Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Sentinel Tables Connectors Reference

29 September 2026Doc update+117 / −61 lines

In brief

The reference adds mappings for Fortra Agari, Airlock Digital, BloodHound Enterprise, and Cisco Meraki connectors, updates ASim and Armis entries, and removes several older mappings.

What Defender admins need to know

Use the revised mappings when checking table availability and connector associations for affected data sources.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| ABNORMAL_THREAT_MESSAGES_CL | AbnormalSecurity (using Azure Functions) | Yes | Yes | | ADFSSignInLogs | Microsoft Entra ID | Yes | Yes | | ADOAuditLogs_CL | Azure DevOps Audit Logs (via Codeless Connector Platform) | Yes | Yes | | AgariAPDPolicyLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AgariAPDTCLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AgariBPAlertsLog_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AgariBPThreatFeedSubs_CL | Fortra Agari Data Connector (via Codeless Connector Framework) | No | No | | AirlockDigitalExecutionHistories | Airlock Digital connector (via Codeless Connector Framework) | No | No | | AirlockDigitalExecutionHistories_CL | Airlock Digital (Poll - SaaS)Airlock Digital (Poll)Airlock Digital (Push) | No | No | | AirlockDigitalFileActivitySummary | Airlock Digital connector (via Codeless Connector Framework) | No | No | | AirlockDigitalPolicyChanges_CL | Airlock Digital (Push) | No | No | | AirlockDigitalServerActivities | Airlock Digital connector (via Codeless Connector Framework) | No | No | | AirlockDigitalServerActivities_CL | Airlock Digital (Poll - SaaS)Airlock Digital (Poll)Airlock Digital (Push) | No | No | | AIShield_CL | AIShield | No | No | | AkamaiSIEMEvent | Akamai Security Events (via Codeless Connector Framework) | No | No | | AlertEvidence | Microsoft Defender XDR | Yes | Yes | | argsentdc_CL | Check Point Cyberint Alerts Connector (via Codeless Connector Platform) | Yes | Yes | | Armis_Activities_CL | Armis Alerts Activities (using Azure Functions) | Yes | Yes | | Armis_Alerts_CL | Armis Alerts Activities (using Azure Functions) | Yes | Yes | | Armis_Devices_CL | Armis Devices (using Azure Functions) | NoYes | NoYes | | ASimAuditEventLogs | Workday User ActivityCisco Meraki Events (using REST API) (via Codeless Connector Framework)Workday User Activity (via Codeless Connector Framework) | Yes | Yes | | ASimDnsActivityLogs | Windows DNS Events via AMA | Yes | Yes | | atlassian_beacon_alerts_CLASimNetworkSessionLogs | Atlassian Beacon AlertsCisco Meraki Events (using REST API) (via Codeless Connector Framework) | NoYes | NoYes | | ASimWebSessionLogs | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | AtlassianAuditEvents | Atlassian Organization Audit Events (via Codeless Connector Framework) | No | No | | Audit_CL | Mimecast Audit | Yes | Yes | | AuditLogs | Microsoft Entra ID | Yes | Yes | | AzureActivity | Azure Activity | No | No | | AzureDiagnostics | Azure Batch AccountAzure Cognitive SearchAzure DDoS ProtectionAzure Event HubAzure FirewallAzure Key VaultAzure Kubernetes Service (AKS)Azure Logic AppsAzure SQL DatabasesAzure Service BusAzure Stream AnalyticsAzure Web Application Firewall (WAF)Network Security Groups | No | No | | AzureMetrics | Azure Storage Account | No | No | | BetterMTDAppLog_CL | BETTER Mobile Threat Defense (MTD) | No | No | | BetterMTDDeviceLog_CL | BETTER Mobile Threat Defense (MTD) | No | No | | BetterMTDIncidentLog_CL | BETTER Mobile Threat Defense (MTD) | No | No | | BetterMTDNetflowLog_CL | BETTER Mobile Threat Defense (MTD) | No | No | | BeyondTrustPM_ActivityAudits_CL | BeyondTrust PM Cloud | Yes | Yes | | BeyondTrustPM_ClientEvents_CL | BeyondTrust PM Cloud | Yes | Yes | | BHEAttackPathsData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BHEAttackPathsTimelineData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BHEAuditLogsData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BHEFindingTrendsData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BHEPostureHistoryData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BHETierZeroAssetsData_CL | BloodHound Enterprise Data Connector (using Azure Functions) | No | No | | BigIDDSPMCatalog_CL | BigID DSPM connector | No | No | | BitglassLogs_CL | Bitglass (using Azure Functions) | No | No | | BitwardenEventLogs | Bitwarden Event Logs | No | No | | CarbonBlackAuditLogs_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CarbonBlackEvents_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CarbonBlackNotifications_CL | [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) (using Azure Functions) | No | No | | CatoNetworksEvents_CL | Cato Networks Events (Push) | Yes | Yes | | CayosoftThreatAlerts_CL | Cayosoft Guardian Threat Alerts | No | No | | CBSLog_AzureV2_CL | CTM360 CyberBlindSpot (Serverless) | Yes | Yes | | CheckPointEmailSecAntiPhishingExceptions_CL | Check Point Email Security (via Codeless Connector Framework) | Yes | Yes | | CheckPointEmailSecurityAuditLogs_CL | Check Point Email Security (via Codeless Connector Framework) | Yes | Yes | | Cisco_Umbrella_ravpnlogs_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | No | No | | Cisco_Umbrella_ztaflow_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | No | No | | Cisco_Umbrella_ztna_CL | Cisco Cloud Security (using Azure Functions)Cisco Cloud Security (using elastic premium plan) (using Azure Functions) | No | No | | CiscoDuo_CL | Cisco Duo Security (using Azure Functions) | No | No | | CiscoETD_CL | Cisco ETD | No | No | | CiscoETDv2_CL | Cisco Email Threat Defense (ETD) | Yes | Yes | | CiscoMerakiAirMarshalEvents_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiNetworkClients_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiOrganizationNetworks_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiOrganizations_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoSDWANNetflow_CL | Cisco Software Defined WAN | No | No | | CiscoSecureEndpointAuditLogsV2_CL | Cisco Secure Endpoint (via Codeless Connector Framework) | Yes | Yes | | CitrixAnalytics_riskScoreChange_V1_CL | Citrix Analytics (via Codeless Connector Framework) | Yes | Yes | | CitrixAnalytics_SPA_Events_V1_CL | Citrix Analytics (via Codeless Connector Framework) | Yes | Yes | | CitrixAnalytics_userProfile_V1_CL | Citrix Analytics (via Codeless Connector Framework) | Yes | Yes | | CitrixDaaSConfigOps_CL | Citrix DaaS Audit & Sessions (via Codeless Connector Framework) | NoYes | NoYes | | CitrixDaaSSessions_CL | Citrix DaaS Audit & Sessions (via Codeless Connector Framework) | NoYes | NoYes | | Cloud_Integrated_CL | Mimecast Cloud Integrated | Yes | