Security operations
Microsoft Sentinel
Cloud-native SIEM, data lake and SOAR for the security operations centre.
News
Sentinel news
41 posts in the last 180 days from Microsoft's blogs, Tech Community and Azure Updates.
Sentinel
Catch Microsoft Defender and Sentinel at Ignite 2026
Join us at Microsoft Ignite 2026, November 17 to 20, in San Francisco and online.
Microsoft Defender XDR BlogSentinel
What’s new in Microsoft Sentinel: October 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
Growing our connector ecosystem with 500+ Microsoft Sentinel connectors
Connecting the modern security environment Having spent years working across Microsoft's cloud, AI, and customer-facing organizations.
Microsoft Sentinel BlogSentinelPreview
Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)
As security teams bring in more data from more sources and use it across SIEM and XDR workflows, decisions about connector health, ingestion volume, and cost…
Microsoft Sentinel BlogSentinelGA
Expanded cross-tenant delegated access in Microsoft Defender is generally available
Security operations rarely stop at a single tenant boundary.
Microsoft Sentinel BlogSentinel
Introducing the Microsoft Sentinel ASIM EmailEvent schema
Email remains one of the most common entry points for security threats.
Microsoft Sentinel BlogSentinel
What’s new in Microsoft Sentinel: September 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinelPreview
Public Preview: Multi-account support for Microsoft Sentinel codeless connectors
Security teams rarely have just one of anything. Most SOCs run separate production, staging, and development accounts.
Microsoft Sentinel BlogSentinel
Introducing Multi-Account Support for Connectors in Microsoft Sentinel
We're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion…
Microsoft Security Community Blog
Show 32 older posts
Sentinel
What’s new in Microsoft Sentinel: August 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse
Most large organizations don’t live in a single Microsoft Entra ID tenant.
Microsoft Security Community BlogSentinel
Smarter signals, broader coverage: UEBA anomalies on top of Behaviors layer and new data sources
Co-authors: Ron Shlomo and Ryan Smith Security teams don't struggle with a lack of security signals.
Microsoft Sentinel BlogSentinelRetirement
Retirement: Containerized data connector agent for the Microsoft Sentinel solution for SAP applications
On September 14, 2026 we will retire the containerized data connector agent for the Microsoft Sentinel solution for SAP applications.
Azure UpdatesSentinel
Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent
Overview We previously announced the public preview of the Microsoft Sentinel connector builder agent via VS code extension, that helps developers build Microsoft…
Microsoft Sentinel BlogSentinelGA
AI-powered playbook generator, now available to more customers
We’re excited to announce we’re making it easier than ever to go from intent to action with the AI-powered playbook generator now available to more customers.
Microsoft Sentinel BlogSentinelPreview
Public Preview: Nested API Support Comes to Microsoft Sentinel CCF
Microsoft Sentinel continues to evolve its capabilities to support an expanding ecosystem of partners and data integrations.
Microsoft Sentinel BlogSentinel
Building a CCF Nested API Pull Connector: A Technical Lab Walkthrough
This post walks through building a Microsoft Sentinel Codeless Connector Framework (CCF) RestApiPoller connector that uses the nested API polling pattern.
Microsoft Sentinel BlogSentinel
What’s new in Microsoft Sentinel: July 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
Run agentless SAP connector cost-efficiently
The SAP agentless connector uses SAP Integration Suite (Cloud Integration/CPI) to fetch SAP audit log data and forward it to Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
Announcing the ASIM Parser Creation Agentic Experience
Creating high-quality ASIM parsers has always required deep knowledge about source data and ASIM schemas, careful KQL design, and repeated validation cycles.
Microsoft Sentinel BlogSentinel
Building toward an Agentic SOC: A Portable, Autonomous Malware Investigation Agent
Modern Security Operations Centers are not short on tools. They are short on continuity.
Microsoft Sentinel BlogSentinel
Behind the Build with Gigamon: Enriching Microsoft Sentinel with Network-Derived Telemetry
Behind the Build is an ongoing series spotlighting standout Microsoft partner collaborations.
Microsoft Sentinel BlogSentinel
What’s new in Microsoft Sentinel: June 2026
Welcome back to What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
The AI-first SOC: Copilot, UEBA, threat intelligence, and SOC optimization
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The portal change was the easy part.
Microsoft Sentinel BlogSentinel
Your readiness playbook: adoption helper, costs, APIs, and the checklist
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The transition is not a project—it is a sequence of small, ordered decisions.
Action may be required
Microsoft Sentinel BlogSentinel
Understand your Sentinel tables at a glance: Monitor with table insights
What it is Table insights is a new panel on the Sentinel Tables page that gives you 30-day ingestion volume per tier, day-over-week fluctuations, the top 5…
Microsoft Tech CommunitySentinel
The governance shift: RBAC, URBAC, data lake, and MSSP
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Governance is the silent dependency every transition trips on.
Microsoft Sentinel BlogSentinel
A guide to innovating threat hunting with Microsoft Sentinel custom graph
Microsoft Sentinel platform offers a growing list of tools and features, with graph being a cornerstone capability.
Microsoft Sentinel BlogSentinel
Detection and automation, reimagined
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl How analytics rules, playbooks, workbooks, and hunting evolve in Defender—and why the…
Microsoft Sentinel BlogSentinel
Introducing New Additions to Microsoft Sentinel Normalization and ASIM
TL;DR: New ASIM parsers for Azure Firewall, Key Vault, AWS CloudTrail (EC2, S3, IAM), and 10+ third-party products.
Microsoft Tech CommunitySentinel
Anatomy of the change
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Incidents, alerts, correlation, and data—what actually changes with the new platform…
Microsoft Sentinel BlogSentinelPreview
Announcing Public Preview: Agent Identities Asset Connector for Microsoft Sentinel
As organizations accelerate adoption of AI agents across Microsoft 365 and enterprise environments, security teams face a fundamental shift: Agents are…
Microsoft Tech CommunitySentinel
Transform your security operation with a unified experience in Defender
Co-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Security operations teams today are being asked to do more than ever: respond faster…
Microsoft Sentinel BlogSentinel
The Worm in the Supply Chain: How Defender for Endpoint and Sentinel for SAP BTP Caught Shai-Hulud
On 29 April 2026, malicious versions of multiple SAP ecosystem npm packages were briefly published, creating a supply-chain exposure for SAP Cloud…
Microsoft Sentinel BlogSentinel
What’s new in Microsoft Sentinel: May 2026
Welcome to the May edition of What's new in Microsoft Sentinel.
Microsoft Sentinel BlogSentinel
Amazon Security Lake Integration with Microsoft Sentinel: Parquet at the Gates
This blog has been jointly published by and .
Microsoft Security Community BlogSentinel
Introducing the next generation of SOC automation: Sentinel playbook generator
Security teams today operate under constant pressure.
Microsoft Sentinel BlogSentinel
Microsoft Security Community Spotlight: Marcel Graewer
Globally, Marcel shares practical detection engineering insights on Microsoft Sentinel and Microsoft Defender XDR through forums and blog posts.
Microsoft Security Community BlogSentinelPreview
The Microsoft Copilot Data Connector for Microsoft Sentinel is Now in Public Preview
*Please note that this connector is now in GA status as of March, 2026* We are happy to announce a new data connector that is available to the public…
Microsoft Sentinel BlogSentinel
Migrate Sentinel to Defender - Why It Is a Security Architecture Decision, Not Just a Portal Change
Microsoft will retire the Sentinel experience in Azure on March 31, 2027.
Microsoft Security Community BlogSentinel
Agent 365 connector: Monitor, hunt, and investigate AI agent activity in Microsoft Sentinel
As enterprises scale the use of AI agents, SOC teams need visibility into AI agent behavior.
Microsoft Sentinel Blog
Content hub
Content hub updates
Solutions, connectors, detections and migrations merged into Microsoft's public Sentinel repository. Community and partner content, not a Microsoft product release.
New in the content hub
- Connector
Restore PurviewAudit CCF connectors in Microsoft Business Applications (v3.2.5)
Required items, please complete Change(s): - Restored the 3 missing PurviewAudit CCF connector source definitions, DCRs, and polling configs under `Solutions/Microsoft Business Applications/Data Connectors/`: - …
- Migration
Migrate Batch 8 Sentinel solutions to Defender XDR (v3.2.2)
Required items, please complete Change(s): - Migrate and qualify 7 Microsoft Sentinel solutions to Defender XDR hybrid V3.1 packages (removed `Box` and `ImpervaCloudWAF` per review feedback; bumped `SentinelOne` and …
- Detection
feat(toolkit): support multi-tactic XDR detections and enforce qualification default
Change(s): - V3.1 Packaging (Tools/Create-Azure-Sentinel-Solution/common/customDetections.ps1): Preserved the full authored actics[] array and nested echniques in Set-V31CustomDetectionTactics across both ARM Custom …
- Solution
Filewall for Microsoft 365 3.2.2: verdict-based alerts, XDR entities and Defender for Endpoint correlation
Change(s): - Filewall for Microsoft 365 solution 3.2.2. - Analytic rules `BlockedEmails` and `BlockedFiles` (1.1.0) now alert by Filewall verdict, not on every block: - antivirus malware is High; -…
- Solution
LicensingGovernance Workbook
Required items, please complete Change(s): - new workbook Reason for Change(s): - Making use of (preview) workbook feature to show Graph capability Version Updated: - v1 Testing Completed: - Yes
- Migration
Migrate Teams and Microsoft Active Directory Tier Model to Defender XDR (v3.2.2)
Summary Migrates 2 parser-free 1P Microsoft Sentinel solutions to Microsoft Defender XDR and packages each solution at `v3.2.2`: | Solution | Version | Analytic Rules - XDR Detections |…
- Detection
Add hunting query: Entra ID successful sign-in after account disabled
Change(s): - Added a new hunting query: Hunting Queries/MultipleDataSources/SuccessfulSignInAfterAccountDisabled.yaml Reason for Change(s): - After an Entra ID account is disabled during an incident, responders need to …
- Solution
[TheHive] - Adding multi-instance support
Required items, please complete Change(s): - Adding multi-instance support Reason for Change(s): - multi-instance support is required Version Updated: N/A Testing Completed: - - Checked that the validations are passing…
- Migration
Migrate Microsoft Copilot solution to Defender XDR in Qualification Mode (v3.2.2)
Required items, please complete Change(s): - Migrated Microsoft Copilot (`Solutions/Microsoft Copilot`, `3.0.2` - `3.2.2`) to Defender XDR in Qualification Mode with: - 4 Defender XDR Custom Detections (`XDR …
- Solution
Update to 0.1.3
Required items, please complete Change(s): - See guidance below Reason for Change(s): - See guidance below Version Updated: - Required only for Detections/Analytic Rule templates - See guidance below Testing…
- Solution
Reduce Salesforce Audit Trail ingestion transform size
Required items, please complete Change(s): - Reduce only `Parsers/ASimAuditEvent/IngestTimeParsers/ASimAuditEventSalesforceAuditTrail.yaml`: consolidate 87 ordered, unique Section equality mappings into six readable …
- Solution
Reduce CrowdStrike AuditEvent transform size
Required items, please complete Change(s): - Removed two redundant `EventType` and `ObjectType` case branches that returned the existing `Other` fallback; the parsed `ParserQuery` shrank from 14,907 to 14,242 characters …
- Detection
Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase
Change(s): - Data connector (Azure Function App, RubrikWebhookEvents): - Added collection of DSPM and Identity Resilience (IR) violation events into a new table, RubrikViolationDataCL, through a new …
- Migration
feat: migrate VMware Carbon Black Cloud to Defender XDR (v3.2.2)
Solutions to be Packaged (if applicable) VMware Carbon Black Cloud Description of Changes Full end-to-end Sentinel-to-Defender-XDR v3.2.2 migration and live qualification for VMware Carbon Black Cloud (1P …
- Solution
Add KELA BrandControl, IdentityGuard and Monitor solutions
