic App playbook automatically retrieves known malicious IP addresses from Cyren and submits them to CrowdStrike Falcon as custom indicators of compromise (IOCs) for blocking and detection. Scheduled execution keeps the intelligence updated and automates the flow of Cyren IP reputation data into CrowdStrike Falcon for blocking and detection. Vaikora AI Agent Signals for Microsoft Sentinel Vaikora AI Agent Signals for Microsoft Sentinel brings behavioral security signals from AI agents into Sentinel for centralized monitoring and response. The connector ingests risk scores, anomaly and threat classifications, policy enforcement decisions, and audit data, including signals for prompt injection attempts and suspicious tool usage. Included analytics rules and a workbook help security teams detect behavioral anomalies, investigate policy violations, and incorporate AI agent risks into existing Sentinel incident workflows. Vaikora AI Agent Signals for SentinelOne Vaikora AI Agent Signals for SentinelOne brings high-risk behavioral security signals from Vaikora into SentinelOne as threat intelligence indicators of compromise (IOCs). The integration filters high-severity and anomalous AI agent activity and maps Vaikora risk scores to SentinelOne severity levels. The resulting IOCs are submitted to SentinelOne and expire after 90 days, enabling Vaikora security signals to be incorporated into SentinelOne endpoint protection workflows. DataBahn Agentic Data Control Plane for Microsoft Sentinel DataBahn’s agentic data control plane integrates with Microsoft Sentinel to provide our shared customers an AI-native data pipeline and orchestration platform that allows them to accelerate enterprise deployments. DataBahn’s pipeline standardizes onboarding and shaping across all data sources while providing operational visibility into data flow and health. Together, the collaboration focuses on reducing onboarding friction, improving normalization consistency, and enabling intentional routing, which helps security teams improve visibility, support threat detection, and streamline investigation and incident response workflows. Delinea Platform for Microsoft Sentinel Delinea Platform Sentinel Solution brings privileged access activity into Sentinel natively through the Content Hub, as a complete SOC package. The connector pulls audit events covering secrets access, authentication, session activity and configuration changes directly into Sentinel. Ready-made workbooks, analytics rules with baseline-driven detection, hunting queries and an automated response playbook let security teams detect bulk secret access, failed sign-in bursts and privilege escalation sooner, investigate without leaving Sentinel and answer auditors with a record of what happened and why it was allowed. Dynatrace Software Intelligence Platform with Microsoft Sentinel Dynatrace integrates bidirectionally with Microsoft Sentinel, bringing application attacks, runtime vulnerabilities, Dynatrace Intelligence problems, and audit logs into Sentinel, where analytics rules, workbooks, and playbooks support detection, triage, and response. Sentinel can also send alerts to Dynatrace and enrich detected attacks with Sentinel and Microsoft Defender XDR insights. Bindplane by Dynatrace complements the integration by collecting and routing logs into Sentinel, including normalization to ASIM tables, giving SOC teams runtime and topology context for investigations. ExtraHop RevealX for Microsoft Sentinel ExtraHop RevealX for Microsoft Sentinel brings network detection and response (NDR) into Sentinel, giving your SOC visibility into threats that endpoint and log tools miss, including lateral movement and credential abuse hiding in encrypted east-west traffic. RevealX decrypts and analyzes network traffic at line rate, out of band with no impact on the network. The connector sends ExtraHop detections into Sentinel for dashboards, custom alerts, and investigation, so network context enriches your existing SOC workflows instead of sitting in a separate console. Fire Compass FireCompass Risks for Microsoft Sentinel brings validated external risk findings from the FireCompass platform into Microsoft Sentinel through the Codeless Connector Framework. The connector ingests risk data including severity, affected assets, assessment context, impact, and remediation guidance. By making validated exposures available in Sentinel, security teams can correlate external risks with endpoint and network telemetry, track remediation progress, and build analytics rules, workbooks, and hunting queries on top of FireCompass findings. Gambit Security Sentinel Solution Gambit brings resilience context into Microsoft Sentinel. It finds the resilience issues in your environment and syncs them to your Sentinel workspace daily, to help analysts see recovery risk before anything goes wrong. Sentinel correlates those issues with its detections. Your team can then prioritize the attacks most likely to disrupt critical operations: the ones hitting resources that aren’t ready to recover. Sentinel tells you what’s happening. Gambit tells you whether you can recover from it. Holm Security for Microsoft Sentinel Holm Security for Microsoft Sentinel brings asset data from the Holm Security platform into Sentinel via the Holm Security REST API. The connector ingests web and network assets into Microsoft Sentinel, including metadata such as IP addresses, hostnames, operating systems, tags, and vulnerability counts per asset. By incorporating this asset inventory alongside other security telemetry, the integration enables security teams to build dashboards, create custom alerts, and correlate asset information with other data in Microsoft Sentinel. Idira Endpoint Privilege Manager for Microsoft Sentinel The Idira® Endpoint Privilege Manager by Palo Alto Networks integration for Microsoft Sentinel pulls application events and policy audit activity into Microsoft Sentinel using the Codeless Connector Framework and the Idira Endpoint Privilege Manager REST API. Events land in a dedicated Log Analytics table, so security teams can analyze privilege activity alongside their other telemetry and build detections. IPinfo: IP geolocation & intelligence database IPinfo: IP geolocation & intelligence database brings contextual IP intelligence into Microsoft Sentinel to enrich security logs and investigations. The solution provides data such as IP geolocation, network ownership and routing, proxy and residential proxy detection, ASN information, and other IP classifications. By adding this context to IP addresses observed in Sentinel, the integration helps security teams better understand indicators of compromise, prioritize security events, strengthen threat detection and investigation, and inform network and access management decisions. Island Solution for Microsoft Sentinel Island Solution for Microsoft Sentinel brings user activity and administrative audit events from the Island Enterprise Browser into Microsoft Sentinel for centralized security monitoring. The solution automatically shares events from the Island Management Console with Sentinel and includes data connectors and workbooks for user activity and admin audit logs. By adding browser activity context to existing security telemetry, the integration helps security teams monitor and analyze user and administrative activity and investigate potential security issues. NetApp Ransomware Resilience for Microsoft Sentinel NetApp Ransomware Resilience detects and contains ransomware attacks on NetApp ONTAP workloads in real time, then enables fast, clean recovery. Its Microsoft Sentinel integration enriches alerts with data-layer context, including attack type, severity, user and IP, and affected cluster, volume, and SVM. The NetApp SOAR playbook can take actions on ONTAP such as trigger immutable snapshots, block suspicious users or IPs, and take compromised volumes offline. Together, these integrations extend the NetApp Platform’s ability to help security teams triage and respond to ransomware attacks, limit data loss, protect recovery points, and coordinate response across storage and security teams. NordStellar for Microsoft Sentinel NordLayer Intelligence by NordStellar for Microsoft Sentinel brings external threat and exposure findings into Sentinel through the Azure Monitor Logs Ingestion API. The integration provides findings including leaked credentials, breach exposures, malware and info-stealer infections, dark web activity, domain impersonation risks, and external attack surface vulnerabilities. By correlating these findings with other security telemetry in Sentinel, the solution helps teams investigate external threats, identify exposures affecting their organization, and automate triage and response through analytics rules and SOAR playbooks. Panorays for Microsoft Sentinel Panorays for Microsoft Sentinel brings third-party security findings from the Panorays platform into Sentinel through the Panorays API. The connector provides security teams with visibility into the security posture of vendors and supply-chain organizations, making third-party risk and vulnerability findings available alongside other security telemetry. By incorporating Panorays findings into Sentinel workflows, the integration helps SOC teams centrally monitor and investigate third-party risks and correlate them with internal security signals. USTA Account Takeover Prevention Sentinel Connector USTA Account Takeover Prevention Sentinel Connector brings compromised credential intelligence from the PRODAFT USTA Threat Intelligence platform into Microsoft Sentinel. The connector ingests alerts for exposed corporate credentials, enabling security teams to investigate potential account takeover risks within existing Sentinel workflows. Included analytics can identify newly compromised credentials and successful Microsoft Entra ID sign-ins involving known-compromised accounts, helping SOC teams operationalize external credential