What's new in Microsoft Security: November 2026

SentinelNov 12

[ASIM] Unify ITP platform-managed column handling

Fixes # ## Proposed Changes - Centralize platform-managed fields in `PLATFORM_MANAGED_COLUMNS` with case-insensitive matching.

Threat IntelligenceNov 12

Trained to betray: How post-training supply chain attacks hijack coding agents

Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious…

SentinelNov 12

Restore PurviewAudit CCF connectors in Microsoft Business Applications (v3.2.5)

Required items, please complete Change(s): - Restored the 3 missing PurviewAudit CCF connector source definitions, DCRs, and polling configs under `Solutions/Microsoft…

SentinelNov 12

Migrate Batch 8 Sentinel solutions to Defender XDR (v3.2.2)

Required items, please complete Change(s): - Migrate and qualify 7 Microsoft Sentinel solutions to Defender XDR hybrid V3.1 packages (removed `Box` and `ImpervaCloudWAF`…

SentinelNov 12

feat(toolkit): auto-bump and validate patch version on modified Analytic Rules and XDR Detections

### Contribution Checklist: - [x] **The pull request only addresses one issue or adds one feature.

SentinelNov 12

feat(toolkit): support multi-tactic XDR detections and enforce qualification default

Change(s): - **V3.1 Packaging (Tools/Create-Azure-Sentinel-Solution/common/customDetections.ps1)**: Preserved the full authored actics[] array and nested echniques in…

SentinelNov 12

Filewall for Microsoft 365 3.2.2: verdict-based alerts, XDR entities and Defender for Endpoint correlation

Change(s): - Filewall for Microsoft 365 solution 3.2.2.

SentinelNov 11

Add Fortinet ingestion-time ASIM parsers

Add Authentication, DNS, Network Session, and Web Session service definitions in their schema-specific IngestTimeParsers directories.

SentinelNov 11

Add AWS CloudTrail ingestion-time ASIM parsers

Add Authentication, File Event, and User Management Ingest-Time Parsers layout.

SentinelNov 11

Catch Microsoft Defender and Sentinel at Ignite 2026

Join us at Microsoft Ignite 2026, November 17 to 20, in San Francisco and online.

Threat IntelligenceNov 11

The global socket: how threat actors are weaponizing GSocket for stealthy C2

Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched.

Azure securityNov 11Preview

Public Preview: Rate limit grouping for Azure Front Door Premium WAF

Announcing the public preview of rate limit grouping for Azure Web Application Firewall (WAF) on Azure Front Door Premium.

SentinelNov 11

[ASIM] Fix ITP replay and validation workflow

Required items, please complete Change(s): - Use the immutable parser-input snapshot schema and rows for optional QTP raw replay so row-only source fields are retained.

SentinelNov 11

[ASIM] Use native IP validation in Salesforce Login History ITPs

Required items, please complete Change(s): - Replaced the lossy regex-based Salesforce source IP validation with DCR-supported `parse_ipv4` and `parse_ipv6` calls in…

SentinelNov 11

[ASIM] Updates to CrowdStrike Falcon CSL Authentication parser

Required items, please complete Change(s): - Update both CrowdStrike FalconHost ASIM Authentication parsers to derive event timestamps from `ReceiptTime` as Unix…

Microsoft SecurityNov 11

Lessons from 59 Linux Kernel Bug Reports

Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged…

SentinelNov 11

LicensingGovernance Workbook

Required items, please complete Change(s): - new workbook Reason for Change(s): - Making use of (preview) workbook feature to show Graph capability Version Updated: - v1…

SentinelNov 11

Migrate Teams and Microsoft Active Directory Tier Model to Defender XDR (v3.2.2)

## Summary Migrates 2 parser-free 1P Microsoft Sentinel solutions to Microsoft Defender XDR and packages each solution at `v3.2.2`: | Solution | Version | Analytic Rules…

SentinelNov 11

Add hunting query: Entra ID successful sign-in after account disabled

Change(s): - Added a new hunting query: Hunting Queries/MultipleDataSources/SuccessfulSignInAfterAccountDisabled.yaml Reason for Change(s): - After an Entra ID account…

SentinelNov 11

[Network Session Essentials] Fix Kusto CRT0013 visitor limit in ASIM network session anomaly queries (v3.2.4)

## Summary Updates the **Network Session Essentials** solution to **v3.2.4** to resolve Kusto `CRT0013` (`Semantic pass has exceeded the max allowed visitors count…

SentinelNov 11

Fix Microsoft Copilot workbook empty-table parameter syntax error (v3.2.2)

**Description:** Follow-up to Azure/Azure-Sentinel#15543 for **Microsoft Copilot** (`v3.2.2`): - Fixed the `SYN0002: Query could not be parsed at ')' on line [4,17]`…

SentinelNov 10

[ASIM] Harden ingestion-time parser validation

Required items, please complete Change(s): - Enforced the normalization compiler's exact source-pipeline shape: one expression statement rooted at lowercase `source`.

