Azure/Azure-Sentinel

View on GitHub

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

Stars: 6.1k
Forks: 3.8k
Open beginner issues: 0
Indexed issues: 40
Avg merge: 4d 7h
Merged PRs (30d): 125

Dominant language: Python
License: MIT
Last GitHub push: Sep 14, 2026
Latest indexed: Sep 14, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Open All

39 open issues indexed

[Sentinel] CCF Push fails when run through the MS Defender UI Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#13547 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Can't install Logstash Sentinel plugin Open

Log Analytics logstach plugin

Azure/Azure-Sentinel#14190 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Enhancements to Sentinel Workday Connector to Support Multiple Tenants Open

Codeless Connector Framework (CCF) Connector Connector enhancement feature request

Azure/Azure-Sentinel#14241 · 1 comment · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Logstash output plugin doesn't support 'id' Open

logstach plugin

Azure/Azure-Sentinel#14251 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Crowdstrike CCF Polling Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14372 · 5 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Logstash output plugin logs no longer include stream name and request ID Open

logstach

Azure/Azure-Sentinel#14393 · 2 comments · 4 reactions · 3 assignees · Indexed Sep 14, 2026
Palo Alto PAN OS - CEF Format Unsupported After 10.0.x Open

Connector

Azure/Azure-Sentinel#14458 · 2 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Cisco Umbrella CCF connector: expose IsCompressed / HasCsvHeader in the "Add new collector" GUI (silent failure otherwise) Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14514 · 7 comments · 10 reactions · 3 assignees · Indexed Sep 14, 2026
SalesForceRealTimeEventMonitoringConnector_CCF: Attempts to access PlannerId which only exists in the Source Event Objects if Agentforce is Enabled. Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14598 · 5 comments · 1 reaction · 3 assignees · Indexed Sep 14, 2026
OCI CCF - Incorrect PEM file and passphrase processing Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14656 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Google Workspace Activities (CCF) connector supports only one Google Workspace tenant per Sentinel workspace Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14657 · 1 comment · 0 reactions · 3 assignees · Indexed Sep 14, 2026
GitHubAuditData parser dropping logs Open

Parser

Azure/Azure-Sentinel#14659 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
AzureDevOps Auditing CCF Connector should be able to handle multiple organizations Open

Codeless Connector Framework (CCF) Connector Connector enhancement feature request

Azure/Azure-Sentinel#14669 · 0 comments · 0 reactions · 2 assignees · Indexed Sep 14, 2026
Issue with False Positives from AWSCloudTrail logs in from "Malformed user agent" Analytic Open

Analytic Rules

Azure/Azure-Sentinel#14686 · 3 comments · 0 reactions · 2 assignees · Indexed Sep 14, 2026
GitHub Enterprise Audit Log (via Codeless Connector Framework) Fails to Connect Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14695 · 4 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
DocuSign Security Events Function app uses API going EOL mid-Sept Open

Connector

Azure/Azure-Sentinel#14701 · 2 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Azure DevOps Audit Logs connector: support app-only authentication or clarify why delegated authorization is required Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14725 · 3 comments · 3 reactions · 2 assignees · Indexed Sep 14, 2026
AWS S3 Connector creates AWSGuardDuty records but all parsed fields remain empty for native GuardDuty Export Findings Open

Connector

Azure/Azure-Sentinel#14747 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Workday_ccp: Change page size value and make it changable in Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14764 · 7 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Proposal: ASIM-aligned AWS GuardDuty parser and hunting queries Open

ASIM enhancement Hunting Parser Solution

Azure/Azure-Sentinel#14768 · 2 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
TI Map Domain entity to Cloud App Events Open

Analytic Rules

Azure/Azure-Sentinel#14779 · 4 comments · 0 reactions · 2 assignees · Indexed Sep 14, 2026
Issue with Checkpoint Email Security CCF Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14825 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
OCI CCF - Error: "The config for this connector was malformed." - Sovereign Cloud Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14843 · 4 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
CCF Cisco Umbrella (AWS S3) Connector — S3B40034 due to duplicated/malformed S3 prefix construction Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14866 · 6 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
ASIM: documented 'line to add' for Im_<Schema>Custom doesn't match the shipped stub signatures (5/11 schemas; 3 hard-fail, 1 fails silently) Open

ASIM

Azure/Azure-Sentinel#14880 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Confluence Audit CCP connector: "Atlassian Confluence organization URL" field/placeholder is misleading for scoped API tokens (401 Unauthorized) Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14909 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Support FortiAnalyzer Azure Monitor Log Ingestion API with CommonSecurityLog Mapping Open

Connector DCR enhancement feature request

Azure/Azure-Sentinel#14981 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Okta CCF connector: stuck poller re-ingests old events with new timestamps Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14984 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Cisco Meraki Events via REST API connector no longer populates DvcAction Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#14993 · 1 comment · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Add Oracle Cloud Guard support to the OCI CCF data connector Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#15005 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
OCI_LogsV2_CL ingestion cost and duplicate columns Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#15006 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Migrate GitHub (Webhooks) V2 connector Function to Flex Consumption plan Open

Connector enhancement feature request

Azure/Azure-Sentinel#15022 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
_Im_NetworkSession_AzureFirewallV02 parser failing Open

ASIM Parser

Azure/Azure-Sentinel#15045 · 2 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Meraki CCF Connector: getNetworkClients API Call Fails with 504 Timeout Due to Excessive Default Lookback Period Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#15060 · 1 comment · 0 reactions · 3 assignees · Indexed Sep 14, 2026
AWS CloudTrail : connector validation failed there are two connectors with different names and the same kind and context id Open

Connector

Azure/Azure-Sentinel#15075 · 3 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Workbook that need a supporting .CSV Open

Workbook

Azure/Azure-Sentinel#15076 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 14, 2026
Amazon Web Services S3 - Connections Not Visible in Data Connector Page Open

Connector

Azure/Azure-Sentinel#15082 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
[CrowdStrike API CCF connector] Majority of V2_CL columns cannot be populated; device fields not extracted from the `device` object Open

Codeless Connector Framework (CCF) Connector Connector

Azure/Azure-Sentinel#15094 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026
Meraki API Switch Open

Connector Problem Solution

Azure/Azure-Sentinel#15115 · 0 comments · 0 reactions · 3 assignees · Indexed Sep 14, 2026

Azure/Azure-Sentinel

Get new issues in your inbox