intelligence and prioritize investigation and response. USTA IoC Threat Stream for Sentinel USTA IoC Threat Stream for Sentinel brings curated indicators of compromise (IoCs) from the PRODAFT USTA Threat Stream into Microsoft Sentinel Threat Intelligence. The integration provides indicators including malicious URLs, phishing sites, and malware hashes derived from PRODAFT investigations. By making these indicators available for correlation with existing telemetry, hunting queries, and detection rules, the solution helps security teams identify connections to malicious infrastructure, investigate phishing and malware activity, and incorporate external threat intelligence into existing triage and response workflows. USTA Payment Card Fraud Intelligence Sentinel Connector USTA Payment Card Fraud Intelligence Sentinel Connector brings compromised payment card intelligence from the PRODAFT USTA Threat Intelligence platform into Microsoft Sentinel. The connector retrieves alerts associated with an organization’s payment card BIN ranges and makes them available within Sentinel for investigation. Included analytics identify newly exposed and non-expired compromised cards, helping security teams centralize payment fraud intelligence, prioritize potentially actionable exposures, and incorporate them into existing investigation and response workflows. Pulumi Cloud Audit Logs for Microsoft Sentinel Pulumi Cloud Audit Logs for Microsoft Sentinel brings audit logs from Pulumi, the infrastructure platform for humans and agents, into Microsoft Sentinel through the Codeless Connector Framework (CCF). The connector ingests authentication events, organization membership changes, stack lifecycle operations, policy changes, and access token usage. It also includes three analytics rules that detect failed login attempts, stack deletions, and organization membership changes. Your security team can see what a human or agent did, when, and where across infrastructure as code, secrets, configuration, and policies, which helps speed up security and governance investigations. QCrypton PQC Scanner for Microsoft Sentinel QCrypton PQC Scanner for Microsoft Sentinel brings post-quantum cryptography readiness findings from Azure environments into Sentinel using the Codeless Connector Framework (CCF). The connector provides visibility into cryptographic assets including Key Vault keys, TLS certificates and configurations, and Entra ID app registration certificates, with quantum posture ratings and risk scores. Included are six analytics rules, a workbook, and a notification playbook to help security teams identify vulnerable cryptographic assets and prioritize post-quantum migration planning. SailPoint for Microsoft Sentinel SailPoint for Microsoft Sentinel brings identity security telemetry from SailPoint Identity Security Cloud into Sentinel using the Codeless Connector Framework (CCF). The solution streams audit and search events into Sentinel tables, where analysts can correlate identity activity with other security signals and query SailPoint APIs for additional identity and account context during incident triage. Automated playbooks can also remediate threats by revoking access or disabling compromised accounts, helping teams connect identity insight with investigation and response. SAP LogServ (RISE), S/4HANA Cloud private edition SAP LogServ (RISE), S/4HANA Cloud private edition extends Microsoft Sentinel security monitoring for SAP RISE environments with infrastructure, database, operating system, and network security logs managed by SAP Enterprise Cloud Services. Deployed alongside the Microsoft Sentinel Solution for SAP applications, it complements application-layer monitoring to provide visibility across the SAP stack and enable cross-layer threat detection and correlation. The solution supports near real-time log collection, built-in analytics and workbooks, ASIM-based security content, and correlation with signals from endpoints, Microsoft Entra ID, and other sources in Microsoft Sentinel. MailRisk data connector for Microsoft Sentinel MailRisk data connector for Microsoft Sentinel brings suspicious email data analyzed by users through Secure Practice MailRisk into Sentinel. The connector ingests enriched email metadata and risk assessment updates from the Secure Practice API, providing potential indicators of compromise identified from reported emails. By incorporating MailRisk data alongside other security telemetry, the integration helps security teams correlate suspicious email activity, search and investigate potential threats, and incorporate user-reported email intelligence into alerting and incident response workflows. SecurityScorecard Ratings for Microsoft Sentinel SecurityScorecard Ratings for Microsoft Sentinel provides cybersecurity posture ratings based on continuously monitored risk factors and threat intelligence. SecurityScorecard evaluates organizations using an A-F rating, helping security teams identify and track cybersecurity risks. The solution supports use cases including enterprise cyber risk management, third-party risk monitoring, executive reporting, and cyber due diligence. SIGNL4 - Mobile Alerting & Response for Microsoft Sentinel and Defender for Cloud SIGNL4 bridges the gap between security detection and human response with mobile-first alerting and incident management for Microsoft Sentinel and Defender for Cloud. Its two-way integrations allow security teams to acknowledge, escalate, and resolve incidents directly from their mobile devices, with updates automatically synchronized back to Sentinel. Critical Defender for Cloud findings trigger actionable response workflows, while persistent mobile notifications, automated escalations, and on-call scheduling ensure the right people are reached when it matters most. The result is faster incident response, clear accountability, and a fully auditable process - wherever responders are. SOC Prime Audit CCP SOC Prime Audit CCP brings SOC Prime Platform audit logs into Microsoft Sentinel for centralized security monitoring and analysis. The connector ingests platform activity including user actions, API calls, and administrative events, providing an audit trail across detection engineering processes. By correlating SOC Prime activity with other security signals in Sentinel, the integration helps security teams investigate platform activity, support compliance monitoring, and incorporate audit telemetry into broader threat detection and response workflows. SOCRadar Alerts Azure Sentinel Directional Solution SOCRadar Threat Intelligence for Microsoft Sentinel enriches security operations by bringing prioritized, context-rich alerts directly into Microsoft Sentinel. Covering SOCRadar’s Extended Threat Intelligence capabilities, including Brand Protection, External Attack Surface Management (ASM), Third-Party Findings, and other security modules, the integration helps organizations monitor external threats and manage investigations within their existing SOC workflows. Bidirectional synchronization also helps keep incident status, severity, and comments aligned between Microsoft Sentinel and SOCRadar. SpyCloud Enterprise Protection for Microsoft Sentinel SpyCloud Enterprise Protection for Microsoft Sentinel brings stolen identity data from infostealer malware, phishing attacks, and third-party breaches into Microsoft Sentinel, helping security teams uncover compromised identities, prioritize high-risk exposures, and accelerate remediation to prevent session hijacking and other targeted identity-based attacks. The solution includes a custom API connector, a Logic Apps playbook for ingesting data into Log Analytics, analytic rules that generate Sentinel incidents from breach and malware data, and additional Logic Apps playbooks for incident automation and enrichment. Tenable App for Microsoft Sentinel Tenable App for Microsoft Sentinel brings asset and vulnerability data from Tenable One Vulnerability Management into Sentinel for centralized security analysis. The integration combines Tenable cyber exposure insights with Sentinel’s collection, detection, and investigation capabilities, making vulnerability context available alongside other security telemetry. By incorporating asset and vulnerability findings into Sentinel workflows, the solution helps security teams correlate exposure data with security signals, investigate risks affecting vulnerable assets, and better prioritize remediation efforts. Uniqkey Security Events for Microsoft Sentinel Uniqkey Security Events for Microsoft Sentinel brings authentication, credential access and management, sharing, administrative activity, and platform threat detections into Microsoft Sentinel using the Codeless Connector Framework (CCF). Included analytics rules identify scenarios such as sign-ins from unfamiliar IP addresses, excessive credential access, data exports, and security policy or privilege changes. A workbook visualizes activity and threat detections, helping security teams monitor password-management activity, investigate potential credential risks, and correlate findings with broader security telemetry. Utimaco Enterprise Secure Key Manager Utimaco Enterprise Secure Key Manager (ESKM) integrates with Microsoft Sentinel to provide centralized security monitoring and visibility into cryptographic key management activities through KMIP server logs. The solution enables organizations to monitor key operations, KMIP client activity, and authentication events, helping security teams identify suspicious behavior and investigate potential threats. Built-in analytics rules help detect brute-force authentication attempts, repeated permission-denied events, and key-destruction activity, while hunting queries and a dedicated workbook support deeper investigation of unusual users, source IPs, key retrieval patterns, and after-hours activity. valimail-sentinel-enforce Valimail enables organizations to see who sends email using your domain, protects against domain impersonation, and displays a verified logo in inboxes to increase brand trust. Our Microsoft Sentinel Connector brings Valimail Enforce event data directly into Sentinel, allowing security teams to incorporate our telemetry into unified SIEM workflows, monitor authentication and enforcement trends in real time, and build custom alerts and visualizations based on DMARC events. Once configured, Sentinel continuously ingests Valimail event logs, enriching your broader security intelligence and helping to improve your ability to detect and respond to threats across your environment. Varonis for Sentinel Solutions Varonis for Sentinel Solutions brings enriched, data-centric Varonis alerts into Microsoft Sentinel for triage, investigation, and remediation. Varonis insights are contextualized alongside other security events to provide a unified view of data risk. This allows security teams to view and close Varonis alerts directly within Sentinel, reducing the need to switch interfaces and supporting incident resolution with less manual effort Whisper for Sentinel Whisper for Sentinel enriches Microsoft Sentinel incidents and alerts with threat and infrastructure intelligence for IPs, domains, ASNs, and networks. The solution provides threat scores, supporting evidence, infrastructure relationships, and historical context directly within Sentinel. Included enrichment playbooks, analytics rules, hunting queries, and workbooks support investigation of threats including C2 communications, malicious infrastructure, suspicious domains, and BGP anomalies, while retained enrichment data can be queried and correlated with existing logs. WhoisFreaks Threat Intelligence for Microsoft Sentinel The WhoisFreaks solution for Microsoft Sentinel brings domain threat intelligence and newly registered domain (NRD) data into Sentinel using the Codeless Connector Framework (CCF). Customers can connect malware, phishing, and spam threat feeds, along with gTLD and ccTLD NRD feeds with or without WHOIS data. Included analytics rule templates help identify high-confidence malicious domains, newly registered domains appearing in threat feeds, threat-listed parked domains, and unusual NRD volumes that may indicate bulk registration activity. Wiz for Microsoft Sentinel Wiz for Microsoft Sentinel brings Wiz Issues, Vulnerability Findings, and Audit logs into Microsoft Sentinel. Wiz identifies and prioritizes cloud security risks across areas including vulnerabilities, malware, internet exposure, identity, and data security in AWS, Azure, Google Cloud, OCI, Alibaba, and Kubernetes environments. In addition to the solutions from our third-party partners, we are also excited to announce the following connectors published by the Microsoft Sentinel team: Agari Solution Akamai DDOS Protection Alibaba Cloud Networking Atlassian Organization Audit AWS Elastic Kubernetes Service AWS Elastic Load Balancing Cisco Cloud Security Cisco Meraki Events via REST API Crowdstrike Falcon Endpoint Protection Elastic Agent Solution Imperva WAF Cloud Solution Microsoft Copilot Microsoft Dragon Copilot Mulesoft CloudHub Alerts OpenAI Qualys VM Knowledgebase Rapid7 InsightVM CloudAPI SentinelOne TheHive Solution Trellix Enpoint Security Trend Micro Cloud App Security VMware Workspace ONE Zoom Reports Building a more connected foundation for security operations The strength of the connector ecosystem reflects the work of Microsoft and our technology partners to support our shared customers. Together, we are helping organizations connect the technologies they rely on and bring more of their security data into a unified operational experience. For customers If you are a Microsoft Sentinel or ISOC customer, or considering adopting it, we want you to have the security connectors and integrations you need to get value from the platform. If an integration with an independent software vendor (ISV) is not yet available, or you have an issue with an existing solution, we have a dedicated team that may be able to assist by working with ISVs to build new or update existing connectors. For software companies If you are a software development partner, the Microsoft Sentinel Codeless Connector Framework (CCF) provides a streamlined way to bring your product into the Microsoft Security ecosystem. Partners can also work directly with Microsoft for engineering guidance and support to build or improve a connector. Building a more connected foundation for security operations Our goal is simple: help customers protect their digital environments by giving human defenders and AI agents a more complete picture of risk. We’ll continue investing in connectors, partnerships, and integrated security experiences to help customers defend their organizations with greater visibility, context, and confidence. Learn More Microsoft Sentinel What is Microsoft Sentinel Empower Real-Time Security with Microsoft Sentinel’s CCF Push Feature | Microsoft Community Hub Growing our connector ecosystem with 500+ Microsoft Sentinel connectors Microsoft Defender ISOC in Microsoft Defender Microsoft Sentinel connector hands-on labs Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent Building a CCF Nested API Pull Connector: A Technical Lab Walkthrough Microsoft Sentinel features in public preview Accelerate connectors development using AI agent in Microsoft Sentinel | Microsoft Community Hub Extending Sentinel Data Integration: Azure Blob Storage Support for CCF Connectors | Microsoft Community Hub Public Preview: Nested API Support Comes to Microsoft Sentinel CCF | Microsoft Community Hub Public Preview: Multi-Account Support for Microsoft Sentinel Codeless Connectors | Microsoft Community Hub Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview) | Microsoft Community HubRSAC 2026: New Microsoft Sentinel Connectors Announcement
Microsoft Sentinel helps organizations detect, investigate, and respond to security threats across increasingly complex environments. With the rollout of the Microsoft Sentinel data lake in the fall, and the App Assure-backed Sentinel promise that supports it, customers now have access to long-term, cost-effective storage for security telemetry, creating a solid foundation for emerging Agentic AI experiences. Since our last announcement at Ignite 2025, the Microsoft Sentinel connector ecosystem has expanded rapidly, reflecting continued investment from software development partners building for our shared customers. These connectors bring diverse security signals together, enabling correlation at scale and delivering richer investigation context across the Sentinel platform. Below is a snapshot of Microsoft Sentinel connectors newly available or recently enhanced since our last announcement, highlighting the breadth of partner solutions contributing data into, and extending the value of, the Microsoft Sentinel ecosystem. New and notable integrations Acronis Cyber Protect Cloud Acronis Cyber Protect Cloud integrates with Microsoft Sentinel to bring data protection and security telemetry into a centralized SOC view. The connector streams alerts, events, and activity data - spanning backup, endpoint protection, and workload security - into Microsoft Sentinel for correlation with other signals. This integration helps security teams investigate ransomware and data-centric threats more effectively, leverage built-in hunting queries and detection rules, and improve visibility across managed environments without adding operational complexity. Anvilogic Anvilogic integrates with Microsoft Sentinel to help security teams operationalize detection engineering at scale. The connector streams Anvilogic alerts into Microsoft Sentinel, giving SOC analysts centralized visibility into high-fidelity detections and faster context for investigation and triage. By unifying detection workflows, reducing alert noise, and improving prioritization, this integration supports more efficient threat detection and response while helping teams extend coverage across evolving attack techniques. BigID BigID integrates with Microsoft Sentinel to extend data security posture management (DSPM) insights into security operations workflows. The solution brings visibility into sensitive, regulated, and critical data across cloud, SaaS, and on‑premises environments, helping security teams understand where high‑risk data resides and how it may be exposed. By incorporating data‑centric risk context into Sentinel, this integration supports more informed investigation and prioritization, enabling organizations to reduce data‑related risk and align security operations with data protection and compliance objectives. Commvault Cloud Commvault Cloud integrates with Microsoft Sentinel to bring data protection and cyber‑resilience telemetry into security operations workflows. The connector ingests security‑relevant signals from Commvault Cloud—such as backup anomalies, malware and ransomware indicators, and other threat‑related events—into Sentinel, enabling centralized detection, investigation, and automated response. By correlating backup intelligence with broader Sentinel telemetry, this integration helps security teams reduce blind spots, validate the scope of incidents, and improve coordination between security and recovery operations. CyberArk Audit CyberArk Audit integrates with Microsoft Sentinel to centralize visibility into privileged identity and access activity. By streaming detailed audit logs - covering system events, user actions, and administrative activity - into Microsoft Sentinel, security teams can correlate identity-driven risks with broader security telemetry. This integration supports faster investigations, improved monitoring of privileged access, and more effective incident response through automated workflows and enriched context for SOC analysts. Cyera Cyera integrates with Microsoft Sentinel to extend AI-native data security posture management into security operations. The connector brings Cyera’s data context and actionable intelligence across