Daily Defender News
Track documentation and Message Center changes for Microsoft Sentinel.
Microsoft Learn documentation ↗The article now documents a connector that ingests SAP Application Vulnerability Report Service findings into Microsoft Sentinel, including setup prerequisites, credentials, polling and ingestion-delay settings, verification, and related analytics content.
The documentation now describes an optional Application Vulnerabilities workbook tab and an analytics rule correlating SAP Application Vulnerability Report Service findings with BTP audit events. The rule detects custom apps with open high or critical vulnerabilities, using a default CVSS threshold of 7.0 and a 14-day evaluation window.
The documentation adds a separate preview connector for SAP BTP Application Vulnerability Report Service findings, plus a preview analytics rule and an Application Vulnerabilities workbook tab with a vulnerability posture KPI.
The October 2026 documentation adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect interactive XSUAA logins involving custom apps with open high or critical vulnerabilities.
The documentation now lists required CrowdStrike REST API scopes, links to upgrade notes, adds Pathlock deployment guidance, removes the Red Canary connector section, and adds SilentPush Feeds details.
The table adds entries for SilentPush Feeds, Theom, and Theom via the Codeless Connector Framework, and removes the Red Canary Threat Detection entry.
The connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.
The instructions now use Create > Logic App playbook and distinguish Consumption triggers—including alert, case, and legacy options—from Standard playbooks, which start with Blank playbook. The page also explains case-versus-incident terminology and adds supporting links.
The comparison table now describes excluding a rule from the correlation engine and marks it supported for analytics rules and custom detections, with configuration guidance linked.
The reference adds a connector that ingests SAP BTP application vulnerability findings into Microsoft Sentinel. It also updates Confluence permissions and DCR support, and changes Corelight naming and access requirements.
The table now labels the Netskope Web Transactions connector as deprecated, removes several older connector entries, and adds new connectors plus Snowflake V3 tables.
The documentation now explains that the generated table sets `disabled=false` to enable custom parsers and advises forwarding `pack` only when the source-specific parser supports it.
The page adds an Email Event mapping to `_Im_EmailEvent`, updates the Process Event mapping to include `_Im_ProcessEvent`, and refreshes ontology links and the publication date.
The documentation adds AgentEvent and AssetEntity entries, updates the ProcessEvent listing, and revises parser examples to show explicit parameter-to-column mappings. Several examples also include fields such as `pack` and `disabled`.
The parser-management documentation updates custom unifying-function examples to pass `disabled=disabled` where supported, including AgentEvent and DNS parser examples, and adds or updates parser entries.
The documentation now lists the `_Im_AgentEvent_AnthropicClaudeCompliance` parser, its BlueVoyant Codeless Connector Framework source, and that it uses the pack parameter. The page date was also updated.
The page now documents `imProcessEvent` for querying all process event types, retains specialized parsers, revises custom parser naming guidance, and updates the filtering example.
Microsoft added reference documentation for the ASIM Email Event schema, including email routing, authentication, delivery outcomes, and threat fields. It also documents the `_Im_EmailEvent` parser, custom parser naming, and filtering parameters.
The normalization page now links to the Email Event schema and has an updated documentation date.
The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.
The page now states that re-ingestion costs follow standard log ingestion pricing for paid tables, with final costs affected by tenant discounts or commitment tiers.
The comparison table now identifies flexible rule frequency and configurable lookback for custom detection rules, with links to detailed guidance. Page metadata was also updated.
The documentation now lists flexible and high-frequency support for Sentinel data. It specifies lookback limits of up to 48 hours for frequencies over one hour and up to 14 days for frequencies of one hour or less; lookback remains in public preview.
The Cisco Meraki connector now documents File Scanned detections and the `CiscoMerakiFileScannedEvents_CL` table. F5Telemetry LTM and RFI Playbook Alert Results tables are marked supported, and workspace transform DCR support is documented.
The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.
The documentation now describes Airlock Digital SaaS polling, self-hosted polling, and push connectors, including supported data tables, prerequisites, setup, and connection behavior.
The feature-availability page was refreshed, including metadata and reference links. The Codeless Connectors Platform entry remains in public preview, while its final availability field changed from No to Yes.
Microsoft added a guide covering prerequisites, Partner Center publishing, and Azure Government endpoint updates for Sentinel CCF data connector solutions.
The publishing guidance now links to separate instructions for making published solutions that include a CCF data connector available in Azure Government.
The guide now states that, after publishing a CCF data connector solution to Azure public cloud, publishers must enable Azure Government for the plan in Partner Center.
The reference adds mappings for Fortra Agari, Airlock Digital, BloodHound Enterprise, and Cisco Meraki connectors, updates ASim and Armis entries, and removes several older mappings.
The data connector UI definitions reference now uses the corrected relative link to the Create a codeless connector documentation.
The documentation now states that parser creation skills normalize each source record independently and preserve record cardinality. Query-local datatable/lookup mappings are allowed when lookup keys are unique, while same-table and cross-table event enrichment are not used.
The documentation now restricts parsers to the declared source table, one normalized output per source record, and scalar or local static mappings. Cross-table enrichment, watchlists, multi-value expansion, joins, aggregation, and deduplication are prohibited for parser operations.
The documentation now describes required ARM template files, folder layouts, metadata fields, validation checks, and incident-versus-alert trigger types for Sentinel playbooks.
The article updates its title and metadata, standardizes formatting, renames tab headings, and clarifies instructions for adding OR condition groups and entity-property values.
The article now focuses on adding Sentinel MCP tools to AI agents, clarifies how to use the client secret and Azure values in Copilot Studio OAuth settings, and retitles step 3 around configuring the redirect URI.
The article now distinguishes CSV and JSON template guidance, adds instructions for choosing CSV template options, and describes CSV schema and JSON STIX 2.1 examples more precisely. Documentation metadata was also updated.
The article now more clearly covers authentication, autoloading providers and components, Python kernels, package installation issues, and MSTICPYCONFIG environment variables, with platform-specific tabs for Windows, Linux, and Azure Machine Learning.
The article now explains that the unified MCP server exposes Sentinel tool collections, links to the getting-started guidance, and more explicitly identifies the endpoint as the MCP server endpoint for Security Copilot agent creation tools. Title and metadata were also refreshed.
The reference now explains that listed UEBA anomalies are stored in the Anomalies table, distinguishes BehaviorInfo insights, and documents Check Point, Fortinet, GuardDuty, and Zscaler anomaly types with data sources, ATT&CK mappings, and activity criteria.
The documentation describes the SOAR playbook generator as an AI-assisted LLM feature in the Microsoft Defender portal. It clarifies that generated playbooks are code-based Python scripts running in a managed environment and specifies the permissions required to generate and deploy them.
The article now more clearly explains using AzureActivity and LAQueryLogs to audit Sentinel activity, including deleted resources, non-successful queries, resource-intensive clients, active users, and access to sensitive tables. Metadata and heading structure were also updated.
The article clarifies task-detail fields, adds steps for observing record changes, and updates wording for querying and interpreting incident-task records.
The page now states that users must have the View-Only Audit Logs or Audit Logs role and remote PowerShell access before running the audit-log script. The page metadata and link wording were also updated.
The article now uses clearer terminology for Azure Logic Apps connections, managed identities, service principals, and application credentials, with updated headings, links, and screenshot descriptions.
The Microsoft Sentinel best practices page now links partners to “Build and publish Microsoft Sentinel SIEM solutions” instead of the previous partner integration guide.
The article updates its metadata and clarifies troubleshooting wording, including how and when to capture a HAR file during issue reproduction.
Updated metadata and wording clarify bookmark creation, Advanced hunting availability, MITRE ATT&CK mapping, the Bookmarks tab, incident viewing, and deletion behavior.
The documentation adds a how-to guide for creating and testing an agent that uses Microsoft Sentinel data lake telemetry to correlate identity, access, and endpoint signals before publishing to Security Copilot.
The page now focuses on using the entity analyzer MCP tool in Azure Logic Apps to enrich entities and automate verdicts. It also clarifies supported authentication options and the Security Reader requirement, and updates page metadata.
The article now uses clearer titles and headings, adds setup and validation guidance, clarifies the AI-assisted Visual Studio Code workflow, and updates screenshots and metadata.
The page metadata was updated, Microsoft Sentinel role names were expanded in links, and screenshot descriptions were made more specific.
The page’s update date and custom metadata were revised, and the “Next step” heading was renamed “Next steps” with an anchor added.
The article adds Azure and Defender portal steps for creating data collection rules, warns not to edit automatically populated transformations for listed applications or devices, and documents ARM-based setup tooling.
The article description now focuses on ingesting SAP HANA audit logs into Microsoft Sentinel for customer-managed environments and identifies security, infrastructure, and SAP BASIS teams as relevant audiences. The publication metadata was updated, and a “Learn more” line was removed.
Updated the Hunts article title and metadata, clarified instructions and terminology, refined section headings, and renamed “Next steps” to “Related content.”
The documentation now highlights that the machine learning algorithm needs 30 days of Windows Security events to establish a user-behavior baseline before detecting incidents.
The article now labels the data collection rule reference section, clarifies which DCR procedures require verification, and warns that deleting the legacy table and custom data connector is irreversible and may affect existing queries, workbooks, or integrations.
The page’s publication date and authoring metadata were updated, and several Fusion descriptions and scheduled analytics rule guidance were reworded for clarity, including the Customer-Managed Keys link text.
The article updates its title and metadata, links the UEBA reference to the deployment guide, and reformats the post-deployment next-step link.
The article was reorganized into dedicated sections for data connectors, analytics rules, automation rules, and playbooks, with refreshed wording and links to setup guidance.
The page now focuses on retention and data tier settings for Sentinel and Defender XDR tables, adds Table insights for monitoring ingestion health and costs, and revises its permissions section and related-content links.
The article description and content were streamlined by removing connection-agent sections, agent installation references, role-creation procedures, and SNC connection guidance. The user section was renamed to focus on creating an SAP user for the Microsoft Sentinel role.
The page now uses clearer Microsoft Sentinel terminology, improves navigation and headings, clarifies the GuardDuty-to-S3 export step, and refreshes related links and metadata.
The documentation updates wording and clarifies that the second CloudFormation template creates the remaining AWS resources, including the S3 bucket, SQS queue, and IAM role.
The page metadata was updated, and references now explicitly name the Microsoft Entra ID data connector and Microsoft Sentinel in linked guidance.
Updated the Microsoft Sentinel Azure Functions connector article with clearer links, section headings, deployment guidance, and Key Vault reference information.
Updated the page metadata, clarified that dashboards use data collected from Azure Stack Hub virtual machines, identified them as Microsoft Sentinel dashboards, and refined the screenshot description.
The article’s date and authoring metadata were updated, and the query guidance now states that queries can run after Azure Virtual Desktop data is connected to Microsoft Sentinel.
The article received clearer navigation links, updated wording and formatting, and refreshed metadata. It now directs readers to connector-specific configuration guidance and identifies the connector details page for support contacts.
The article updates its metadata and wording, including clearer subscription-status text and guidance to query Defender for Cloud alerts where the product name is Azure Security Center. It also refreshes the introductory links and closing guidance.
The documentation clarifies that Azure Arc is required for collecting events from non-Azure virtual machines and identifies the JSON filter examples as equivalent definitions for the DCR API payload.
The documentation now references output plugin v2.5.0, revises supported Logstash versions, adds version 9.0.8, and flags required security updates for listed versions.
The documentation now explicitly identifies intelligence ingested from the Defender Threat Intelligence connector, while updating related links and page metadata.
The page now describes the KQL query as a 14-day event-volume trend for validating ingestion consistency, notes that TVM tables aren't ingested into Microsoft Sentinel, and improves references to the relevant query documentation.
The article date and custom metadata were refreshed, and the Dataverse audit-settings reference was reworded and linked directly.
The documentation now states that customers should use the Microsoft 365 auditing solution moving forward after the AIP analytics and audit logs preview retirement.
The Microsoft Sentinel AWS EKS connector article now includes guidance for verifying audit-log ingestion and troubleshooting common setup issues. Related content links and setup wording were also revised.
The page now clarifies S3 and legacy CloudTrail connector instructions, AWS resource descriptions, Azure Government role assignment, credential locations, prerequisites, and troubleshooting links. The title and page metadata were also refreshed.
The article’s metadata was updated, and its wording was clarified to state that some diagnostic settings-based connectors are managed through Azure Policy.
The article now says table names are listed under each connector in the Data connectors reference and adds a Microsoft Entra ID Protection example. Documentation metadata was also updated.
The documentation now states that Windows Event Forwarding events are written to the `WindowsEvent` table, not `SecurityEvent`. It also notes that built-in rules querying `SecurityEvent` won't match data stored only in `WindowsEvent`.
The guidance now explicitly names the application ID, tenant ID, client secret, and Microsoft Graph tiIndicators API permission required for TIP integration with Microsoft Sentinel. Section headings and connector-enablement steps were also clarified.
The article now uses updated navigation and permission guidance, identifies the Okta API token explicitly, and warns that deleting a connector stops ingestion, removes its configuration, and cannot be undone.
A new guide explains prerequisites and steps to connect SAP to Microsoft Sentinel, including Azure resource deployment, required permissions, DCR authorization, and SAP client setup.
The article now identifies the upload API as a preview API, clarifies STIX-supported uploads and prerequisites, renames the configuration section, and updates related links and permission wording.
The article’s title, date, metadata, punctuation, grammar, and wording were updated. The guidance now clarifies that workbook parameter values can be referenced elsewhere in the same workbook.
The article distinguishes pull/polling connectors from push connectors and focuses its instructions on connectors that periodically fetch data through APIs. It also links to the Microsoft Sentinel Visual Studio Code extension.
The article now clarifies prerequisites, authentication guidance, trigger examples, output descriptions, and links for creating analytics rules. Metadata and wording were also refreshed.
The article now describes writing, cloning, and editing KQL-based hunting queries, clarifies the navigation sequence, and specifies that queries from content hub solutions or repositories must be edited in their original source.
The page date and custom metadata were updated, and the Microsoft Sentinel API description was clarified to identify the Incidents operation group and its get, create, update, and delete operations.
The article was refreshed with clearer wording, a new introductory step description, updated links, and reorganized related content. Metadata and the publication date were also updated.
The article now specifies that Microsoft Defender XDR incident integration or onboarding Sentinel to the Defender portal causes Defender XDR to correlate incidents, and clarifies the Microsoft security data connector section and Azure account link.
The article was refreshed with clearer wording for trigger selection and improved formatting for trigger and condition tables, along with updated metadata.
The documentation now explains parser YAML structure, required fields, validation rules, KQL query design, and common submission issues for custom log tables, Syslog, and CEF connectors.
Microsoft Sentinel now documents how to build Codeless Connector Framework pull connectors that chain parent and child REST API calls, including configuration of nested polling in RestApiPoller connection rules.
The documentation changed “Next steps” to “Related content” and “Getting help” to “Get help.”
The playbook text now says the task targets the user associated with the researched malicious IP address. The document date and authoring metadata were also updated.
The article describing Microsoft Sentinel for SAP across multiple workspaces was deleted, including guidance on separate SAP and SOC workspaces, access, data residency, and preview limitations.
The guidance now states that interactive-session graphs are temporary, on-demand graph jobs materialize graphs for 30 days before deletion, and custom graph activity is billed under the Microsoft Sentinel graph meter. It also updates terminology, examples, and links.
The page now uses clearer Analytics and Data Lake terminology and adds a warning that resetting analytics and total retention to 30 days disables the connector in the Azure portal. The page date and authoring metadata were also updated.
The article now links directly to retention and data tiering, XDR data, custom and auxiliary log tables, and direct ingestion sections. The custom log tables heading and anchor were also updated.
The article’s metadata was updated, and its introductory text was reorganized under a new “Overview” heading.
The page expands the definition of KQL jobs, adds guidance on scheduled jobs that reference deleted source workspaces, and documents a query lookback and ingestion-delay example.
The article now specifies required Microsoft Entra ID roles before creating or scheduling jobs, and a managed identity permission requirement for jobs that create custom analytics-tier tables. It also clarifies job-management and `save_as` guidance.
Updated notebook guidance includes clearer permissions and Provider class headings, new navigation anchors, revised Visual Studio Code image descriptions, improved scheduling links, and guidance for creating Jupyter notebooks.
The article now uses clearer descriptions for querying Entra ID sign-in, group, and device event tables. It also updates guidance for identifying lateral movement and credential-dumping activity, including connection-count thresholds and port filters.
The documentation states that the containerized SAP data connector agent will be permanently disabled on September 14, 2026. Dependent analytics rules, workbooks, hunting queries, and playbooks will stop returning results for affected SAP systems.
The article adds guidance for recreated workspaces, regional-capacity workarounds, generic setup errors, and workspaces missing from the Defender portal. It also adds a warning that deleting a Log Analytics workspace can cause permanent data loss.
The article adds prerequisites and onboarding guidance for Sentinel data lake and graph, announces September 2026 cutoffs for onboarding or configuring data risk graph, and clarifies policy exemption and workspace offboarding behavior.
The article now directs readers to its alert details properties table for customization guidance and for identifying preview-labeled properties. It also updates the publication metadata and related-content introduction.
The reference now explains that BlobCreated events are sent through an Azure Storage notification queue before connector processing, and adds setup guidance for notification and dead-letter queues.
The documented maximum for both `RequestTimeoutInSeconds` and `TimeoutInSeconds` increased from 180 to 300 seconds. Their default values remain 100 and 20 seconds, respectively.
Seven screenshot references now use the `isv/media/create-codeless-connector/` path.
The page was updated with revised wording for data exploration, graph features, setup steps, access requirements, and tool descriptions, along with metadata and formatting changes.
The overview now requires external source tables to use Delta Parquet and documents support for hybrid Azure Databricks workspaces, excluding serverless workspaces. The page title also adds “Preview.”
The page date was updated, and the guidance now specifies that transformations to Analytics tables in Sentinel-enabled Log Analytics workspaces are exempt from Azure Monitor’s filtering ingestion charge. The Azure Monitor reference link was also updated.
A new article explains how to select and combine Sentinel data lake connectors, Security Copilot agents, the Sentinel MCP server, custom graphs, notebook jobs, and SIEM content based on customer scenarios.
The article now provides separate steps for viewing existing analytics rule templates in the Defender portal and Azure portal, and updates the procedure wording and metadata.
