Skip to content

Commit f413b9a

Browse files
denreadenrea
authored
Merge pull request #313521 from v-alje/AUTOGEN-Sentinel-connectors-Mon_Mar_23_2026-0934
[AUTOGEN] PR for Sentinel connectors
2 parents 8c0c726 + 8074410 commit f413b9a

2 files changed

Lines changed: 112 additions & 26 deletions

File tree

‎articles/sentinel/includes/connector-details.md‎

Lines changed: 98 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
author: EdB-MSFT
33
ms.author: edbaynash
44
ms.topic: include
5-
ms.date: 03/17/2026
5+
ms.date: 03/23/2026
66

77
# This file is auto-generated. Do not edit manually. Changes will be overwritten.
88
---
@@ -480,6 +480,23 @@ You can stream the audit logs from the WebCTRL SQL server hosted on Windows mach
480480

481481
---
482482

483+
<a name="aws-eks-data-connector-via-codeless-connector-framework"></a><details><summary>**AWS EKS Data Connector (via Codeless Connector Framework)**</summary>
484+
485+
**Supported by:** [Microsoft Corporation](https://support.microsoft.com/)
486+
487+
The AWS EKS data connector provides the capability to ingest audit logs from [Amazon Elastic Kubernetes Service](https://aws.amazon.com/eks/) into Microsoft Sentinel. This connector focuses on EKS audit logs (JSON format) which contain detailed information about API server requests, authentication decisions, and cluster activities. The connector uses AWS SQS to receive notifications when new audit log files are exported to S3, ensuring real-time security monitoring and compliance tracking for your Kubernetes clusters.
488+
489+
**Log Analytics table(s):**
490+
491+
|Table|DCR support|Lake-only ingestion|
492+
|---|---|---|
493+
|`AWSEKSLogs_CL`|No|No|
494+
495+
**Data collection rule support:** Not currently supported<br><br>
496+
</details>
497+
498+
---
499+
483500
<a name="aws-s3-server-access-logs-via-codeless-connector-framework"></a><details><summary>**AWS S3 Server Access Logs (via Codeless Connector Framework)**</summary>
484501

485502
**Supported by:** [Microsoft Corporation](https://support.microsoft.com/)
@@ -5909,6 +5926,30 @@ SecurityBridge enhances SAP security by integrating seamlessly with Microsoft Se
59095926

59105927
---
59115928

5929+
<a name="semperis-lightning-logs"></a><details><summary>**Semperis Lightning Logs**</summary>
5930+
5931+
**Supported by:** [Semperis](https://www.semperis.com/support/)
5932+
5933+
The [Semperis Lightning](https://www.semperis.com/platform/) connector uses Azure Functions to ingest Semperis Lightning identity security data into Microsoft Sentinel. The connector deploys an Azure Function and collects data into custom Log Analytics tables for investigation and threat hunting.
5934+
5935+
**Log Analytics table(s):**
5936+
5937+
|Table|DCR support|Lake-only ingestion|
5938+
|---|---|---|
5939+
|`LightningTier0Nodes_CL`|No|No|
5940+
|`LightningAttackPaths_CL`|No|No|
5941+
|`LightningIOEResults_CL`|No|No|
5942+
5943+
**Data collection rule support:** Not currently supported
5944+
5945+
**Prerequisites:**
5946+
5947+
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. For more information, see [Azure Functions](/azure/azure-functions/).
5948+
- **Semperis Lightning API credentials**: A Semperis Lightning **API Key** and selected **Zone** (na or eu) are required to authenticate the connector to Semperis Lightning.<br><br>
5949+
</details>
5950+
5951+
---
5952+
59125953
<a name="sentinelone"></a><details><summary>**SentinelOne**</summary>
59135954

59145955
**Supported by:** [Microsoft Corporation](https://support.microsoft.com/)
@@ -6068,23 +6109,6 @@ Use this data connector to integrate with Sonrai Security and get Sonrai tickets
60686109
|---|---|---|
60696110
|`Sonrai_Tickets_CL`|No|No|
60706111