multi-cloud, on-premises, and SaaS environments into Microsoft Sentinel, helping teams understand where sensitive data resides and how it is accessed, exposed, and used. Built on Sentinel’s modern framework, the integration feeds context-rich data risk signals into the Sentinel data lake, enabling more informed threat hunting, automation, and decision-making around data, user, and AI-related risk. TacitRed CrowdStrike IOC Automation Data443 TacitRed CS IOC Automation integrates with Microsoft Sentinel to streamline the operationalization of compromised credential intelligence. The solution uses Sentinel playbooks to automatically push TacitRed indicators of compromise into CrowdStrike via Sentinel playbooks, helping security teams turn identity-based threat intelligence into action. By automating IOC handling and reducing manual effort, this integration supports faster response to credential exposure and strengthens protection against account-driven attacks across the environment. TacitRed SentinelOne IOC Automation Data443 TacitRed SentinelOne IOC Automation integrates with Microsoft Sentinel to help operationalize identity-focused threat intelligence at the endpoint layer. The solution uses Sentinel playbooks to automatically consume TacitRed indicators and push curated indicators into SentinelOne via Sentinel playbooks and API-based enforcement, enabling faster enforcement of high-risk IOCs without manual handling. By automating the flow of compromised credential intelligence from Sentinel into EDR, this integration supports quicker response to identity-driven attacks and improves coordination between threat intelligence and endpoint protection workflows. TacitRed Threat Intelligence Data443 TacitRed Threat Intelligence integrates with Microsoft Sentinel to provide enhanced visibility into identity-based risks, including compromised credentials and high-risk user exposure. The solution ingests curated TacitRed intelligence directly into Sentinel, enriching incidents with context that helps SOC teams identify credential-driven threats earlier in the attack lifecycle. With built-in analytics, workbooks, and hunting queries, this integration supports proactive identity threat detection, faster triage, and more informed response across the SOC. Cyren Threat Intelligence Cyren Threat Intelligence integrates with Microsoft Sentinel to enhance detection of network-based threats using curated IP reputation and malware URL intelligence. The connector ingests Cyren threat feeds into Sentinel using the Codeless Connector Framework (CCF), transforming raw indicators into actionable insights, dashboards, and enriched investigations. By adding context to suspicious traffic and phishing infrastructure, this integration helps SOC teams improve alert accuracy, accelerate triage, and make more confident response decisions across their environments. TacitRed Defender Threat Intelligence Data443 TacitRed Defender Threat Intelligence integrates with Microsoft Sentinel to surface early indicators of credential exposure and identity-driven risk. The solution automatically ingests compromised credential intelligence from TacitRed into Sentinel and can support synchronization of validated indicators with Microsoft Defender Threat Intelligence through Sentinel workflows, helping SOC teams detect account compromise before abuse occurs. By enriching Sentinel incidents with actionable identity context, this integration supports faster triage, proactive remediation, and stronger protection against credential-based attacks. Datawiza Access Proxy (DAP) Datawiza Access Proxy integrates with Microsoft Sentinel to provide centralized visibility into application access and authentication activity. By streaming access and MFA logs from Datawiza into Sentinel, security teams can correlate identity and session-level events with broader security telemetry. This integration supports detection of anomalous access patterns, faster investigation through session traceability, and more effective response using Sentinel automation, helping organizations strengthen Zero Trust controls and meet auditing and compliance requirements. Endace Endace integrates with Microsoft Sentinel to provide deep network visibility by providing always-on, packet-level evidence. The connector enables one-click pivoting from Sentinel alerts directly to recorded packet data captured by EndaceProbes. This helps SOC and NetOps teams reconstruct events and validate threats with confidence. By combining Sentinel’s AI-driven analytics with Endace’s always-on, full-packet capture across on-premises, hybrid, and cloud environments, this integration supports faster investigations, improved forensic accuracy, and more decisive incident response. Feedly Feedly integrates with Microsoft Sentinel to ingest curated threat intelligence directly into security operations workflows. The connector automatically imports Indicators of Compromise (IoCs) from Feedly Team Boards and folders into Sentinel, enriching detections and investigations with context from the original intelligence articles. By bringing analyst‑curated threat intelligence into Sentinel in a structured, automated way, this integration helps security teams stay current on emerging threats and reduce the manual effort required to operationalize external intelligence. Gigamon Gigamon integrates with Microsoft Sentinel through a new connector that provides access to Gigamon Application Metadata Intelligence (AMI), delivering high-fidelity network-derived telemetry with rich application metadata from inspected traffic directly into Sentinel. This added context helps security teams detect suspicious activity, encrypted threats, and lateral movement faster and with greater precision. By enriching analytics without requiring full packet ingestion, organizations can reduce noise, manage SIEM costs, and extend visibility across hybrid cloud infrastructure. Halcyon Halcyon integrates with Microsoft Sentinel to provide purpose-built ransomware detection and automated containment across the Microsoft security ecosystem. The connector surfaces Halcyon ransomware alerts directly within Sentinel, enabling SOC teams to correlate ransomware behavior with Microsoft Defender and broader Microsoft telemetry. By supporting Sentinel analytics and automation workflows, this integration helps organizations detect ransomware earlier, investigate faster using native Sentinel tools, and isolate affected endpoints to prevent lateral spread and reinfection. Illumio The Illumio platform identifies and contains threats across hybrid multi-cloud environments. By integrating AI-driven insights with Microsoft Sentinel and Microsoft Graph, Illumio Insights enables SOC analysts to visualize attack paths, prioritize high-risk activity, and investigate threats with greater precision. Illumio Segmentation secures critical assets, workloads, and devices and then publishes segmentation policy back into Microsoft Sentinel to ensure compliance monitoring. Joe Sandbox Joe Sandbox integrates with Microsoft Sentinel to enrich incidents with dynamic malware and URL analysis. The connector ingests Joe Sandbox threat intelligence and automatically detonates suspicious files and URLs associated with Sentinel incidents, returning behavioral and contextual analysis results directly into investigation workflows. By adding sandbox-driven insights to indicators, alerts, and incident comments, this integration helps SOC teams validate threats faster, reduce false positives, and improve response decisions using deeper visibility into malicious behavior. Keeper Security The Keeper Security integration with Microsoft Sentinel brings advanced password and secrets management telemetry into your SIEM environment. By streaming audit logs and privileged access events from Keeper into Sentinel, security teams gain centralized visibility into credential usage and potential misuse. The connector supports custom queries and automated playbooks, helping organizations accelerate investigations, enforce Zero Trust principles, and strengthen identity security across hybrid environments. Lookout Mobile Threat Defense (MTD) Lookout Mobile Threat Defense integrates with Microsoft Sentinel to extend SOC visibility to mobile endpoints across Android, iOS, and Chrome OS. The connector streams device, threat, and audit telemetry from Lookout into Sentinel, enabling security teams to correlate mobile risk signals such as phishing, malicious apps, and device compromise, with broader enterprise security data. By incorporating mobile threat intelligence into Sentinel analytics, dashboards, and alerts, this integration helps organizations detect mobile driven attacks earlier and strengthen protection for an increasingly mobile workforce. Miro Miro integrates with Microsoft Sentinel to provide centralized visibility into collaboration activity across Miro workspaces. The connector ingests organization-wide audit logs and content activity logs into Sentinel, enabling security teams to monitor authentication events, administrative actions, and content changes alongside other enterprise signals. By bringing Miro collaboration telemetry into Sentinel analytics and dashboards, this integration helps organizations detect suspicious access patterns, support compliance and eDiscovery needs, and maintain stronger oversight of collaborative environments without disrupting productivity. Obsidian Activity Threat The Obsidian Threat and Activity Feed for Microsoft Sentinel delivers deep visibility into SaaS and AI applications, helping security teams detect account compromise and insider threats. By streaming user behavior and configuration data into Sentinel, organizations can correlate application risks with enterprise telemetry for faster investigations. Prebuilt analytics and dashboards enable proactive monitoring, while automated playbooks simplify response workflows, strengthening security posture across critical cloud apps. OneTrust for Purview DSPM OneTrust integrates with Microsoft Sentinel to bring privacy, compliance, and data governance signals into security operations workflows. The connector enriches Sentinel with privacy relevant events and risk indicators from OneTrust, helping organizations detect sensitive data exposure, oversharing, and compliance risks across cloud and non-Microsoft data sources. By unifying privacy intelligence with Sentinel analytics and automation, this integration enables security and privacy teams to respond more quickly to data risk events and support responsible data use and AI-ready governance. Pathlock Pathlock integrates with Microsoft Sentinel to bring SAP-specific threat detection and response signals into centralized security operations. The connector forwards security-relevant SAP events into Sentinel, enabling SOC teams to correlate SAP activity with broader enterprise telemetry and investigate threats using familiar SIEM workflows. By enriching Sentinel with SAP security context and focused detection logic, this integration helps organizations improve visibility into SAP landscapes, reduce noise, and accelerate detection and response for risks affecting critical business systems. Quokka Q-scout Quokka Q-scout integrates with Microsoft Sentinel to centralize mobile application risk intelligence across Microsoft Intune-managed devices. The connector automatically ingests app inventories from Intune, analyzes them using Quokka’s mobile app vetting engines, and streams security, privacy, and compliance risk findings into Sentinel. By surfacing app-level risks through Sentinel analytics and alerts, this integration helps security teams identify malicious or high-risk mobile apps, prioritize remediation, and strengthen mobile security posture without deploying agents or disrupting users. Semperis Lightning Semperis Lightning integrates with Microsoft Sentinel to deliver deep visibility into identity‑centric risk across Active Directory and Microsoft Entra environments. The connector ingests identity security telemetry such as indicators of exposure, Tier 0 assets, and attack path insights into Sentinel, enabling security teams to correlate identity risks with broader security signals. By bringing rich identity context into Sentinel analytics, hunting, and investigations, this integration helps organizations detect, prioritize, and respond to identity‑driven attacks more effectively across hybrid identity infrastructures. Synqly Synqly integrates with Microsoft Sentinel to simplify and scale security integrations through a unified API approach. The connector enables organizations and security vendors to establish a bi‑directional connection with Sentinel without relying on brittle, point‑to‑point integrations. By abstracting common integration challenges such as authentication handling, retries, and schema changes, Synqly helps teams orchestrate security data flows into and out of Sentinel more reliably, supporting faster onboarding of new data sources and more maintainable integrations at scale. Versasec vSEC:CMS Versasec vSEC:CMS integrates with Microsoft Sentinel to provide centralized visibility into credential lifecycle and system health events. The connector securely streams vSEC:CMS and vSEC:CLOUD alerts and status data into Sentinel using the Codeless Connector Framework (CCF), transforming credential management activity into correlation-ready security signals. By bringing smart card, token, and passkey management telemetry into Sentinel, this integration helps security teams monitor authentication infrastructure health, investigate credential-related incidents, and unify identity security operations within their SIEM workflows. VirtualMetric DataStream VirtualMetric DataStream integrates with Microsoft Sentinel to optimize how security telemetry is collected, normalized, and routed across the Microsoft security ecosystem. Acting as a high-performance telemetry pipeline, DataStream intelligently filters and enriches logs, sending high-value security data to Sentinel while routing less-critical data to Sentinel data lake or Azure Blob Storage for cost-effective retention. By reducing noise upstream and standardizing logs to Sentinel ready schemas, this integration helps organizations control ingestion costs, improve detection quality, and streamline threat hunting and compliance workflows. VMRay VMRay integrates with Microsoft Sentinel to enrich SIEM and SOAR workflows with automated sandbox analysis and high-fidelity, behavior-based threat intelligence. The connector enables suspicious files and phishing URLs to be submitted directly from Sentinel to VMRay for dynamic analysis, while validated, high-confidence indicators of compromise (IOCs) are streamed back into Sentinel’s Threat Intelligence repository for correlation and detection. By adding detailed attack-chain visibility and enriched incident context, this integration helps SOC teams reduce investigation time, improve detection accuracy, and strengthen automated response workflows across Sentinel environments. XBOW XBOW integrates with Microsoft Sentinel to bring autonomous penetration testing insights directly into security operations workflows. The connector ingests automated penetration test findings from the XBOW platform into Sentinel, enabling security teams to analyze validated exploit activity alongside alerts, incidents, and other security telemetry. By correlating offensive testing results with Sentinel detections, this integration helps organizations identify monitoring gaps, validate detection coverage, and strengthen defensive controls using real‑world, continuously generated attack evidence. Zero Networks Segment Audit Zero Networks Segment integrates with Microsoft Sentinel to provide visibility into micro-segmentation and access-control activity across the network. The connector can collect audit logs or activities from Zero Networks Segment, enabling security teams to monitor policy changes, administrative actions, and access events related to MFA-based network segmentation. By bringing segmentation audit telemetry into Sentinel, this integration supports compliance monitoring, investigation of suspicious changes, and faster detection of attempts to bypass lateral-movement controls within enterprise environments. Zscaler Internet Access (ZIA) Zscaler Internet Access integrates with Microsoft Sentinel to centralize cloud security telemetry from web and firewall traffic. The connector enables ZIA logs to be ingested into Sentinel, allowing security teams to correlate Zscaler Internet Access signals with other enterprise data for improved threat detection, investigation, and response. By bringing ZIA web, firewall, and security events into Sentinel analytics and hunting workflows, this integration helps organizations gain broader visibility into internet-based threats and strengthen Zero Trust security operations. In addition to these solutions from our third-party partners, we are also excited to announce the following connector published by the Microsoft Sentinel team: GitHub Enterprise Audit Logs Microsoft’s Sentinel Promise For Customers Every connector in the Microsoft Sentinel ecosystem is built to work out of the box. In the unlikely event a customer encounters any issue with a connector, the App Assure team stands ready to assist. For Software Developers Software partners in need of assistance in creating or updating a Sentinel solution can also leverage Microsoft’s Sentinel Promise to support our shared customers. For developers seeking to build agentic experiences utilizing Sentinel data lake, we are excited to announce the launch of our Sentinel Advisory Service to guide developers across their Sentinel journey. Customers and developers alike can reach out to us via our intake form. Learn More Microsoft Sentinel data lake Microsoft Sentinel data lake: Unify signals, cut costs, and power agentic AI Introducing Microsoft Sentinel data lake What is Microsoft Sentinel data lake Unlocking Developer Innovation with Microsoft Sentinel data lake Microsoft Sentinel Codeless Connector Framework (CCF) Create a codeless connector for Microsoft Sentinel Public Preview Announcement: Microsoft Sentinel CCF Push What’s New in Microsoft Sentinel Monthly Blog Microsoft App Assure App Assure home page App Assure services App Assure blog App Assure Request Assistance Form App Assure Sentinel Advisory Services announcement App Assure’s promise: Migrate to Sentinel with confidence App Assure’s Sentinel promise now extends to Microsoft Sentinel data lake Ignite 2025 new Microsoft Sentinel connectors announcement Microsoft Security Microsoft’s Secure Future Initiative Microsoft Unified SecOps Editor's Note - April 7th, 2026: This blog was updated to include connector descriptions for BigID, Commvault, Semperis, and XBOW.
Sentinel incidents API: createdTimeUtc filter missed incidents that showed up later
On one day we saw four incidents created between about 09:30 and 10:45 UTC that were not returned by our polls. Each poll covering their creation times got HTTP 200 with an empty value list (no errors, no throttling). When we ran the identical query later, with the same time window and api-version, all four were returned. Details: - Two of the incidents came from Microsoft Defender XDR (providerName: Microsoft XDR). The other two came from a Sentinel analytics rule. - Normally, incidents show up in our polls within about 3 minutes (median) and never more than 15 minutes, based on a week of our logs. - The Microsoft documentation says Defender XDR incidents "typically appear in the Microsoft Sentinel UI and API within five minutes". Ours took far longer. Questions: Is the Incidents List API with a createdTimeUtc filter eventually consistent? What delay should clients expect, and is there an upper bound? Can an incident appear in the API after its createdTimeUtc has already passed, for example when synced from Defender XDR? Note: Currently we have poll every 5 minutes, with overlapping ~20-minute windows.
Microsoft Sentinel Armis Connector
Hi all, In our environment, we use Armis and collect Armis activity, alert, and device logs in Microsoft Sentinel. For this, we use the Microsoft-released Armis connector from Content Hub. The connector uses an Azure Function app to collect logs from Armis via the REST API. However, the connector uses the legacy HTTP Data Collector API, which Microsoft has deprecated, and support ended in September 2026. My questions: Has Microsoft released a DCR-based or CCF connector for collecting Armis logs? I couldn't find any newly released connector in Content Hub. If an issue occurs on the connector side, is Microsoft support still available, given that Microsoft hasn't released a new connector to migrate to?Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)
As security teams bring in more data from more sources and use it across SIEM and XDR workflows, decisions about connector health, ingestion volume, and cost optimization get harder. Today, we’re announcing the public preview of Unified Data Management for Microsoft Sentinel, available in the new Data & connectors experience in the Microsoft Defender portal, so you can monitor and manage your data from a single place. What Unified Data Management is and why it matters Unified Data Management brings connectors, tables, and ingestion health together. Instead of moving between separate pages, you can see your full data landscape, spot issues, and act on them from one view. It’s designed to help you quickly answer questions like: Which connectors are configured and which need attention? Which tables are receiving data? Are there ingestion spikes, drops, or stale data patterns? Which tables drive the most ingestion volume? What schema, transformations, and retention settings apply to a table? You’ll find it under Setup & configuration > Data & connectors, organized into three tabs: Overview, Connectors, and Tables. Overview: See health at a glance The Overview tab gives you a workspace-level snapshot of ingestion and health, so you can catch data issues before they impact analytics, detections, investigations, or reporting. It surfaces: Ingestion volume: Daily ingestion split by Analytics tier and Data Lake tier for your selected time range. Connectors that need attention: Connectors with credential errors, ingestion failures, or outages, including error type, failure count, and last successful ingestion. Table ingestion fluctuations: Tables with unexpected volume changes, grouped into spikes and drops. Data ingestion volume by table: Your top ingesting tables, ranked by daily volume. Ingestion latency by table: How long it takes for data to become available after it’s generated. Together, these insights help you troubleshoot connector failures, track down cost spikes, validate that new connectors are flowing, and catch unexpected changes in volume. Figure 1: The Overview tab shows daily ingestion volume by tier alongside data health insights, including connectors that need attention and tables with unexpected volume spikes or drops. Connectors: One inventory for unified and classic connectors The Connectors tab puts unified data connectors and Sentinel classic data connectors side by side, so it’s easier to see which data sources are onboarded and how they're connected. From here, you can: View onboarded connectors with their status, provider, content source, and available updates. Switch between unified connectors and Sentinel classic connectors. Search and filter connectors by provider, data type, and status. Open connector details to review configuration and health. Unified connectors reduce duplication by allowing supported data sources to connect once and feed data across Microsoft security products. Sentinel classic connectors continue to support the broad connector ecosystem, including connectors built with the Codeless Connector Framework (CCF). Figure 2: The Connectors tab brings unified and Sentinel classic connectors into a single inventory, with counts for onboarded and connected connectors, available updates, and filters for provider, data type, and status. Tables: Health, schema, transformations, and retention in one place The Tables tab brings Microsoft Sentinel and Microsoft Defender XDR tables together with their health signals, schema, transformations, and retention settings. Key insights now appear right in the grid, so you can compare tables side by side: last data received, average daily ingestion volume, estimated daily ingestion cost, volume anomaly, tier, and retention settings. This makes it easier to spot tables that have gone stale, are growing unexpectedly, or are driving a big share of your ingestion volume. Select any table to open the details panel, which organizes everything about that table into tabs: Details panel tab What it shows Overview Table type, tier, analytics retention, total retention, and other table metadata. Schema Column names, data types, and descriptions, with no KQL query required. Transformations Filter, Split, and Scope Tag transformation rules applied to the table. Retention Analytics retention and total retention settings. Figure 3: The Tables tab opens a details panel for any selected table. The Schema tab is especially useful when you need to understand incoming data, validate table fields, or create transformation logic without first writing schema-discovery queries. Built for everyday data operations in the Microsoft Defender portal Data management touches nearly every part of security operations, from detection and investigation to hunting, retention, and cost optimization. By bringing these tasks into the Microsoft Defender portal, Unified Data Management cuts down on context switching and makes it clearer how connectors, tables, health, transformations, and retention fit together. It’s one more step in Microsoft Sentinel’s investment in a unified security operations experience, where SIEM and XDR data can be managed and used together. Preview availability and prerequisites Unified Data Management is now available in public preview in commercial cloud environments. To experience it, you’ll need: Microsoft Sentinel onboarded to the Microsoft Defender portal. Unified role-based access control (URBAC) enabled in the Microsoft Defender portal. Data (manage) permission in the Data Operations permission group. Workspace permissions equivalent to Log Analytics Contributor, including permissions to write workspace and table settings. Get started Ready to try it? Open the Microsoft Defender portal and go to Setup & configuration > Data & connectors. From there: Start on the Overview tab to check ingestion volume and data health. Use the Connectors tab to view your unified and classic connectors. Explore the Tables tab to review table health, schema, transformations, and retention. For implementation and configuration guidance, see: Manage data in Microsoft Sentinel and Defender Configure data connectors Manage your existing tables and data Monitor the health of your Microsoft Sentinel data connectors Unified connectors overview Microsoft Sentinel data connectors More Microsoft Sentinel data integration news Public Preview: Nested API Support Comes to Microsoft Sentinel CCF Create a pull codeless connector for Microsoft Sentinel Logs Ingestion API in Azure MonitorIntroducing the Microsoft Sentinel ASIM EmailEvent schema
Email remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources. The Microsoft Sentinel Advanced Security Information Model, or ASIM, EmailEvent schema is now available. It provides a common structure for email delivery and inspection events, helping customers and partners create security content that works across supported email data sources. A consistent view of email security activity EmailEvent standardizes the information analysts need to understand what happened to an email and why. It covers: Email delivery and inspection events Sender, source, and recipient information Message subject, size, direction, and delivery location URLs and file attachments SPF, DKIM, and DMARC authentication results Delivery actions such as delivered, blocked, quarantined, or deleted Threat, risk, confidence, tactic, technique, and remediation details Instead of learning a different data model for every product, analysts can query the normalized EmailEvent fields. Parser developers map each source's native data to the same schema. How it works Consider an email that contains a suspicious attachment. The email security product records the sender, recipients, attachment, authentication results, inspection verdict, and final action. A connector collects that event. A parser or Data Collection Rule maps the source fields to EmailEvent. Microsoft Sentinel can then query the normalized record using the same field names used for other supported email sources. This common structure separates security content from the details of a specific product. When another source adds an EmailEvent parser, existing source-independent queries and detections can work with that source without being rewritten around its native field names. Why it matters Simpler analytics: Write queries against one consistent set of email fields. Broader coverage: Apply source-independent security content across normalized email sources. Faster investigations: Compare delivery, authentication, attachment, URL, and threat details without translating different data models. Easier integration: Give connector and parser developers a defined contract for bringing new email telemetry into ASIM. EmailEvent does not replace the rich native data produced by email security products. It provides a consistent security layer that makes that data easier to use together. Build on EmailEvent The EmailEvent release includes the schema definition, source-independent parser framework, filtering parser, deployment templates, and validation support in the Azure-Sentinel repository. The schema version is 1.0.0. Customers can use normalized EmailEvent data to develop hunting queries, analytics rules, workbooks, and investigation experiences. Partners and community contributors can create source-specific parsers that map their email data to the schema. Get started Normalization Email Schema MS Learn Learn about normalization and ASIM Explore the EmailEvent implementation in Azure-Sentinel Deploy ASIM parsers Thank you to the ASIM engineering and partner teams who contributed to the schema, deployment path, validation, and release.
Cloudflare Log ingestion in Sentinel with CCF
Hi all, I built a connector to ingest cloudflare firewall logs using CCF. The reason why I had to build this custom one while the official one was available was because official one uses Logpush which is a service that is available only on Enterprise plan, so if you are on pro or business plan you can not use it. Putting it out here in case anyone wants to try. https://amankhan.net/posts/Cloudflare-CCF-Connector/Integrating Fluent Bit with Microsoft Sentinel
This guide will walk you through the steps required to integrate Fluent Bit with Microsoft Sentinel. Beware that in this article, we assume you already have a Sentinel workspace, a Data Collection Endpoint and a Data Collection Rule, an Entra ID application and finally a Fluent Bit installation. As mentioned above, log ingestion API supports ingestion both in custom tables as built-in tables, like CommonSecurityLog, Syslog, WindowsEvent and more. In case you need to check which tables are supported please the following article: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview#supported-tables Prerequisites: Before beginning the integration process, ensure you have the following: An active Azure subscription with Microsoft Sentinel enabled; Microsoft Entra ID Application taking note of the ClientID, TenantID and Client Secret – create one check this article: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=certificate A Data Collection Endpoint (DCE) – to create a data collection endpoint, please check this article: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-endpoint-overview?tabs=portal A Data Collection Rule (DCR) – fields from the Data Collection Rule need to match exactly to what exists in table columns and also the fields from the log source. To create a DCR please check this article: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-create-edit?tabs=cli Depending on the source, it might require a custom table to be created or an existing table from log analytics workspace; Fluent Bit installed on your server or container – In case you haven’t yet installed Fluent Bit, in the following article you'll find the instructions per type of operating system: https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit High level architecture: Step 1: Setting up Fluent Big configuration file Before we step-in into the configuration, Fluent Bit has innumerous output plugins and one of those is through Log Analytics Ingestion API both to supported Sentinel tables but also for custom tables. You can check more information about it here in Fluent Bit documentation: https://docs.fluentbit.io/manual/pipeline/outputs/azure_logs_ingestion Moving forwarder, in order to configure Fluent Bit to send logs into Sentinel log analytics workspace, please take note of the specific input plugin you are using or intend to use to receive logs and how can you use it to output the logs to Sentinel workspace. For example most of the Fluent Bit plugins allow to set a “tag” key which can be used within the output plugin so that there’s a match in which logs are intended to send. On the other hand, in a scenario where multiple input plugins are used and all are required send logs to Sentinel, then a match of type wildcard "*" could be used as well. Another example, in a scenario where there are multiple input plugins of type “HTTP” and you want to just send a specific one into Sentinel, then the “match” field must be set according to the position of the required input plugin, for example “match http.2”, if the input plugin would the 3 rd in the list of HTTP inputs. If nothing is specified in the "match" field, then it will assume "http.0" by default. For better understanding, here’s an example of how a Fluent Bit config file could look: First, the configuration file is located under the path ”/etc/fluent-bit/fluent-bit.conf” The first part is the definition of all “input plugins”, then follows the “filter plugins” which you can use for example to rename fields from the source to match for what exists within the data collection rule schema and Sentinel table columns and finally there’s the output plugins. Below is a screenshot of a sample config file: INPUT plugins section: In this example we’re going to use the “dummy input” to send sample messages to Sentinel. However, in your scenario you could leverage other’s input plugins within the same config file. After everything is configured in the input section, make sure to complete the “FILTER” section if needed, and then move forward to the output plugin section, screenshot below. OUTPUT plugins section: In this section, we have output plugins to write on a local file based on two tags “dummy.log” and “logger”, an output plugin that prints the outputs in json format and the output plugin responsible for sending data to Microsoft Sentinel. As you can see, this one is matching the “tag” for “dummy.log” where we’ve setup the message “{“Message”:”this is a sample message for testing fluent bit integration to Sentinel”, “Activity”:”fluent bit dummy input plugn”, “DeviceVendor”:”Ubuntu”}. Make sure you insert the correct parameters in the output plugin, in this scenario the "azure_logs_ingestion" plugin. Step 2: Fire Up Fluent Bit When the file is ready to be tested please execute the following: sudo /opt/fluent-bit/bin/fluent-bit -c /etc/fluent-bit/fluent-bit.conf Fluent bit will start initialization all the plugins it has under the config file. Then you’re access token should be retrieved if everything is well setup under the output plugin (app registration details, data collection endpoint URL, data collection rule id, sentinel table and important to make sure the name of the output plugin is actually “azure_logs_ingestion”). In a couple of minutes you should see this data under your Microsoft Sentinel table, either an existing table or a custom table created for the specific log source purpose. Summary Integrating Fluent Bit with Microsoft Sentinel provides a powerful solution for log collection and analysis. By following this guide, hope you can set up a seamless integration that enhances your organization's ability to monitor and respond to security threats, just carefully ensure that all fields processed in Fluent Bit are mapped exactly to the fields in Data Collection Rule and Sentinel table within Log Analytics Workspace. Special thanks to “Bindiya Priyadarshini” that collaborated with me on this blog post. Cheers!Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent
Overview We previously announced the public preview of the Microsoft Sentinel connector builder agent via VS code extension, that helps developers build Microsoft Sentinel codeless connectors faster with low-code and AI-assisted prompts. This post walks through a hands-on lab using a mock Network Log API to demonstrate how the Sentinel connector builder agent simplifies building Codeless Connector Framework (CCF) pull connectors. Instead of manually creating ingestion infrastructure and configuration files, you’ll use a guided, conversational workflow in VS Code to generate connector artifacts, test them against a live API, and deploy them into Microsoft Sentinel. The lab focuses on the end-to-end experience ranging from API setup to validated connector deployment so you can see how quickly a working integration can be produced. For additional guidance beyond this lab, refer to our MS Learn documentation. The Lab Environment This lab is built around a mock Network Log API hosted as an Azure Function App. The purpose of the lab environment is to give us a live API that we can use to build, validate, and test the Sentinel CCF connector builder agent against end to end. The API exposes 50 synthetic network activity records that look and behave like a real product data source, including web traffic, DNS requests, blocked remote access attempts, malware command-and-control blocks, VPN activity, and other common network events. That makes it a useful stand-in for the type of telemetry many teams want to onboard into Microsoft Sentinel. The API is intentionally shaped like the kind of source a customer might expose for telemetry retrieval. It uses API key authentication through the X-API-Key header, returns paginated results through a nextLink model, and provides a predictable response structure that the builder agent can map into a pull connector configuration. The repo contains everything needed for the walkthrough. There is an ARM template to deploy the Function App, reference documentation for the API, and a sample connector package showing the generated polling config, table schema, DCR, and connector definition. The end goal of the lab is straightforward: use the builder agent to generate a CCF pull connector that ingests this API into the custom NetworkLogAPIGetNetworkLogs_CL table in Sentinel. Prerequisites Before starting, make sure you have the following: Azure subscription -- with Contributor access on a resource group (for deploying the Function App) and Microsoft Sentinel Contributor access on a Sentinel-enabled workspace (for deploying the connector) Microsoft Sentinel workspace -- an existing Log Analytics workspace with Sentinel enabled. See Onboard Microsoft Sentinel to a Log Analytics workspace for more information. Azure CLI -- See How to install the Azure CLI for more information. VS Code with the Microsoft Sentinel for Visual Studio Code extension installed. GitHub Copilot -- with access to premium models. The connector builder agent requires Claude Sonnet 4.5 or 4.6, which uses Copilot premium model credits. Lab Repository -- Once the aforementioned prerequisites are met, you can access the lab repository here: Azure-Sentinel/Tools/CCF-Connector-Builder-Agent-Accelerator at master · Azure/Azure-Sentinel Deploying the Mock API The full CLI commands for this section are available in the repo. For a simpler option, you can use GitHub Copilot to handle the deployment. Enter this prompt: Follow the deployment instructions in Sentinel-CCF-Pull-Connector-Builder-Agent-Accelerator/agent-instructions.md. Let’s deploy the Network Log API and build a CCF pull connector. At a high level, the setup is four steps: clone the repo, create a resource group, ensure you have a Sentinel-enabled workspace, and deploy the Function App using the included ARM template. The template takes two parameters: an ApiKey of your choice (the secret the CCF connector will use to authenticate) and your Log Analytics workspace resource ID for Application Insights. Deployment takes about two to three minutes and outputs the FunctionAppName and endpoint URLs you will need later. Once deployed, verify the API is live: curl -s -H "X-API-Key: <your-api-key>" \ "https://<functionappname>.azurewebsites.net/api/GetNetworkLogs?page=1&pageSize=3" </functionappname></your-api-key> You should see a response like this: The API also exposes an /api/RefreshData endpoint that regenerates the 50 sample records with fresh timestamps. This is useful later in the walkthrough when you want to produce new events and trigger an immediate ingestion cycle without waiting for the next polling interval: curl -s -X POST -H "X-API-Key: <your-api-key>" \ "https://<functionappname>.azurewebsites.net/api/RefreshData" </functionappname></your-api-key> Building the Connector with the Sentinel Connector Builder Agent With the Microsoft Sentinel extension installed and GitHub Copilot running in agent mode, open a Copilot chat and enter a single prompt pointing at the API documentation file: That is the entire invocation. The agent takes it from there. It works through a structured seven-step sequence: preparation, polling config, table schema, DCR, connector definition, package validation, and summary. The agent produces four files in a sentinel-connectors/NetworkLogAPI_CCF/ output folder: NetworkLogAPI_PollingConfig.json – This is the API poller configuration. The agent reads the documentation and correctly identifies the GET /api/GetNetworkLogs endpoint, configures API Key authentication via the X-API-Key header, sets up NextPageUrl pagination using $.metadata.nextLink with a $.metadata.hasNextPage stop condition, and wires up the since query parameter for incremental delta pulls using the timestamp field. The RefreshData endpoint is correctly excluded, which the agent recognizes as a maintenance operation, not a security data stream. NetworkLogAPI_Table.json – This is the custom Log Analytics table schema for NetworkLogAPIGetNetworkLogs_CL . All 20 fields from the API response are mapped to the correct column types, with timestamp promoted to TimeGenerated as the standard Sentinel time column. NetworkLogAPI_DCR.json – This is the Data Collection Rule. This defines the stream declaration, the workspace destination, and the KQL transform that maps the raw snake_case API fields ( sourceIp , destinationIp , threatIndicator , etc.) to their PascalCase table columns. NetworkLogAPI_ConnectorDefinition.json – This is the connector UI configuration. This drives what the connector page looks like in Microsoft Sentinel: the title, description, prerequisite instructions, the BaseUrl and ApiKey input fields, sample KQL queries, and the connectivity status logic. The only point where the agent paused for input was to propose a connector description and ask for confirmation before writing it to the file. Everything else such as endpoint selection, auth type, pagination pattern, schema mapping, KQL transform, cross-file consistency was selected autonomously. To put that in perspective: without the agent, a developer building this connector from scratch would need to manually author four JSON files, understand the CCF schema for polling configs, DCRs, and connector definitions, write the KQL transform by hand, and validate that every cross-file reference lines up correctly. The agent compresses that work, typically hours of reading documentation, trial-and-error, and portal debugging, into a single prompt. Testing the Connector Before deploying anything to a Sentinel workspace, the Microsoft Sentinel connector builder agent lets you validate the generated polling config against the live API directly from your editor. Right-click the sentinel-connectors/NetworkLogAPI_CCF folder, select Microsoft Sentinel → Test Connector (Preview), and a Configuration Variables panel opens asking for the two template variables from the polling config: BaseUrl and apiKey . For other API patterns, there may be additional and different inputs. For example, apiKey input could be swapped with clientID and secret if the API supports OAUTH. Enter the Function App base URL and your API key, and the test runner connects immediately. The panel shows a live polling session. Poll #1 returns HTTP 200 with 50 events, and a countdown timer shows when the next poll will fire. Switching to the Events tab displays the ingested records in a tabular view with columns for timestamp , severity , action , bytesIn , bytesOut , category , and the rest of the mapped fields fresh from the API. Additionally, there are tabs for Headers, Payload, and Response, which can be useful for verifying that your pollerconfig.json configuration provides the expected request to your api with a working response. Data Extracted: The Test Connector feature can be used to visualize the response data in a table format to verify that data will land in a Sentinel table based on your configuration. Request from Poller: The Test Connector feature can be used to validate the request and response headers that will go out to the API based on the generated poller configuration. Request Response: The Test Connector feature shows you the live response from the API with respect to the request going to the API based on the poller configuration. This is a meaningful pre-flight check. It confirms that auth is working, the $.data events path resolves correctly, pagination is functional, and the polling interval fires as configured all before a single file is deployed to Azure. The most common connector configuration issues (wrong base URL, incorrect header name, mismatched JSON path) surface here in seconds rather than after a failed deployment and a 20-minute wait for Sentinel to attempt its first ingestion cycle. It is also the fastest way to troubleshoot if something goes wrong after deployment, far quicker than pushing changes to Azure and waiting for the connector to poll again. Deploying and Enabling the Connector With the connector tested and passing, deployment is the same right-click menu: right-click the sentinel-connectors/NetworkLogAPI_CCF folder, select Microsoft Sentinel → Deploy Connector (Preview). If you are not already signed in to Azure, the extension will prompt you to authenticate. The agent will also provide a clickbox in the chat window to invoke a connector deployment. Right Click Deploy Connector: UI Prompt Based Deploy Method: Once signed in, a workspace picker lists all available Log Analytics workspaces across your subscriptions. Select the one with Sentinel enabled and click Deploy. The extension deploys all four files to the workspace in the correct order: table schema first, then DCR, polling config, and connector definition. Once deployed, navigate to your Sentinel workspace via https://security.microsoft.com, go to Data Connectors, and find the Network Log API connector. The connector page shows the description, prerequisite notes, and the two credential fields generated by the agent: API Base URL and API Key. Enter your Function App base URL and API key and click Connect. The status updates to show the connector is connected and the deployment succeeded. Note: Data will appear in the workspace within 5 to 30 minutes depending on the polling interval. Run this query in Log Analytics to confirm ingestion. Note that the agent derives the table name from the vendor name and endpoint, so yours may differ slightly from the example below. Check the agent's summary output or the NetworkLogAPI_Table.json file for the exact name: NetworkLogAPIGetNetworkLogs_CL | sort by TimeGenerated desc | take 10 If you want to generate a fresh batch of events immediately rather than waiting for the next polling cycle, use the RefreshData endpoint to reset the sample records with new timestamps: curl -s -X POST -H "X-API-Key: " \ "https://.azurewebsites.net/api/RefreshData" Next Steps If you want to go further: Try it with your own API. The lab repo includes documentation on adapting the polling config, schema, and KQL transform to a real data source. Review the CCF connector schema documentation to understand the full range of supported configurations: pagination patterns, auth types, incremental pull strategies, and delta filter expressions. Explore the Microsoft Sentinel content hub to see how published connectors are structured and what the certification requirements look like for production submissions. Conclusion Following these steps, you saw how a working Sentinel connector can be generated, tested, and deployed in minutes rather than requiring days of manual configuration and infrastructure setup. If you are an ISV building a Sentinel integration and want hands-on support, Microsoft’s App Assure program is available to help. We partner with ISVs on connector development, validation, and deployment and provide guidance through implementation, testing, and readiness for production. You can get started by reaching out through our intake form. See our other Sentinel connector feature’s hands-on labs Building a CCF Nested API Pull Connector: A Technical Lab WalkthroughSentinel Foundry - MCP Server (Github Community Release)
I’ve been cooking something that a lot of people in SOC have been struggling with — especially on the engineering side of Microsoft Sentinel. Thanks to the Microsoft Security team for shaping the capabilities of Sentinel even better with Sentinel Data Lake & Modern SecOps. Today’s the day I can finally share it. Note: This is not an official Microsoft product, but it is designed to make the Sentinel Build even better (complement) with much more intelligence. 🚀 Sentinel Foundry is now in public preview with 43 tools. (Sentinel Foundry - MCP Server) It’s an MCP server built to act like the brain of a strong Sentinel engineer — helping make building, improving, and operating Sentinel far more practical, faster, and honestly more enjoyable. For a lot of teams, the challenge is not understanding what Sentinel can do. The hard part is the engineering work around it: -> Deciding what data should actually be ingested -> Building a clean, scalable Sentinel foundation -> Writing useful detections instead of noisy ones -> Balancing security value with cost -> Turning ideas into deployable engineering outputs That is exactly why I built Sentinel Foundry to help communities grow stronger. It helps with the real engineering tasks behind Sentinel — from architecture thinking to detection design, deployment planning, ingestion strategy, automation ideas, and many of the workflows outlined in the GitHub project. How does it work? Here’s one of the flagship prompts I ran with it: “Give me a complete security posture report for our workspace. Score each pillar and tell me what to prioritise.” And within seconds, it produced a structured engineering blueprint that would normally take a lot longer to pull together manually. You can see the example prompts here in what it can do: https://github.com/prabhukiranveesam/Sentinel-Foundry#what-can-it-do I want building Sentinel to feel less like repetitive engineering overhead — and more like real security engineering that is fast, creative, and enjoyable. If you work with Sentinel as a SOC L2 analyst, engineer, detection engineer, consultant, or architect, I’d genuinely love for you to try it and tell me what you think. 🔗 Public Preview: https://github.com/prabhukiranveesam/Sentinel-Foundry This is just the start of an AI era — and I’m excited to keep shaping it with more powerful features over the coming days. This is very easy to set up and will be available to all of you at no cost during this month as part of the public preview, and your feedback is extremely valuable to shape this as a powerful solution.