Required items, please complete Change(s): - Added three new Microsoft Sentinel solutions for KELA, each built on a Codeless Connector Framework (CCF) data connector: - KELABrandControl - KELAIdentityGuard - KELAMonitor…
- Migration
Migrate Bitglass, DPDP Compliance, and SOX IT Compliance solutions to Defender XDR (v3.2.2)
Summary Migrate Bitglass, DPDP Compliance, and SOX IT Compliance solutions to Microsoft Defender XDR ( 3.2.2) with dual-deployment support (DeployCustomDetection / DeployDefenderWorkbook) and full end-to-end PR …
- Migration
feat: migrate Infoblox NIOS, Digital Guardian DLP, and Trend Micro CAS to Defender XDR (v3.2.2)
Summary End-to-end Defender XDR migration and V3.1 packaging (`v3.2.2`) for 3 solutions: - Infoblox NIOS (`Solutions/Infoblox NIOS`) - Digital Guardian Data Loss Prevention (`Solutions/Digital Guardian Data Loss …
- Detection
Add hunting queries for AI coding CLI permission bypass and MCP config tampering
Change(s): - Added two community hunting queries for AI coding assistants on endpoints (Defender for Endpoint tables): - Hunting Queries/DeviceProcess/AICodingCLIPermissionBypassFromPackageManager.yaml: Claude Code, …
- Migration
MailGuard 365: migrate data connector to CCF Push (v3.0.1)
Change(s): - Replace the HTTP Data Collector API connector with a Codeless Connector Framework Push connector using the Azure Monitor Logs Ingestion API (connector definition, DCR, table, polling config) -…
- Migration
Migrate 5 Sentinel solutions to Defender XDR in Qualification Mode (v3.2.3)
Required items, please complete Change(s): - Migrated 5 Microsoft Sentinel solutions to version `3.2.3` with Defender XDR Custom Detections (`XDR Detections/`), Defender XDR Workbooks (`XDR Workbooks/`), V3.1 hybrid …
- Solution
Package MPIP solution version 3.0.1
Required items, please complete Change(s): - See guidance below Reason for Change(s): - See guidance below Version Updated: - Required only for Detections/Analytic Rule templates - See guidance below Testing…
- Migration
feat: migrate Threat Intelligence (NEW), Sentinel SOAR Essentials, and Threat Analysis & Response to Defender XDR
Summary End-to-end Defender XDR migration and V3.1 packaging (`v3.2.2`) for 3 solutions: - Threat Intelligence (NEW) (`Solutions/Threat Intelligence (NEW)`) - Sentinel SOAR Essentials (`Solutions/SentinelSOARessentials`) …
- Migration
SentinelToXDRMigration: qualification follow-ups, XDR static KQL override, and NPF metrics
Required items, please complete Change(s): - Implement Sentinel-to-XDR Migration Toolkit qualification follow-ups (Todos 0 through 6): - Todo 0 (Security Gate & Test/Profile Isolation): Isolate Azure CLI profile checks …
- Solution
sap contribution add janik
Change(s): - Contributor added
- Migration
Migrate Palo Alto Prisma Cloud CSPM to Defender XDR (3.2.2)
Checklist: [x] Have you checked that there aren't other open [Pull Requests](../../pulls) for the same update/change? [ ] Determines the status of the solution validation failure through…
- Detection
Add HoneyForge Threat Detection solution v1.0.0
Change(s): - New solution: HoneyForge Threat Detection v1.0.0 — CEF/Syslog data connector, NRT analytic rule, ASIM NetworkSession parser, 5 hunting queries, operational workbook Reason for Change(s): - New Content Hub…
- Connector
[CrowdstrikeAPIConnector] - support multi select for data connector grid
- update DCR name for V2 - include link for upgrade notes in connector - multi select for data connectors grid
- Solution
Updating Content for CrowdStrike Solution
Update two CrowdStrike Falcon analytic rule YAMLs to prepend "Common Event Format (CEF) via AMA -" to the rule names (CriticalOrHighSeverityDetectionsByUser and CriticalSeverityDetection) and increment the version from …
- Detection
Updated Microsoft Entra ID Analytic Rule SigninAttemptsByIPviaDisabledAccounts to include the additional "ResultDescription" value: "The user account is disabled."
Change(s): - Updated `Microsoft Entra ID Analytic Rule SigninAttemptsByIPviaDisabledAccounts` to include the additional `"ResultDescription"` value: `"The user account is disabled."` Reason for Change(s): During the …
- Solution
Quality updates for Okta SSO Content
Required items, please complete Change(s): - Refine multiple Okta SSO analytic rules and hunting queries: improve KQL parsing and filtering, introduce configurable variables (thresholds, allowed IPs/users/admins, …
- Solution
Replace deprecated yaml.safeLoad with yaml.load
safeLoad was deprecated in js-yaml v4 and removed in favor of load. Required items, please complete Change(s): - See guidance below Reason for Change(s): - …
Maintenance
- Maintenance
[ASIM] Unify ITP platform-managed column handling
Fixes Proposed Changes - Centralize platform-managed fields in `PLATFORMMANAGEDCOLUMNS` with case-insensitive matching. - Exclude managed fields from fixture schema preparation, immutable snapshots, parser and raw-replay …
- Maintenance
feat(toolkit): auto-bump and validate patch version on modified Analytic Rules and XDR Detections
Contribution Checklist: - [x] The pull request only addresses one issue or adds one feature. - [x] The pull request does not introduce any breaking changes - [x] I…
- Maintenance
Add Fortinet ingestion-time ASIM parsers
Add Authentication, DNS, Network Session, and Web Session service definitions in their schema-specific IngestTimeParsers directories.
- Maintenance
Add AWS CloudTrail ingestion-time ASIM parsers
Add Authentication, File Event, and User Management Ingest-Time Parsers layout.