6071-
**Data collection rule support:** Not currently supported<br><br>
6072-
</details>
6073-
6074-
---
6075-
6076-
<a name="sophos-cloud-optix"></a><details><summary>**Sophos Cloud Optix**</summary>
6077-
6078-
**Supported by:** [Sophos](https://community.sophos.com/products/sophos-cloud-optix/)
6079-
6080-
The [Sophos Cloud Optix](https://www.sophos.com/products/cloud-optix.aspx) connector allows you to easily connect your Sophos Cloud Optix logs with Microsoft Sentinel, to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's cloud security and compliance posture and improves your cloud security operation capabilities.
6081-
6082-
**Log Analytics table(s):**
6083-
6084-
|Table|DCR support|Lake-only ingestion|
6085-
|---|---|---|
6086-
|`SophosCloudOptix_CL`|No|No|
6087-
60886112
**Data collection rule support:** Not currently supported<br><br>
60896113
</details>
60906114

@@ -7008,6 +7032,58 @@ The [Workplace](https://www.workplace.com/) data connector provides the capabili
70087032

70097033
---
70107034

7035+
<a name="xbow-security-platform-via-azure-function"></a><details><summary>**XBOW Security Platform (via Azure Function)**</summary>
7036+
7037+
**Supported by:** [XBOW](https://xbow.com/contact)
7038+
7039+
The **XBOW** data connector ingests asset snapshots, vulnerability findings, and assessment activity from the [XBOW Security Platform](https://console.xbow.com) into Microsoft Sentinel. An Azure Function polls the XBOW API on a timer and pushes asset JSON snapshots into `XbowAssets_CL`, enriched findings (with evidence, PoC recipes, impact, and mitigations) into `XbowFindings_CL`, and assessment lifecycle events into `XbowAssessments_CL`, using the [Azure Monitor Ingestion API](/azure/azure-monitor/logs/logs-ingestion-api-overview) (DCE/DCR).
7040+
7041+
**Log Analytics table(s):**
7042+
7043+
|Table|DCR support|Lake-only ingestion|
7044+
|---|---|---|
7045+
|`XbowAssets_CL`|No|No|
7046+
|`XbowFindings_CL`|No|No|
7047+
|`XbowAssessments_CL`|No|No|
7048+
7049+
**Data collection rule support:** Not currently supported
7050+
7051+
**Prerequisites:**
7052+
7053+
- **XBOW API Token**: A XBOW Personal Access Token is required. Generate one in the [XBOW console](https://console.xbow.com) under **Settings > Personal Access Tokens**. Scope the token to the organization you want to monitor.
7054+
- **XBOW Organization ID**: The Organization ID from your XBOW account. Find it in the XBOW console URL or via the API.
7055+
- **Microsoft.Web/sites permissions**: Read and write permissions to Azure Functions to create a Function App is required. For more information, see [Azure Functions](/azure/azure-functions/).
7056+
- **Custom prerequisites if necessary, otherwise delete this customs tag**: Description for any custom pre-requisites
7057+
- **Azure AD App Registration**: An Azure AD App Registration (service principal) is required. You must manually assign the **Monitoring Metrics Publisher** role on the Data Collection Rule (DCR) to this App Registration after deployment.<br><br>
7058+
</details>
7059+
7060+
---
7061+
7062+
<a name="zero-networks-segment-push"></a><details><summary>**Zero Networks Segment (Push)**</summary>
7063+
7064+
**Supported by:** [Zero Networks](https://zeronetworks.com/)
7065+
7066+
The [Zero Networks Segment](https://zeronetworks.com/) push connector allows Zero Networks to send Audits, Network Activities, Identity Activities, and RPC Activities directly to Microsoft Sentinel in real time. Deploy the connector to create a Data Collection Rule (DCR) and Microsoft Entra app; then configure your Zero Networks application with the connection details to push events.
7067+
7068+
**Log Analytics table(s):**
7069+
7070+
|Table|DCR support|Lake-only ingestion|
7071+
|---|---|---|
7072+
|`ZNAudit_CL`|No|No|
7073+
|`ZNNetworkActivity_CL`|No|No|
7074+
|`ZNIdentityActivity_CL`|No|No|
7075+
|`ZNRPCActivity_CL`|No|No|
7076+
7077+
**Data collection rule support:** Not currently supported
7078+
7079+
**Prerequisites:**
7080+
7081+
- **Microsoft Entra**: Permission to create an app registration in Microsoft Entra ID. Typically requires Entra ID Application Developer role or higher.
7082+
- **Microsoft Azure**: Permission to assign Monitoring Metrics Publisher role on data collection rule (DCR). Typically requires Azure RBAC Owner or User Access Administrator role.<br><br>
7083+
</details>
7084+
7085+
---
7086+
70117087
<a name="zero-networks-segment-audit"></a><details><summary>**Zero Networks Segment Audit**</summary>
70127088

