Microsoft Sentinel
Cloud and workloads

Sentinel Tables Connectors Reference

In brief

The reference now labels Atlassian Jira Audit and SecurityScorecard Factor connectors as deprecated. It also updates connector names and links, adds several connector entries, removes GoogleCloudSCC, and changes availability indicators for multiple connectors.

What Defender admins need to know

Review connector inventories and documentation references, especially where deprecated integrations or changed availability statuses are used. No administrator action or deadline is specified.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

| ABNORMAL_SECURITY_VENDOR_CASE_CL | Abnormal Security (Push) | Yes | Yes | | ABNORMAL_THREAT_MESSAGES_CL | AbnormalSecurity (using Azure Functions) | Yes | Yes | | ADFSSignInLogs | Microsoft Entra ID | Yes | Yes | | ADOAuditLogs_CL | Azure DevOps Audit Logs (via Codeless Connector Platform)Azure DevOps Audit Logs (via Codeless Connector Framework) | Yes | Yes | | AgariAPDPolicyLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AgariAPDTCLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AgariBPAlertsLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | BoxEvents_CL | [DEPRECATED] Box Events (using Azure Function) (using Azure Functions) | No | No | | BoxEventsV2_CL | Box Events (via Codeless Connector Framework) | Yes | Yes | | BV_ClaudeCompliance_ComplianceActivities_CL | BV-ClaudeCompliance (via Codeless Connector Framework) | Yes | Yes | | CarbonBlack_Alerts_CL | VMware Carbon Black Cloud via AWS S3 (via Codeless Connector Framework) | NoYes | NoYes | | CarbonBlackAuditLogs_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CarbonBlackEvents_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CarbonBlackNotifications_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CatoNetworksEvents_CL | Cato Networks Events (Push) | Yes | Yes | | CayosoftThreatAlerts_CL | Cayosoft Guardian Threat Alerts | No | No | | CBSLog_AzureV2_CL | CTM360 CyberBlindSpot (Serverless) | Yes | Yes | | CheckPointEmailSecAntiPhishingExceptions_CLCheckPointEmailSecAntiPhishingExceptions | Check Point Email Security (via Codeless Connector Framework) | YesNo | YesNo | | CheckPointEmailSecurityAuditLogs_CL | Check Point Email Security (via Codeless Connector Framework) | Yes | Yes | | CheckPointEmailSecurityEvents_CL | Check Point Email Security (via Codeless Connector Framework) | Yes | Yes | | CheckPointEmailSecuritySpamExceptions_CLCheckPointEmailSecuritySpamExceptions | Check Point Email Security (via Codeless Connector Framework) | YesNo | YesNo | | Cisco_Umbrella_audit_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | No | No | | Cisco_Umbrella_cloudfirewall_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | Yes | Yes | | Cisco_Umbrella_dlp_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | No | No | | CrowdStrikeAlertsV2_CL | CrowdStrike API Data Connector (via Codeless Connector Framework) | Yes | Yes | | CrowdStrikeReplicatorV2 | CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3) (using Azure Functions) | No | No | | CyberArk_AuditEvents_CL | Idira Audit | Yes | Yes | | CyberArk_EPMEvents_CL | CyberArk EPM | Yes | Yes | | CyberArkEPM_Events_CL | CyberArkEPM (using Azure Functions)Idira EPM (using Azure Functions)Idira EPM | Yes | Yes | | CyberpionActionItems_CL | IONIX Security Logs (via Codeless Connector Framework)[DEPRECATED] IONIX Security Logs (Push) | Yes | Yes | | CyberSixgill_Alerts_CL | Cybersixgill Actionable Alerts (using Azure Functions) | No | No | | CybleVisionAlerts_CL | Cyble Vision Alerts | No | No | | DataminrPulse_Alerts_CL | Dataminr Pulse Alerts Data Connector (using Azure Functions) | No | No | | DataverseActivity | Microsoft Dataverse | Yes | Yes | | datawizaserveraccess_CL | Datawiza DAP | No | No | | DelineaAuditEvents_CL | Delinea Platform Audit Events | No | No | | Detections_Data_CCF_CL | Vectra RUX Security Data Connector (via Codeless Connector Framework) | Yes | Yes | | Detections_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | DeviceEvents | Microsoft Defender XDR | Yes | Yes | | DigitalShadows_V2_CL | Digital Shadows Searchlight | NoYes | NoYes | | DnsEvents | DNS | Yes | Yes | | DnsInventory | DNS | Yes | Yes | | DomainToolsThreatIntelDomains_CL | DomainTools Threat Intelligence Domain Feed | No | No | | ElasticAgentEvent | Elastic Agent | No | No | | ElasticAgentLogsV2_CL | Elastic Agent (via Codeless Connector Framework) | No | No | | EmailEvents | Microsoft Defender XDR | Yes | Yes | | emiocintel_CL | Check Point EM ThreatCloud Intelligence Feed Connector | NoYes | NoYes | | Entities_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | Entity_Scoring_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | ErmesBrowserSecurityEvents_CL | Ermes Browser Security Events | Yes | Yes | | GitHubAuditLogsV3_CL | GitHub Enterprise Audit Log (via Azure Storage) | Yes | Yes | | githubscanaudit_CL | GitHub (using Webhooks) | Yes | Yes | | GKEAudit | Google Kubernetes Engine (via Codeless Connector Framework) | Yes | Yes | | GoogleCloudSCC | Google Security Command Center | Yes | Yes | | GoogleWorkspaceReports | Google Workspace Activities (via Codeless Connector Framework) | Yes | Yes | | GTI_Vulnerabilities_CL | Google Threat Intelligence Vulnerabilities (CCF) | Yes | Yes | | GuardicoreAgents_CL | Akamai Guardicore | No | No | | jamfprotecttelemetryv2_CL | Jamf Protect Push Connector | Yes | Yes | | jamfprotectunifiedlogs_CL | Jamf Protect Push Connector | Yes | Yes | | JBossEvent_CL | Custom logs via AMA | No | No | | Jira_Audit_CL | Atlassian Jira Audit (using Azure Functions)[DEPRECATED] Atlassian Jira Audit (using Azure Function) (using Azure Functions) | Yes | Yes | | Jira_Audit_v2_CL | Atlassian Jira Audit (via Codeless Connector Framework) | Yes | Yes | | JuniperIDP_CL | Custom logs via AMA | Yes | Yes | | KeeperSecurityEventNewLogs_CL | Keeper Security Push Connector | Yes | Yes | | MulesoftCloudhubAlerts_CL | Mulesoft CloudHub Alerts Connector (via Codeless Connector Framework) | Yes | Yes | | MuleSoftCloudhubLogs | MuleSoft CloudHub Logs (Push Connector via Codeless Connector Framework) | No | No | | NCProtectUAL_CL | NC Protect | No | No | | NetcraftTakedown_CL | Netcraft Integration Gateway | Yes | Yes | | Netskope_WebTx_metrics_CL | Netskope Data Connector | No | No | | NetskopeAISecOps_CL | Netskope AI SecOps | No | No | | NetskopeAlerts_CL | Netskope Alerts and Events | Yes | Yes | | ProofPointTAPClicksPermittedV2_CL | Proofpoint TAP (via Codeless Connector Platform) | Yes | Yes | | ProofPointTAPMessagesBlockedV2_CL | Proofpoint TAP (via Codeless Connector Platform) | Yes | Yes | | ProofPointTAPMessagesDeliveredV2_CL | Proofpoint TAP (via Codeless Connector Platform) | Yes | Yes | | PulumiAuditLogs_CL | Pulumi Cloud Audit Logs | No | No | | PurviewDataSensitivityLogs | Microsoft Purview | Yes | Yes | | QscoutAppEvents_CL | QscoutAppEventsConnector (via Codeless Connector Framework) | No | No | | QualysHostDetectionV3_CL | Qualys Vulnerability Management (via Codeless Connector Framework) | Yes | Yes | | SalesforceServiceCloudV3_CL | Salesforce Service Cloud (via Codeless Connector Framework) | Yes | Yes | | Samsung_Knox_Audit_CL | Samsung Knox Asset Intelligence | Yes | Yes | | SAPBTPAuditLog_CL | SAP BTP | Yes | Yes | | SAPBTPAVL_CL | Application Vulnerability Report for SAP BTP | NoYes | NoYes | | SAPETDAlerts_CL | SAP Enterprise Threat Detection, cloud edition | Yes | Yes | | SAPETDInvestigations_CL | SAP Enterprise Threat Detection, cloud edition | Yes | Yes | | SAPLogServ_CL | SAP LogServ (RISE), S/4HANA Cloud private edition | Yes | Yes | | SecurityBridgeLogs_CL | Custom logs via AMA | Yes | Yes | | SecurityEvent | Cyborg Security HUNTER Hunt PackagesMicrosoft Active-Directory Domain Controllers Security Event LogsSecurity Events via Legacy AgentWindows Security Events via AMA[Deprecated] Microsoft Exchange Logs and Events | Yes | Yes | | SecurityIncident | Derdack SIGNL4Microsoft Defender XDR | Yes | Yes | | SecurityScorecardFactor_CL | [DEPRECATED] SecurityScorecard Factor (using Azure Functions) | No | No | | SecurityScorecardFactorHistory_CL | SecurityScorecard Factors (via Codeless Connector Framework) | No | No | | SecurityScorecardIssues_CL | [DEPRECATED] SecurityScorecard Issue (using Azure Functions) | No | No | | SecurityScorecardIssuesHistory_CL | SecurityScorecard Issues (via Codeless Connector Framework) | No | No | | SecurityScorecardRatings_CL | [DEPRECATED] SecurityScorecard Cybersecurity Ratings (using Azure Functions) | No | No | | SecurityScorecardRatingsHistory_CL | SecurityScorecard Ratings (via Codeless Connector Framework) | No | No | | Seg_Cg_CL | Mimecast Secure Email Gateway | Yes | Yes | | Seg_Dlp_CL | Mimecast Secure Email Gateway | Yes | Yes | | SentinelOneActivities_CL | SentinelOne (via Codeless Connector Framework)SentinelOne V2 (via Codeless Connector Framework) | Yes | Yes | | VMwareWorkspaceOneDevices | VMware Workspace ONE (via Codeless Connector Framework) | No | No | | W3CIISLog | IIS Logs of Microsoft Exchange Servers[Deprecated] Microsoft Exchange Logs and Events | Yes | No | | web_assets_CL | Holm Security Data Connector | No | No | | WhoisFreaksThreat_CL | WhoisFreaks Threat & NRD Feeds (via Codeless Connector Framework) | No | No | | WindowsEvent | Windows Forwarded Events | Yes | Yes | | WizAuditLogsV3_CL | Wiz for Microsoft Sentinel | No | No | | WizDetectionsV3_CL | Wiz for Microsoft Sentinel | Yes | Yes |