- Maintenance
[ASIM] Fix ITP replay and validation workflow
Required items, please complete Change(s): - Use the immutable parser-input snapshot schema and rows for optional QTP raw replay so row-only source fields are retained. - Exclude only platform-managed `TenantId`…
- Maintenance
[ASIM] Use native IP validation in Salesforce Login History ITPs
Required items, please complete Change(s): - Replaced the lossy regex-based Salesforce source IP validation with DCR-supported `parseipv4` and `parseipv6` calls in both Salesforce Login History Authentication …
- Maintenance
[ASIM] Updates to CrowdStrike Falcon CSL Authentication parser
Required items, please complete Change(s): - Update both CrowdStrike FalconHost ASIM Authentication parsers to derive event timestamps from `ReceiptTime` as Unix milliseconds. - Map `DestinationTranslatedAddress` to …
- Maintenance
[Network Session Essentials] Fix Kusto CRT0013 visitor limit in ASIM network session anomaly queries (v3.2.4)
Summary Updates the Network Session Essentials solution to v3.2.4 to resolve Kusto `CRT0013` (`Semantic pass has exceeded the max allowed visitors count - 10001`) errors when saving or evaluating…
- Maintenance
Fix Microsoft Copilot workbook empty-table parameter syntax error (v3.2.2)
Description: Follow-up to Azure/Azure-Sentinel15543 for Microsoft Copilot (`v3.2.2`): - Fixed the `SYN0002: Query could not be parsed at ')' on line [4,17]` syntax error in both the Microsoft Sentinel …
- Maintenance
[ASIM] Harden ingestion-time parser validation
Required items, please complete Change(s): - Enforced the normalization compiler's exact source-pipeline shape: one expression statement rooted at lowercase `source`. - Ignored only `TenantId`, `TimeGenerated`, `Type`, …
- Maintenance
[ASIM] Add CHANGELOG to ITP
Required items, please complete Change(s): - Add 34 ingestion-time parser changelogs and relocate 2 existing histories to `CHANGELOG/IngestTimeParsers/`. - Update ASIM changelog instructions to distinguish query-time and …
- Maintenance
[ASIM] Add remaining ITP for AWSCloudTrail AuditEvent
Merged into Azure/Azure-Sentinel.
- Maintenance
Fix V3 storage blob connector packaging compatibility
Fixes Proposed Changes - Preserve the existing `ServicePrincipal` role-assignment GUID formulas while using scope-, principal-, and role-aware GUIDs for `ManagedServicePrincipal` storage blob connectors. - Keep all three …
- Maintenance
[ASIM] Create AWSCloudTrail AuditEvent ITP regarding Account and Infra
Required items, please complete Change(s): - Add the AWS CloudTrail EC2 AccountAndInfrastructure AuditEvent ingestion-time parser and source-specific sample data. Reason for Change(s): - Normalize the supported …
- Maintenance
[ASIM] Replace static KQL parsing with Kusto.Language
Required items, please complete Change(s): - Added a trusted .NET 8 analyzer using Microsoft.Azure.Kusto.Language 12.4.1 with a locked NuGet dependency. - Replaced custom regex/tokenizer-based KQL validation with …
- Maintenance
3.1.2 BUFGIX:
Change(s): - queryWindowInMin:1440 added to Data Connector Reason for Change(s): - bugfix polling interval = 5min Testing Completed: - Yes Checked that the validations are passing and have addressed any…
- Maintenance
[Network Session Essentials] Fix NetworkSessionEssentialsCustomParser empty table fallback (v3.2.3)
Summary - Updates `Solutions/Network Session Essentials/Parsers/NetworkSessionEssentialsCustomParser.yaml` (v1.0.1) to union `fuzzy=true` with an empty `datatable(...)[]` fallback containing all columns referenced by the …
- Maintenance
[ASIM] Compare only AdditionalFields keys in ITP parity validation
Required items, please complete Change(s): - Compare only case-sensitive top-level keys in dynamic `AdditionalFields` property bags during QTP/ITP parity. Keep other values, schema types, and duplicate counts strict, …
- Maintenance
[ASIM] Fix GUID type mismatches in ingestion-time validation raw replay
Required items, please complete Change(s): - Read raw-replay destination types from ARM table metadata, including standard columns, so GUID fields receive `toguid()` conversions. Add regression coverage and update …
- Maintenance
Fix AWS GuardDuty ingestion parser count selector
Change(s): - Escape both ServiceDetails["count"] selectors in the AWSGuardDuty ingestion-time parser; update parser to 0.1.1 and dates to 2026-11-09. Reason for Change(s): - ARM ingestion compilation rejects the …
- Maintenance
SentinelToXDRMigration: table-catalog follow-ups, preserve TimeGenerated, and locale URL validation
Required items, please complete Change(s): - Complete Sentinel-to-XDR Migration Toolkit table-catalog and URL validation follow-ups (`Tools/SentinelToXDRMigration/FOLLOWUPS.md` items 1–6): - Follow-up 1 (Unblock 6 …
- Maintenance
[ASIM] Update optimized parser unit-test expectation
Required items, please complete Change(s): - Removed `ASimAuthenticationSalesforceServiceCloud.yaml` from the repository test's `oversizedqueryparsers` exception set. - Removed the stale assertion that this parser must …
- Maintenance
[ASIM] Stop compacting ingestion parser KQL
Required items, please complete Change(s): - Removed `compactkql` and all imports/exports of the helper. - Submit `ParserQuery` to the parser DCR exactly as decoded from YAML, preserving comments, indentation, …
- Maintenance
Reduce Salesforce V2 ingestion parser transform length
Proposed Changes - Only change `ASimAuditEventSalesforceAuditTrailV2CL.yaml` and its filename-matched changelog. This branch is based directly on `master`, not stacked on the CrowdStrike work. - Group 87 unique, …
- Maintenance
[ASIM] Optimize parser for Salesforce Service Cloud Authentication
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Fix CrowdStrikeDetections AlertEvent ITP
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Align ASIM AWSCloudTrail Authentication parser types to ASim table
Merged into Azure/Azure-Sentinel.