70137089
**Supported by:** [Zero Networks](https://zeronetworks.com/)
@@ -7134,20 +7210,19 @@ The [Zoom](https://zoom.us/) Reports data connector provides the capability to i
71347210

71357211
**Supported by:** [Microsoft Corporation](https://support.microsoft.com/)
71367212

7137-
The [Zoom Reports](https://developers.zoom.us/docs/api/) data connector enables you to ingest Zoom Reports data into Microsoft Sentinel through the Zoom REST API v2, allowing you to monitor and audit Zoom usage across your organization. This connector uses server-to-server OAuth account credentials for authentication and supports ingestion of multiple report types including Daily Usage Reports for meeting statistics and usage metrics, User Reports for active/inactive user host information, Telephony Reports for telephony usage statistics, Cloud Recording Usage Reports for cloud storage and recording usage, Operation Logs for administrative operations and audit trail, and Activity Logs for user sign-in/sign-out activities. Each report type is collected in a separate polling configuration with automatic pagination support using NextPageToken, polling every 5 minutes per 7-day window with a rate limit of 2 queries per second per endpoint and up to 3 automatic retries with exponential backoff. The data connector is built on Microsoft Sentinel Codeless Connector Framework and supports DCR-based [ingestion time transformations](/azure/azure-monitor/logs/custom-logs-overview) for optimized query performance.
7213+
The [Zoom Reports](https://developers.zoom.us/docs/api/) data connector enables you to ingest Zoom Reports data into Microsoft Sentinel through the Zoom REST API v2, allowing you to monitor and audit Zoom usage across your organization. This connector uses server-to-server OAuth account credentials for authentication and supports ingestion of multiple report types including Daily Usage Reports for meeting statistics and usage metrics, User Reports for active/inactive user host information, Telephony Reports for telephony usage statistics, Cloud Recording Usage Reports for cloud storage and recording usage, Operation Logs for administrative operations and audit trail, and Activity Logs for user sign-in/sign-out activities. Each report type is collected in a separate polling configuration with automatic pagination support using NextPageToken. The data connector is built on Microsoft Sentinel Codeless Connector Framework and supports DCR-based [ingestion time transformations](/azure/azure-monitor/logs/custom-logs-overview) for optimized query performance.
71387214

71397215
**Log Analytics table(s):**
71407216

71417217
|Table|DCR support|Lake-only ingestion|
71427218
|---|---|---|
7143-
|`Zoom_CL`|Yes|Yes|
7219+
|`ZoomV2_CL`|No|No|
71447220

7145-
**Data collection rule support:** [Workspace transform DCR](/azure/azure-monitor/logs/tutorial-workspace-transformations-portal)
7221+
**Data collection rule support:** Not currently supported
71467222

71477223
**Prerequisites:**
71487224

7149-
- **Zoom API access**: Access to Zoom REST API v2 with account credentials
7150-
- **If you've used an `Azure Functions` based connector that uses the same table Zoom_CL before**: Migrate your classic custom table to use the CCF connector. Open your `Log Analytics Workspace` attached to the current `Microsoft Sentinel Workspace`, find the existing Zoom_CL and edit its schema, then click `Migrate to manual schema management` to migrate. Please close the current data connector page and reopen it after migration to see the effect, in case you run into errors asking for table migration.<br><br>
7225+
- **Zoom API access**: Access to Zoom REST API v2 with account credentials<br><br>
71517226
</details>
71527227

71537228
---

‎articles/sentinel/includes/sentinel-tables-connectors.md‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
author: EdB-MSFT
33
ms.author: edbaynash
44
ms.topic: include
5-
ms.date: 03/17/2026
5+
ms.date: 03/23/2026
66
# This file is auto-generated. Do not edit manually. Changes will be overwritten.
77
---
88

@@ -60,6 +60,7 @@ ms.date: 03/17/2026
6060
|AWSCloudFront_AccessLog_CL|[Amazon Web Services CloudFront (via Codeless Connector Framework) (Preview)](/azure/sentinel/data-connectors-reference#amazon-web-services-cloudfront-via-codeless-connector-framework-preview)|Yes|Yes|
6161
|[AWSCloudTrail](/azure/azure-monitor/reference/tables/AWSCloudTrail)|[Amazon Web Services S3](/azure/sentinel/data-connectors-reference#amazon-web-services-s3)<br>[Amazon Web Services](/azure/sentinel/data-connectors-reference#amazon-web-services)|Yes|Yes|
6262
|[AWSCloudWatch](/azure/azure-monitor/reference/tables/AWSCloudWatch)|[Amazon Web Services S3](/azure/sentinel/data-connectors-reference#amazon-web-services-s3)|Yes|Yes|
63+
|AWSEKSLogs_CL|[AWS EKS Data Connector (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#aws-eks-data-connector-via-codeless-connector-framework)|No|No|
6364
|[AWSGuardDuty](/azure/azure-monitor/reference/tables/AWSGuardDuty)|[Amazon Web Services S3](/azure/sentinel/data-connectors-reference#amazon-web-services-s3)|Yes|Yes|
6465
|[AWSNetworkFirewallFlow](/azure/azure-monitor/reference/tables/AWSNetworkFirewallFlow)|[Amazon Web Services NetworkFirewall (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#amazon-web-services-networkfirewall-via-codeless-connector-framework)|Yes|Yes|
6566
|[AWSRoute53Resolver](/azure/azure-monitor/reference/tables/AWSRoute53Resolver)|[Amazon Web Services S3 DNS Route53 (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#amazon-web-services-s3-dns-route53-via-codeless-connector-framework)|Yes|Yes|
@@ -331,6 +332,9 @@ ms.date: 03/17/2026
331332
|JuniperIDP_CL|[Custom logs via AMA](/azure/sentinel/data-connectors-reference#custom-logs-via-ama)|Yes|Yes|
332333
|KeeperSecurityEventNewLogs_CL|[Keeper Security Push Connector](/azure/sentinel/data-connectors-reference#keeper-security-push-connector)|Yes|Yes|
333334
|LastPassNativePoller_CL|[LastPass Enterprise - Reporting (Polling CCP)](/azure/sentinel/data-connectors-reference#lastpass-enterprise---reporting-polling-ccp)|No|No|
335+
|LightningAttackPaths_CL|[Semperis Lightning Logs](/azure/sentinel/data-connectors-reference#semperis-lightning-logs)|No|No|
336+
|LightningIOEResults_CL|[Semperis Lightning Logs](/azure/sentinel/data-connectors-reference#semperis-lightning-logs)|No|No|
337+
|LightningTier0Nodes_CL|[Semperis Lightning Logs](/azure/sentinel/data-connectors-reference#semperis-lightning-logs)|No|No|
334338
|Lockdown_Data_CL|[Vectra XDR (using Azure Functions)](/azure/sentinel/data-connectors-reference#vectra-xdr-using-azure-functions)|Yes|Yes|
335339
|Lookout_CL|[[DEPRECATED] Lookout](/azure/sentinel/data-connectors-reference#deprecated-lookout)|No|No|
336340
|LookoutMtdV2_CL|[Lookout Mobile Threat Detection Connector (via Codeless Connector Framework) (Preview)](/azure/sentinel/data-connectors-reference#lookout-mobile-threat-detection-connector-via-codeless-connector-framework-preview)|Yes|Yes|
@@ -446,7 +450,6 @@ ms.date: 03/17/2026
446450
|SnowflakeUsers_CL|[Snowflake (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework)|Yes|Yes|
447451
|SOCPrimeAuditLogs_CL|[SOC Prime Platform Audit Logs Data Connector](/azure/sentinel/data-connectors-reference#soc-prime-platform-audit-logs-data-connector)|Yes|Yes|
448452
|Sonrai_Tickets_CL|[Sonrai Data Connector](/azure/sentinel/data-connectors-reference#sonrai-data-connector)|No|No|
449-
|SophosCloudOptix_CL|[Sophos Cloud Optix](/azure/sentinel/data-connectors-reference#sophos-cloud-optix)|No|No|
450453
|SophosEP_CL|[Sophos Endpoint Protection (using Azure Functions)](/azure/sentinel/data-connectors-reference#sophos-endpoint-protection-using-azure-functions)|Yes|Yes|
451454
|SophosEPEvents_CL|[Sophos Endpoint Protection (using REST API)](/azure/sentinel/data-connectors-reference#sophos-endpoint-protection-using-rest-api)|Yes|Yes|
452455
|SquidProxy_CL|[Custom logs via AMA](/azure/sentinel/data-connectors-reference#custom-logs-via-ama)|Yes|Yes|
@@ -500,6 +503,9 @@ ms.date: 03/17/2026
500503
|[WindowsEvent](/azure/azure-monitor/reference/tables/WindowsEvent)|[Windows Forwarded Events](/azure/sentinel/data-connectors-reference#windows-forwarded-events)|Yes|Yes|
501504
|Workplace_Facebook_CL|[Workplace from Facebook (using Azure Functions)](/azure/sentinel/data-connectors-reference#workplace-from-facebook-using-azure-functions)|No|No|
502505
|WsSecurityEvents_CL|[WithSecure Elements API (Azure Function)](/azure/sentinel/data-connectors-reference#withsecure-elements-api-azure-function)|Yes|Yes|
506+
|XbowAssessments_CL|[XBOW Security Platform (via Azure Function)](/azure/sentinel/data-connectors-reference#xbow-security-platform-via-azure-function)|No|No|
507+
|XbowAssets_CL|[XBOW Security Platform (via Azure Function)](/azure/sentinel/data-connectors-reference#xbow-security-platform-via-azure-function)|No|No|
508+
|XbowFindings_CL|[XBOW Security Platform (via Azure Function)](/azure/sentinel/data-connectors-reference#xbow-security-platform-via-azure-function)|No|No|
503509
|ZeroFox_CTI_advanced_dark_web_CL|[ZeroFox CTI](/azure/sentinel/data-connectors-reference#zerofox-cti)|No|No|
504510
|ZeroFox_CTI_botnet_CL|[ZeroFox CTI](/azure/sentinel/data-connectors-reference#zerofox-cti)|No|No|
505511
|ZeroFox_CTI_breaches_CL|[ZeroFox CTI](/azure/sentinel/data-connectors-reference#zerofox-cti)|No|No|
@@ -522,6 +528,11 @@ ms.date: 03/17/2026
522528
|ZeroFox_CTI_vulnerabilities_CL|[ZeroFox CTI](/azure/sentinel/data-connectors-reference#zerofox-cti)|No|No|
523529
|ZeroFoxAlertPoller_CL|[ZeroFox Enterprise - Alerts (Polling CCF)](/azure/sentinel/data-connectors-reference#zerofox-enterprise---alerts-polling-ccf)|Yes|Yes|
524530
|ZimperiumThreatLog_CL|[Zimperium Mobile Threat Defense](/azure/sentinel/data-connectors-reference#zimperium-mobile-threat-defense)|No|No|
531+
|ZNAudit_CL|[Zero Networks Segment (Push)](/azure/sentinel/data-connectors-reference#zero-networks-segment-push)|No|No|
532+
|ZNIdentityActivity_CL|[Zero Networks Segment (Push)](/azure/sentinel/data-connectors-reference#zero-networks-segment-push)|No|No|
533+
|ZNNetworkActivity_CL|[Zero Networks Segment (Push)](/azure/sentinel/data-connectors-reference#zero-networks-segment-push)|No|No|
534+
|ZNRPCActivity_CL|[Zero Networks Segment (Push)](/azure/sentinel/data-connectors-reference#zero-networks-segment-push)|No|No|
525535
|ZNSegmentAuditNativePoller_CL|[Zero Networks Segment Audit](/azure/sentinel/data-connectors-reference#zero-networks-segment-audit)|No|No|
526-
|Zoom_CL|[Zoom Reports (using Azure Functions)](/azure/sentinel/data-connectors-reference#zoom-reports-using-azure-functions)<br>[Zoom Reports Connector (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#zoom-reports-connector-via-codeless-connector-framework)|Yes|Yes|
536+
|Zoom_CL|[Zoom Reports (using Azure Functions)](/azure/sentinel/data-connectors-reference#zoom-reports-using-azure-functions)|Yes|Yes|
537+
|ZoomV2_CL|[Zoom Reports Connector (via Codeless Connector Framework)](/azure/sentinel/data-connectors-reference#zoom-reports-connector-via-codeless-connector-framework)|No|No|
527538
|ZPA_CL|[Custom logs via AMA](/azure/sentinel/data-connectors-reference#custom-logs-via-ama)|Yes|Yes|

0 commit comments

Comments
 (0)