SentinelNov 10

[ASIM] Add CHANGELOG to ITP

Required items, please complete Change(s): - Add 34 ingestion-time parser changelogs and relocate 2 existing histories to `CHANGELOG/IngestTimeParsers/`.

Threat IntelligenceNov 10

Detecting sleeper agents hiding in AI model neurons

Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject…

SentinelNov 10

[TheHive] - Adding multi-instance support

Required items, please complete Change(s): - Adding multi-instance support Reason for Change(s): - multi-instance support is required Version Updated: N/A Testing…

SentinelNov 10

[ASIM] Add remaining ITP for AWSCloudTrail AuditEvent

SentinelNov 10

Fix V3 storage blob connector packaging compatibility

Fixes # ## Proposed Changes - Preserve the existing `ServicePrincipal` role-assignment GUID formulas while using scope-, principal-, and role-aware GUIDs for…

SentinelNov 10

[ASIM] Create AWSCloudTrail AuditEvent ITP regarding Account and Infra

Required items, please complete Change(s): - Add the AWS CloudTrail EC2 AccountAndInfrastructure AuditEvent ingestion-time parser and source-specific sample data.

SentinelNov 10

[ASIM] Replace static KQL parsing with Kusto.Language

Required items, please complete Change(s): - Added a trusted .NET 8 analyzer using Microsoft.Azure.Kusto.Language 12.4.1 with a locked NuGet dependency.

SentinelNov 10

Migrate Microsoft Copilot solution to Defender XDR in Qualification Mode (v3.2.2)

Required items, please complete Change(s): - Migrated **Microsoft Copilot** (`Solutions/Microsoft Copilot`, `3.0.2` -> `3.2.2`) to Defender XDR in Qualification Mode…

SentinelNov 10

3.1.2 BUFGIX:

Change(s): - queryWindowInMin:1440 added to Data Connector Reason for Change(s): - bugfix polling interval = 5min Testing Completed: - Yes Checked that the validations…

SentinelNov 10

[Network Session Essentials] Fix NetworkSessionEssentialsCustomParser empty table fallback (v3.2.3)

## Summary - Updates `Solutions/Network Session Essentials/Parsers/NetworkSessionEssentialsCustomParser.yaml` (v1.0.1) to union `fuzzy=true` with an empty…

SentinelNov 10

[ASIM] Compare only AdditionalFields keys in ITP parity validation

Required items, please complete Change(s): - Compare only case-sensitive top-level keys in dynamic `AdditionalFields` property bags during QTP/ITP parity.

SentinelNov 9

[ASIM] Fix GUID type mismatches in ingestion-time validation raw replay

Required items, please complete Change(s): - Read raw-replay destination types from ARM table metadata, including standard columns, so GUID fields receive `toguid()`…

Microsoft SecurityNov 9

FORGE Lab uses agentic tools to identify memory safety issues in Rust

Microsoft FORGE Lab researchers found memory-safety bugs in Rust's core and std libraries, including cases where safe Rust code can trigger undefined behavior.

SentinelNov 9

Fix AWS GuardDuty ingestion parser count selector

Change(s): - Escape both ServiceDetails["count"] selectors in the AWSGuardDuty ingestion-time parser; update parser to 0.1.1 and dates to 2026-11-09.

SentinelNov 8

SentinelToXDRMigration: table-catalog follow-ups, preserve TimeGenerated, and locale URL validation

Required items, please complete Change(s): - Complete Sentinel-to-XDR Migration Toolkit table-catalog and URL validation follow-ups…

Threat IntelligenceNov 7

ARTEX abuse expands as cybercriminals target financial sector

In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.

SentinelNov 7

Update to 0.1.3

Required items, please complete Change(s): - See guidance below Reason for Change(s): - See guidance below Version Updated: - Required only for Detections/Analytic Rule…

EntraNov 6

What’s new in Microsoft Entra: November 2026

Don't miss our Microsoft Ignite announcements.