- Maintenance
Fix Salesforce ingestion-time source-rooted IP validation
Required items, please complete Change(s): - Fix both Salesforce Authentication ingestion-time variants: `ASimAuthenticationSalesforceLoginHistory.yaml` and `ASimAuthenticationSalesforceLoginHistoryV2CL.yaml`. - Inline …
- Maintenance
[ASIM] Align raw replay DCR transforms with destination column types
Required items, please complete Change(s): - Read raw replay destination column types and cast mismatched fixture columns, including string-to-GUID conversions. Preserve parser DCR behavior and fixture input types; add …
- Maintenance
[ASIM] Fix Proofpoint POD MailLog inline ingestion-time IP validation
Summary - Fix only the Proofpoint POD MailLog ingestion-time parser. The parser is present on upstream master; no dependent PR or unrelated content is included. - Replace parseipv4/parseipv6 with…
- Maintenance
[ASIM] Fix AlertEvent FileSize type mismatch in ITP validation
Required items, please complete Change(s): - Cast `ASimAlertEventLogs.FileSize` to `long` only in ASimDataTester input; add regression tests and documentation. Ingestion and QTP parity remain unchanged. Reason for …
- Maintenance
SilentPush: 3.1.1 BUFGIXES
Change(s): - Playbooks now declare a dependency on the SilentPush-API custom connector - renamed the workspace parameter to WorkspaceName - connection now uses the resource group location instead of reference()…
- Maintenance
[ASIM] Add native parsers to schemas that did not have them (AgentEvent, EmailEvent, AssetEntity, AlertEvent)
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Add Salesforce Real-Time Event Monitoring parsers
Summary - regenerate the Salesforce PermissionSetEventStore AuditEvent and UserManagement parsers from the Salesforce object contract - normalize enabled/disabled permissions into AuditEvent value fields and permission …
- Maintenance
[ASIM] Refactor AWSCloudTrail AuditEvent into smaller parsers
Merged into Azure/Azure-Sentinel.
- Maintenance
Add ASIM Proofpoint TAP blocked-click ingestion-time parser
Required items, please complete Change(s): - Add `ASimEmailEventProofpointTAPClicksBlockedIngestTime.yaml` under `Parsers/ASimEmailEvent/IngestTimeParsers/` and its own filename-matched changelog. - Convert the merged …
- Maintenance
[ASIM] Support ParentParser validation and deduplicate sample ingestion
Change(s): - Add support for optional top-level `ParentParser` YAML metadata in ASIM query-time template validation. Missing, null, or empty values retain the existing `ASim ` / `im ` defaults. -…
- Maintenance
Add ASIM Proofpoint TAP blocked-click query-time parsers
Required items, please complete Change(s): - Add parameterless and filtering ASIM EmailEvent query-time parsers for `ProofPointTAPClicksBlockedV2CL`. - Register both parsers in the EmailEvent unifiers, forward …
- Maintenance
[ASIM] AWSCloudTrail Authentication ITP
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Fix IPv4-prefix filtering validator SDK row comparison
Fixes the SDK row-identity comparison defect in ASIM filtering validation; relates to 15514. Proposed Changes - Normalize Azure Monitor SDK rows to Python lists before the order-independent `assertCountEqual` comparison…
- Maintenance
[Citrix DaaS Connector] - Fixing duplicate records issue
Change(s): - Citrix DaaS CCF connector: switched the Sessions and ConfigLog Operations pollers from GET /Sessions and GET /ConfigLog/Operations to POST /Sessions/$search and POST /ConfigLog/Operations/$search, with a …
- Maintenance
[ASIM] Create ITP for Proofpoint TAP Delivered
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Exclude ITP yaml files in QTP workflows
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Create ITP for Proofpoint TAP Blocked
Merged into Azure/Azure-Sentinel.
- Maintenance
Resolve ASIM QTP sample collisions while preserving valid legacy fixtures
Change(s): - Add source-aware sample discovery to the existing trusted ASIM file helper and use it consistently in QTP template validation and sample ingestion. - Preserve `{Vendor}{Product}{Schema}IngestedLogs.csv` when …
- Maintenance
Remove unused "WEBSITE_NODE_DEFAULT_VERSION": "~10"
Required items, please complete Change(s): - Repackaged Reason for Change(s): - Remove unused "WEBSITENODEDEFAULTVERSION": "~10" - updated version "WEBSITENODEDEFAULTVERSION" from "~12" to "~22" Version Updated: - …
- Maintenance
[ASIM] Create EmailEvent parser for ProofPointTAPMessagesDeliveredV2_CL and ProofPointTAPMessagesBlockedV2_CL
Merged into Azure/Azure-Sentinel.
- Maintenance
[ASIM] Create CrowdStrike Falcon DNS ITP
Merged into Azure/Azure-Sentinel.
- Maintenance
Exclude ITPs from legacy ASIM template validation
Related to 15463 Proposed Changes - Exclude `IngestTimeParsers/` YAML from the legacy query-time parser template validator's changed-file selection. - Keep ingestion-time validation on its dedicated workflow and preserve …
- Maintenance
[ASIM] Add Proofpoint POD MailLog ingestion-time parser
Required items, please complete Change(s): - Add the Proofpoint POD MailLog ingestion-time EmailEvent parser targeting ASimEmailEventLogs. - Add its source-table-specific CSV fixture and separate ingestion-time parser …
- Maintenance
fix packaging script nested property parsing logic
Required items, please complete Change(s): - See guidance below Reason for Change(s): - Netskopev2 incident due to packaging tool not able to parse nested property parsing logic Version Updated: -…
- Maintenance
[Salesforce] - Corrected the parser metadata version
Reverted back the parser version from 3.x.x to 1.0.1
- Maintenance
Harden ASIM tester workflow for fork PRs
Strengthens pullrequesttarget security controls in the ASIM schema/data tester workflow. Adds a fork+SafeToRun approval check that validates the labeler has write/maintain/admin access, narrows secret-bearing jobs to run …
- Maintenance
Use js-yaml load in YAML validators
Replaced deprecated `safeLoad` calls with `load` in both local validation scripts. This aligns with current `js-yaml` APIs and keeps YAML syntax validation working across the validation pipeline. Required items, please…
- Maintenance
Fix field references in Log4j WAF detection rule
Corrects the columnifexists references in the Log4j vulnerability detection rule to use the proper field names from AdditionalFields. The detailsmessages and detailsmsgs fields were referencing incorrect suffixed field …
No content hub updates match.
Product changes
New features and changes
All 34 entries Microsoft documented on Learn in the last 12 months, newest first.
October 2026
- Preview
Detect use of vulnerable SAP BTP custom apps (Preview)
The SAP BTP solution adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect use of custom apps with open high or critical vulnerabilities. The rule identifies interactive XSUAA logins that match a…
DocsMicrosoft Sentinel Solution for SAP BTP - security content referenceNew
Microsoft Sentinel Solution for SAP BTP - security content reference Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.
September 2026
- New feature
Use Sentinel MCP triage collection to query data
Use the triage collection in the Microsoft Sentinel MCP server to discover and query data using MCP tools. Use the list advanced hunting tables tool to return a list of all available tables in the built-in data lake. Use the…
DocsTriage Tool Collection in Microsoft Sentinel MCP Server
Triage Tool Collection in Microsoft Sentinel MCP Server Explore the Microsoft Sentinel MCP triage tools for incident triage and hunting, including tools to fetch incidents, alerts, entities, and run hunting queries.
- New feature
Use Microsoft Fabric for data federation
When cost, governance, or compliance requirements prevent data movement, customers can query the data where it resides using data federation. Using Data federation, you can enrich investigations with context from data stored outside the data lake. You can use Microsoft…
DocsUnify Data Sources With OneLake ShortcutsUpdatedMirroring
Unify Data Sources With OneLake Shortcuts OneLake shortcuts provide a way to connect to existing data without having to directly copy it. Learn how to use them.
- New feature
Use Microsoft Fabric for custom security analytics
Microsoft Fabric enables custom analytics across data lake tables and external data tables. You can use KQL , notebooks , scheduled jobs , and custom graphs within Microsoft Fabric to analyze and enrich data at scale and then store results…
DocsData Collection Rules in Azure MonitorNewHow graph in Microsoft Fabric worksUpdatedQuery data in a KQL querysetHow to use notebooks
Data Collection Rules in Azure Monitor Learn when to work directly with data collection rules (DCRs) and how they provide centralized, reusable control for Azure Monitor data collection.
- GA
Run interactive KQL queries in advanced hunting
Interactive Kusto Query Language (KQL) queries on the data lake are now available using Advanced Hunting under Investigation & Response in the Defender portal. Use the Advanced Hunting page to investigate data from both Microsoft Sentinel and Microsoft Defender XDR…
DocsAdvanced hunting with Microsoft Sentinel data in Microsoft DefenderUpdated
Advanced hunting with Microsoft Sentinel data in Microsoft Defender Learn how to use advanced hunting in the portal unifying Defender XDR and Sentinel data
- New feature
Mirror the data lake tier to Microsoft Fabric OneLake
Using the Azure Monitor mirroring feature, you can select the Microsoft Sentinel workspace tables you want to expose in Microsoft Fabric. The mirroring feature doesn't create a copy of the data and incurs no additional charge. The data remains in…
DocsTutorial: Configure the Mirror Azure Monitor Solution in Fabric …Updated
Tutorial: Configure the Mirror Azure Monitor Solution in Fabric (Preview) Learn how to create a mirrored Azure Monitor item in Microsoft Fabric and access Log Analytics tables through the Eventhouse endpoint or a Lakehouse shortcut.
- New feature
Integrated Microsoft Sentinel SIEM and data lake onboarding
The data lake comes integrated with Microsoft Sentinel and continues as the low-cost ingestion and storage tier for long-term retention inside Sentinel. Going forward, you do not need to go through a separate data lake onboarding and billing setup. You…
DocsOnboard to Microsoft SentinelUpdatedConnect Microsoft Sentinel to the Microsoft Defender portalUpdated
Onboard to Microsoft Sentinel In this quickstart, you enable Microsoft Sentinel, and set up data connectors to monitor and protect your environment.
- New feature
Enable the data lake tier using Table management
Once you've onboarded to Microsoft Sentinel in Defender portal, you can use the Table Management page to enable the data lake tier. Select a table, and then select Retention to view data-retention settings . From here, you can mirror data…
DocsManage data tiers and retention in Microsoft Sentinel
Manage data tiers and retention in Microsoft Sentinel Manage log data in Microsoft Sentinel and with Microsoft Defender XDR services in the Microsoft Defender portal to optimize security operations and cost efficiency.
August 2026
- Preview
UEBA anomalies on behaviors (Preview)
Microsoft Sentinel now adds contextual anomaly insights directly to UEBA behavior records. These insights help analysts identify first-seen activity, unusually high behavior volumes, uncommon values, and threat intelligence matches without manually correlating raw events. For more information, see Investigate anomalies…
DocsInvestigate anomalies on UEBA behaviors in Microsoft Sentinel
Investigate anomalies on UEBA behaviors in Microsoft Sentinel Learn how Microsoft Sentinel enriches UEBA behaviors with anomaly insights and how to query these insights in the Microsoft Defender portal.
- New feature
SAP solution releases
The SAP agentless solution version 1.1.12 adds audit log performance enhancements and the force-sal-filesystem parameter. The SAP BTP solution version 3.1.1 adds an analytic rule for unaudited custom apps with login-only activity and renames analytic rules with the SAP BTP…
DocsSAP agentless solutionSAP BTP solutionSAP LogServ solution
- Preview
New data sources for UEBA behaviors and anomaly detection (Preview)
Microsoft Sentinel UEBA expands coverage with new data sources for both the behaviors layer and anomaly detection. Fortinet FortiGate behaviors The UEBA behaviors layer now supports Fortinet FortiGate firewall events from the CommonSecurityLog table. More than 40 new behaviors identify…
July 2026
- Preview
Custom detection rules support in Microsoft Sentinel Repositories (Preview)
You can now manage custom detection rules as code in your GitHub or Azure DevOps repository using the Microsoft Security BICEP extension. Sync custom detection rules to Microsoft Sentinel using the Repositories feature, or deploy them directly using BICEP CLI…
DocsOverview of custom detections in Microsoft Defender XDRManage custom content with repository connections
Overview of custom detections in Microsoft Defender XDR Understand how you can use advanced hunting to create custom detections and generate alerts.
June 2026
- Preview
Reason over Microsoft Sentinel graphs with graph tool (Preview)
The graph tool collection in the Microsoft Sentinel Model Context Protocol (MCP) server provides visual graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps. For more information, see Explore Microsoft Sentinel graphs…
DocsData Exploration Tool Collection in Microsoft Sentinel MCP Server
Data Exploration Tool Collection in Microsoft Sentinel MCP Server Learn how to search tables, run KQL queries, analyze entities, and explore graphs by using the data exploration tools in the Microsoft Sentinel MCP server.
- Preview
Link behavior results to incidents in advanced hunting (Preview)
You can now link behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting. This feature lets you enrich incident context with behavior records from Microsoft Sentinel UEBA. The wizard automatically populates alert metadata and…
DocsLink query results to an incident
Link query results to an incident Use the link to incident feature in Microsoft Defender XDR to attach advanced hunting query results to a new or existing incident for richer investigation context.
May 2026
- New feature
UEBA enhancements: New settings experience, Okta V2 support, and more GCP anomaly detections
We introduced a new entry point and created a consolidated view for the UEBA Settings and the Behaviors Settings. You can now access the UEBA settings from the new UEBA tab in the Microsoft Sentinel settings page. For more information…
DocsEnable entity behavior analytics to detect advanced threatsMicrosoft Sentinel User and Entity Behavior Analytics (UEBA) referenceAnomalies detected by the Microsoft Sentinel machine learning engine
Enable entity behavior analytics to detect advanced threats Enable User and Entity Behavior Analytics in Microsoft Sentinel, and configure data sources
- GA
Generate playbooks using AI in Microsoft Sentinel is now generally available (GA)
You can now generate playbooks using AI in Microsoft Sentinel . The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. For more information, see the Playbook Generation blog post…
DocsGenerate playbooks using AI in Microsoft Sentinelthe Playbook Generation blog post
Generate playbooks using AI in Microsoft Sentinel Generate playbooks through natural language conversations directly in the Defender portal.
April 2026
- New feature
[Updated] Call to action: update automation by July 1, 2026 - Account Name is now consistently the UPN prefix for analytics rule alerts
Microsoft Sentinel is updating how the account entity's Account Name value is populated for analytics rule alerts when the full UPN is mapped into Account Name. This change improves consistency for downstream automation rules and Logic Apps playbooks. This change…
DocsPost Update: Changing the Account Name Entity Mapping in Microsoft Sentinel
Update: Changing the Account Name Entity Mapping in Microsoft Sentinel The upcoming update introduces more consistent and predictable entity data across analytics, incidents, and automation by standardizing how the Account Name...
- Preview
Transform data with filter and split features (Preview)
Native filtering and splitting in the Microsoft Defender portal helps you reduce noise before ingestion, control costs, and intelligently route data between analytics and data lake tiers so you can optimize what gets analyzed versus retained. For more information, see…
DocsTransform data using filter and split in Microsoft Sentinel
Transform data using filter and split in Microsoft Sentinel Learn how to use filter and split data transformations to streamline ingestion, reduce costs, and route data between Analytics and Data lake tiers in Microsoft Sentinel.
- Preview
Microsoft Sentinel data federation (Preview)
Powered by Microsoft Fabric, Microsoft Sentinel data federation lets you analyze security data where it already lives, without copying or duplicating it. You can federate data from Microsoft Fabric, Azure Data Lake Storage, and Azure Databricks into Microsoft Sentinel data…
DocsData federation overview in Microsoft Sentinel data lake
Data federation overview in Microsoft Sentinel data lake Learn how data federation in Microsoft Sentinel data lake enables seamless querying of external data sources including Azure Databricks, ADLS Gen 2, and Microsoft Fabric.
- GA
Entity analyzer is now generally available
Entity analyzer in the Microsoft Sentinel Model Context Protocol (MCP) data exploration tool collection lets you get out-of-the-box, explainable entity risk assessments for URLs and identities using threat intelligence, prevalence, and organizational context. Important Starting April 1, 2026, you're charged…
DocsData Exploration Tool Collection in Microsoft Sentinel MCP ServerMicrosoft Sentinel MCP server pricing, limits, and availability
Data Exploration Tool Collection in Microsoft Sentinel MCP Server Learn how to search tables, run KQL queries, analyze entities, and explore graphs by using the data exploration tools in the Microsoft Sentinel MCP server.
- Preview
Cost estimation tool for customers and partners (Preview)
A guided, meter-level Microsoft Sentinel cost estimator with three-year projections helps organizations model data growth, predict spend, and plan Microsoft Sentinel adoption with confidence. For more information, see Microsoft Sentinel pricing .
- Preview
Configure row-level access using Microsoft Sentinel scoping (Preview)
Microsoft Sentinel now supports scoping (row-level RBAC) to control access to specific subsets of Sentinel data without requiring workspace separation. Administrators can define logical scopes, tag data at ingestion time, and assign users or groups to scopes using Unified RBAC…
DocsConfigure Microsoft Sentinel scoping (row-level RBAC)
Configure Microsoft Sentinel scoping (row-level RBAC) Create and apply Microsoft Sentinel scopes to control access to data at the row level.
- Preview
Build custom graphs (Preview)
Build tailored security graphs across the Sentinel data lake and third-party data to uncover attack paths, blast radius, and hidden relationships. These graphs also serve as a foundation for advanced investigations and AI agents. For more information, see Custom Graph…
DocsCustom Graphs in Microsoft Sentinel Overview (Preview)
Custom Graphs in Microsoft Sentinel Overview (Preview) Learn how custom graphs in Microsoft Sentinel help you model connected security data from Sentinel data lake and external sources to visualize attack paths, uncover hidden relationships, and improve investigations.
- Preview
Accelerate Microsoft Sentinel connector development with Visual Studio Code connector builder agent (Preview)
An AI-powered, low-code agent in Visual Studio Code helps you build Microsoft Sentinel connectors in minutes, bringing in new data sources faster and unlocking security outcomes sooner. For more information, see Get started with custom connectors using AI agent in…
DocsBuild custom connectors with AI in Microsoft Sentinel
Build custom connectors with AI in Microsoft Sentinel Build custom Microsoft Sentinel data connectors in minutes with the AI connector builder agent in Visual Studio Code. Reduce development time from weeks to hours.
- GA
AI-powered SIEM migration tool is now generally available
Accelerate migrations to Microsoft Sentinel from Splunk and QRadar using an AI-assisted SIEM migration experience designed to reduce manual effort and speed time-to-value. For more information, see Migrate to Microsoft Sentinel with the SIEM migration experience .
DocsUse the SIEM Migration Experience
Use the SIEM Migration Experience Migrate security monitoring use cases from other Security Information and Event Management (SIEM) systems to Microsoft Sentinel.
March 2026
- New feature
Call to action: update older Microsoft Sentinel content as code (Sentinel repositories) API versions before June 15, 2026
Starting June 15, 2026 , older API versions used by Microsoft Sentinel repositories will no longer be supported. This change impacts all Source Control and Source Controls actions in the Microsoft Sentinel REST API for the affected API versions. The…
DocsSource Control - REST API (Azure Sentinel)NewSource Controls - REST API (Azure Sentinel)NewManage custom content with repository connections
Source Control - REST API (Azure Sentinel) Learn more about [Sentinel Source Control Operations]. How to [list Repositories].
February 2026
- GA
Microsoft Sentinel UEBA behaviors layer is now generally available
The UEBA behaviors layer in Microsoft Sentinel is now generally available, summarizing clear, human‑readable behavioral insights from high-volume, raw security logs. The behaviors layer aggregates and sequences related events into normalized behaviors, helping analysts more quickly understand who did what…
DocsTranslate raw security logs to behavioral insights using UEBA …Post Re: Extract data using text within set of data
Translate raw security logs to behavioral insights using UEBA behaviors in Microsoft Sentinel The Microsoft Sentinel UEBA behaviors layer translates security telemetry into normalized behavioral patterns for investigation, hunting, and detection engineering.
- Preview
Generate playbooks using AI in Microsoft Sentinel (Preview)
You can now generate playbooks using AI in Microsoft Sentinel . The SOAR playbook generator creates python based automation workflows coauthored through a conversational experience with Cline, an AI coding agent. For more information, see the Playbook Generation blog post…
DocsGenerate playbooks using AI in Microsoft Sentinelthe Playbook Generation blog post
Generate playbooks using AI in Microsoft Sentinel Generate playbooks through natural language conversations directly in the Defender portal.
January 2026
- Retirement
Updated date: Microsoft Sentinel in the Azure portal to be retired March 2027
Microsoft Sentinel is generally available in the Microsoft Defender portal , including for customers without Microsoft Defender XDR or an E5 license. This means that you can use Microsoft Sentinel in the Defender portal even if you aren't using other…
DocsIntegrated Security Operations Center (ISOC) in Microsoft DefenderNewMicrosoft Sentinel in the Microsoft Defender portalUpdatedTransition Your Microsoft Sentinel Environment to the Defender PortalUpdatedPost Planning your move to Microsoft Defender portal for all Microsoft …
Integrated Security Operations Center (ISOC) in Microsoft Defender Learn how Integrated Security Operations Center (ISOC) in Microsoft Defender brings XDR, SIEM, threat intelligence, automation, and AI together, including eligibility and workspace requirements.
- Preview
UEBA behaviors layer aggregates actionable insights from raw logs in near-real time (Preview)
Microsoft Sentinel introduces a UEBA behaviors layer that transforms high-volume, low-level security logs into clear, human-readable behavioral insights in the Defender portal. This AI-powered capability aggregates and sequences raw events from supported data sources into normalized behaviors that explain "who…
DocsTranslate raw security logs to behavioral insights using UEBA …
Translate raw security logs to behavioral insights using UEBA behaviors in Microsoft Sentinel The Microsoft Sentinel UEBA behaviors layer translates security telemetry into normalized behavioral patterns for investigation, hunting, and detection engineering.
- New feature
New detections for Sentinel solution for SAP BTP
This update expands detection coverage for SAP BTP , strengthening visibility into high‑risk control plane, integration, and identity activities. SAP Integration Suite : Detects unauthorized changes to integration artifacts, access policies, JDBC data sources, and package imports that could enable…
DocsMicrosoft Sentinel Solution for SAP BTP - security content referenceNew
Microsoft Sentinel Solution for SAP BTP - security content reference Learn about the built-in security content provided by the Microsoft Sentinel Solution for SAP BTP.
- Preview
New Entity Behavior Analytics (UEBA) widget in the Defender portal home page (Preview)
The Defender portal home page now includes a UEBA widget where analysts can immediately have visibility into anomalous user behavior and therefore accelerate threat detection workflows. For more information, see How UEBA empowers analysts and streamlines workflows .
DocsAdvanced threat detection with User and Entity Behavior Analytics …
Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel Create behavioral baselines for entities (users, hostnames, IP addresses) and use them to detect anomalous behavior and identify zero-day advanced persistent threats (APT).
- Preview
Enable UEBA directly from data connector configuration (Preview)
You can now enable UEBA for supported data sources directly from the data connector configuration page, reducing management time and preventing coverage gaps. When you enable new connectors, you can onboard the data source to UEBA without navigating to a…
DocsConnect Data Sources to Microsoft Sentinel by using Data Connectors
Connect Data Sources to Microsoft Sentinel by using Data Connectors Learn how to connect data sources to Microsoft Sentinel using data connectors for improved threat detection.
December 2025
- Preview
Triage collection
Triage collection. Use triage collection to prioritize incidents and hunt threats with the Sentinel Model Context Protocol (MCP) server.
DocsTriage Tool Collection in Microsoft Sentinel MCP Server
Triage Tool Collection in Microsoft Sentinel MCP Server Explore the Microsoft Sentinel MCP triage tools for incident triage and hunting, including tools to fetch incidents, alerts, entities, and run hunting queries.
No changes match.