Microsoft Sentinel

Sentinel Tables Connectors Reference

17 October 2026Doc update+3 / −1 lines

In brief

The table adds entries for SilentPush Feeds, Theom, and Theom via the Codeless Connector Framework, and removes the Red Canary Threat Detection entry.

What Defender admins need to know

Administrators using the connector reference should consult the updated table for the current listed connectors and table names.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

@@ -542,7 +542,6 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | RecordedFutureSandboxResults\_V2\_CL | [Recorded Future - Log Ingestion](/en-us/azure/sentinel/data-connectors-reference#recorded-future---log-ingestion) | Yes | Yes |
 | RecordedFutureThreatMap\_V2\_CL | [Recorded Future - Log Ingestion](/en-us/azure/sentinel/data-connectors-reference#recorded-future---log-ingestion) | Yes | Yes |
 | RecordedFutureThreatMapMalware\_V2\_CL | [Recorded Future - Log Ingestion](/en-us/azure/sentinel/data-connectors-reference#recorded-future---log-ingestion) | Yes | Yes |
-| RedCanaryDetections\_CL | [Red Canary Threat Detection (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#red-canary-threat-detection-via-codeless-connector-framework) | Yes | Yes |
 | RedSiftAuth\_CL | [Red Sift Events (CCP Push)](/en-us/azure/sentinel/data-connectors-reference#red-sift-events-ccp-push) | No | No |
 | RedSiftEmailForensics\_CL | [Red Sift Events (CCP Push)](/en-us/azure/sentinel/data-connectors-reference#red-sift-events-ccp-push) | No | No |
 | RelevanceSystemAlerts\_CL | [Google Threat Intelligence Relevance System Alerts](/en-us/azure/sentinel/data-connectors-reference#google-threat-intelligence-relevance-system-alerts) | Yes | Yes |
@@ -585,6 +584,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | ServiceNowCmdbRelCi | [ServiceNow CMDB (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#servicenow-cmdb-via-codeless-connector-framework) | No | No |
 | [SigninLogs](/en-us/azure/azure-monitor/reference/tables/SigninLogs) | [Microsoft Entra ID](/en-us/azure/sentinel/data-connectors-reference#microsoft-entra-id) | Yes | Yes |
 | SlackAuditV2\_CL | [SlackAudit (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#slackaudit-via-codeless-connector-framework) | Yes | Yes |
+| SLP\_Feeds\_CL | [SilentPush Feeds](/en-us/azure/sentinel/data-connectors-reference#silentpush-feeds) | No | No |
 | SnowflakeLoadV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
 | SnowflakeLoginV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
 | SnowflakeMaterializedViewV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
@@ -626,6 +626,8 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | Tenable\_WAS\_Asset\_CL | [Tenable Vulnerability Management (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#tenable-vulnerability-management-using-azure-functions) | Yes | Yes |
 | Tenable\_WAS\_Vuln\_CL | [Tenable Vulnerability Management (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#tenable-vulnerability-management-using-azure-functions) | Yes | Yes |
 | TheHiveData | [TheHive (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#thehive-via-codeless-connector-framework) | No | No |
+| TheomAlerts\_CL | [Theom](/en-us/azure/sentinel/data-connectors-reference#theom) | No | No |
+| TheomAlertsV2\_CL | [Theom (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#theom-via-codeless-connector-framework) | No | No |
 | ThinkstCanaryIncidents\_CL | [Thinkst Canary](/en-us/azure/sentinel/data-connectors-reference#thinkst-canary) | Yes | Yes |
 | [ThreatIntelIndicators](/en-us/azure/azure-monitor/reference/tables/ThreatIntelIndicators) | [CrowdStrike Falcon Adversary Intelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#crowdstrike-falcon-adversary-intelligence--using-azure-functions)[Cyjax Threat Intelligence IOC Connector (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#cyjax-threat-intelligence-ioc-connector-using-azure-functions)[Feedly IoC](/en-us/azure/sentinel/data-connectors-reference#feedly-ioc)[GreyNoise Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#greynoise-threat-intelligence)[JoeSandboxThreatIntelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#joesandboxthreatintelligence-using-azure-functions)[PRODAFT USTA - IoC Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#prodaft-usta---ioc-threat-intelligence) | Yes | No |
 | [ThreatIntelligenceIndicator](/en-us/azure/azure-monitor/reference/tables/ThreatIntelligenceIndicator) | [Datalake2Sentinel](/en-us/azure/sentinel/data-connectors-reference#datalake2sentinel)[Luminar IOCs and Leaked Credentials (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#luminar-iocs-and-leaked-credentials-using-azure-functions)[MISP2Sentinel](/en-us/azure/sentinel/data-connectors-reference#misp2sentinel)[Microsoft Defender Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#microsoft-defender-threat-intelligence)[Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#mimecast-intelligence-for-microsoft---microsoft-sentinel-using-azure-functions)[Premium Microsoft Defender Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#premium-microsoft-defender-threat-intelligence)[Threat Intelligence Platforms](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence-platforms)[Threat Intelligence Upload API (Preview)](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence-upload-api-preview)[Threat intelligence - TAXII](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence---taxii)[VMRayThreatIntelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#vmraythreatintelligence-using-azure-functions) | Yes | No |