SentinelNov 6

[ASIM] Update optimized parser unit-test expectation

Required items, please complete Change(s): - Removed `ASimAuthenticationSalesforceServiceCloud.yaml` from the repository test's `oversized_query_parsers` exception set.…

SentinelNov 6

[ASIM] Stop compacting ingestion parser KQL

Required items, please complete Change(s): - Removed `compact_kql` and all imports/exports of the helper.

SentinelNov 6

Reduce Salesforce Audit Trail ingestion transform size

Required items, please complete Change(s): - Reduce only `Parsers/ASimAuditEvent/IngestTimeParsers/ASimAuditEventSalesforceAuditTrail.yaml`: consolidate 87 ordered…

SentinelNov 6

Reduce Salesforce V2 ingestion parser transform length

## Proposed Changes - Only change `ASimAuditEventSalesforceAuditTrailV2_CL.yaml` and its filename-matched changelog.

SentinelNov 6

[ASIM] Optimize parser for Salesforce Service Cloud Authentication

SentinelNov 6

Reduce CrowdStrike AuditEvent transform size

Required items, please complete Change(s): - Removed two redundant `EventType` and `ObjectType` case branches that returned the existing `Other` fallback; the parsed…

SentinelNov 6

[ASIM] Fix CrowdStrikeDetections AlertEvent ITP

SentinelNov 6

[ASIM] Align ASIM AWSCloudTrail Authentication parser types to ASim table

SentinelNov 6

Fix Salesforce ingestion-time source-rooted IP validation

Required items, please complete Change(s): - Fix both Salesforce Authentication ingestion-time variants: `ASimAuthenticationSalesforceLoginHistory.yaml` and…

SentinelNov 6

[ASIM] Align raw replay DCR transforms with destination column types

Required items, please complete Change(s): - Read raw replay destination column types and cast mismatched fixture columns, including string-to-GUID conversions.

SentinelNov 6

[ASIM] Fix Proofpoint POD MailLog inline ingestion-time IP validation

## Summary - Fix only the Proofpoint POD MailLog ingestion-time parser. The parser is present on upstream master; no dependent PR or unrelated content is included.

SentinelNov 6

[ASIM] Fix AlertEvent FileSize type mismatch in ITP validation

Required items, please complete Change(s): - Cast `ASimAlertEventLogs.FileSize` to `long` only in ASimDataTester input; add regression tests and documentation.

Defender for Office 365Nov 6

Enhancements to the Protection and Posture Insights report

Earlier this year, we introduced the Protection & Posture Insights report: an on-demand, tenant-specific view of the email & collaboration threats targeting your…

SentinelNov 6

SilentPush: 3.1.1 BUFGIXES

Change(s): - Playbooks now declare a dependency on the SilentPush-API custom connector - renamed the workspace parameter to WorkspaceName - connection now uses the…

Microsoft SecurityNov 5

Threat actors use agentic AI tooling to find and abuse exposed secrets

Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can…

Azure securityNov 5GA

Generally Available: Azure Front Door TLS key exchange policy with post-quantum support

Azure Front Door now supports configurable TLS key exchange policies, including hybrid post-quantum key exchange, to help you prepare for evolving cryptographic threats…

Azure securityNov 5GA

Generally Available: WAF Insights for Azure Application Gateway

WAF Insights for Azure Application Gateway Web Application Firewall (WAF) is now generally available.

Microsoft SecurityNov 5

New investments to reduce on-premises security risk

We’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.

Microsoft SecurityNov 5

What’s new in Microsoft Security: November 2026

Microsoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.

Threat IntelligenceNov 5

Email threat landscape: Q3 2026 trends and insights

Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined…

EntraNov 5

Catch Microsoft Entra at Ignite 2026

Join us at Microsoft Ignite 2026, November 17–20, 2026, at Moscone Center in San Francisco and online.

SentinelNov 5

Rubrik: Updated data connector and added playbooks, analytic rules for DSPM & IR violation usecase

Change(s): - Data connector (Azure Function App, RubrikWebhookEvents): - Added collection of DSPM and Identity Resilience (IR) violation events into a new table…

SentinelNov 5

feat: migrate VMware Carbon Black Cloud to Defender XDR (v3.2.2)

### Solutions to be Packaged (if applicable) VMware Carbon Black Cloud ### Description of Changes Full end-to-end Sentinel-to-Defender-XDR v3.2.2 migration and live…

SentinelNov 5

Add KELA BrandControl, IdentityGuard and Monitor solutions

Required items, please complete Change(s): - Added three new Microsoft Sentinel solutions for KELA, each built on a Codeless Connector Framework (CCF) data connector…

SentinelNov 5

[ASIM] Add native parsers to schemas that did not have them (AgentEvent, EmailEvent, AssetEntity, AlertEvent)

SentinelNov 4

[ASIM] Add Salesforce Real-Time Event Monitoring parsers

## Summary - regenerate the Salesforce PermissionSetEventStore AuditEvent and UserManagement parsers from the Salesforce object contract - normalize enabled/disabled…

SentinelNov 4

[ASIM] Refactor AWSCloudTrail AuditEvent into smaller parsers

SentinelNov 4

Add ASIM Proofpoint TAP blocked-click ingestion-time parser

Required items, please complete Change(s): - Add `ASimEmailEventProofpointTAPClicksBlockedIngestTime.yaml` under `Parsers/ASimEmailEvent/IngestTimeParsers/` and its own…

SentinelNov 4

[ASIM] Support ParentParser validation and deduplicate sample ingestion

Change(s): - Add support for optional top-level `ParentParser` YAML metadata in ASIM query-time template validation.

SentinelNov 4

Add ASIM Proofpoint TAP blocked-click query-time parsers

Required items, please complete Change(s): - Add parameterless and filtering ASIM EmailEvent query-time parsers for `ProofPointTAPClicksBlockedV2_CL`.

SentinelNov 4

[ASIM] AWSCloudTrail Authentication ITP

SentinelNov 4

[ASIM] Fix IPv4-prefix filtering validator SDK row comparison

Fixes the SDK row-identity comparison defect in ASIM filtering validation; relates to #15514.

Azure securityNov 4Preview

Public Preview: Azure Firewall IPv6 now supports application rules

Azure Firewall now supports application rules in IPv6 Public Preview, enabling layer 7 filtering for IPv6 HTTP and HTTPS traffic.

EntraNov 4

Scale access controls with Microsoft Entra Conditional Access policy plans

Today we’re announcing the public preview of Microsoft Entra Conditional Access policy plans —a new framework for enterprise-scale access control.

EntraNov 4

Microsoft Entra deep dives: Join our December 15–17 webinar series

At Microsoft Ignite, November 17–20, the Microsoft Entra team will explore innovative ways to secure access for people and AI agents.

Azure securityNov 4

Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations

Written in collaboration with yuvalpery and Gunjan Jain Introduction Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP.

SentinelNov 4

[Citrix DaaS Connector] - Fixing duplicate records issue

Change(s): - Citrix DaaS CCF connector: switched the Sessions and ConfigLog Operations pollers from GET /Sessions and GET /ConfigLog/Operations to POST /Sessions/$search…

SentinelNov 4

Migrate Bitglass, DPDP Compliance, and SOX IT Compliance solutions to Defender XDR (v3.2.2)

## Summary Migrate **Bitglass**, **DPDP Compliance**, and **SOX IT Compliance** solutions to Microsoft Defender XDR ( 3.2.2) with dual-deployment support…

SentinelNov 4

feat: migrate Infoblox NIOS, Digital Guardian DLP, and Trend Micro CAS to Defender XDR (v3.2.2)

## Summary End-to-end Defender XDR migration and V3.1 packaging (`v3.2.2`) for 3 solutions: - **Infoblox NIOS** (`Solutions/Infoblox NIOS`) - **Digital Guardian Data…

SentinelNov 4

Add hunting queries for AI coding CLI permission bypass and MCP config tampering

Change(s): - Added two community hunting queries for AI coding assistants on endpoints (Defender for Endpoint tables): - Hunting…

SentinelNov 4

MailGuard 365: migrate data connector to CCF Push (v3.0.1)

Change(s): - Replace the HTTP Data Collector API connector with a Codeless Connector Framework Push connector using the Azure Monitor Logs Ingestion API (connector…

Microsoft SecurityNov 3

The CISO Cheat Sheet to Microsoft Digital Defense Report 2026

I know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read.

PurviewNov 3

What stops a service-side auto-labeling rollout from being approved — and how to unblock it

The four questions every approver asks Access Proof Reversibility Scale “Will labeling change who can open our files?”

SentinelNov 3

[ASIM] Create ITP for Proofpoint TAP Delivered

SentinelNov 3

[ASIM] Exclude ITP yaml files in QTP workflows

Microsoft SecurityNov 3

Windows news you can use: October 2026

October brought plenty to keep on your radar, from new Windows 11 features and accessibility improvements to security changes that might require some planning.

Azure securityNov 3Preview

Public Preview: JWT validation for Application Gateway for Containers

Application Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource.

Azure securityNov 3Preview

Public Preview: MCP gateway for Application Gateway for Containers

Application Gateway for Containers now supports Model Context Protocol routing through the new MCPRoute custom resource.

Azure securityNov 3Preview

Public Preview: Private ingress for Application Gateway for Containers

Application Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints.

SentinelNov 3

[ASIM] Create ITP for Proofpoint TAP Blocked

SentinelNov 3

Resolve ASIM QTP sample collisions while preserving valid legacy fixtures

Change(s): - Add source-aware sample discovery to the existing trusted ASIM file helper and use it consistently in QTP template validation and sample ingestion.

Threat IntelligenceNov 3

Fake-download campaign uses trojanized installers to deliver monetization payloads

Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and…

Microsoft SecurityNov 3

Microsoft named a Leader in the 2026 Gartner® Magic QuadrantTM for AI Agent Management Platforms

Read why Gartner named Microsoft a Leader in the inaugural 2026 Magic Quadrant for AI Agent Management Platforms.

SentinelNov 3

Migrate 5 Sentinel solutions to Defender XDR in Qualification Mode (v3.2.3)

Required items, please complete Change(s): - Migrated 5 Microsoft Sentinel solutions to version `3.2.3` with Defender XDR Custom Detections (`XDR Detections/`), Defender…

SentinelNov 3

Remove unused "WEBSITE_NODE_DEFAULT_VERSION": "~10"

Required items, please complete Change(s): - Repackaged Reason for Change(s): - Remove unused "WEBSITE_NODE_DEFAULT_VERSION": "~10" - updated version…

SentinelNov 3

Package MPIP solution version 3.0.1

Required items, please complete Change(s): - See guidance below Reason for Change(s): - See guidance below Version Updated: - Required only for Detections/Analytic Rule…

SentinelNov 3

feat: migrate Threat Intelligence (NEW), Sentinel SOAR Essentials, and Threat Analysis & Response to Defender XDR

## Summary End-to-end Defender XDR migration and V3.1 packaging (`v3.2.2`) for 3 solutions: - **Threat Intelligence (NEW)** (`Solutions/Threat Intelligence (NEW)`)…

SentinelNov 2

[ASIM] Create EmailEvent parser for ProofPointTAPMessagesDeliveredV2_CL and ProofPointTAPMessagesBlockedV2_CL

SentinelNov 2

[ASIM] Create CrowdStrike Falcon DNS ITP

EntraNov 2

Global Secure Access: Private Access and Internet Access in one offering

Employees, and now AI agents, need secure access to resources wherever they live: the internet, Microsoft 365 and SaaS, cloud and datacenter workloads, on-premises apps…

Threat IntelligenceNov 2

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Real-world exploitation concentrates in a small, high-impact subset of CVEs.

Defender for IoTNov 2Retirement

Retirement: OT security in Microsoft Defender for IoT

This is the formal notice that Microsoft plans to deprecate the operational technology (OT) security component of Microsoft Defender for IoT.

Azure securityNov 2

Protect against Brotli CVE-2026-111497 with Azure Web Application Firewall (WAF)

Google Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497 .

PurviewNov 2

Scaling classification and labeling: an interactive reference architecture update

In April, I published a set of referential architecture diagrams for Microsoft Purview — Microsoft Purview Referential Architecture Diagrams .

SentinelNov 2

SentinelToXDRMigration: qualification follow-ups, XDR static KQL override, and NPF metrics

Required items, please complete Change(s): - Implement Sentinel-to-XDR Migration Toolkit qualification follow-ups (Todos #0 through #6): - **Todo #0 (Security Gate &…

SentinelNov 2

Exclude ITPs from legacy ASIM template validation

Related to #15463 ## Proposed Changes - Exclude `IngestTimeParsers/` YAML from the legacy query-time parser template validator's changed-file selection.

SentinelNov 2

[ASIM] Add Proofpoint POD MailLog ingestion-time parser

Required items, please complete Change(s): - Add the Proofpoint POD MailLog ingestion-time EmailEvent parser targeting ASimEmailEventLogs.

SentinelNov 2

fix packaging script nested property parsing logic

Required items, please complete Change(s): - See guidance below Reason for Change(s): - Netskopev2 incident due to packaging tool not able to parse nested property…

SentinelNov 2

sap contribution add janik

SentinelNov 2

Migrate Palo Alto Prisma Cloud CSPM to Defender XDR (3.2.2)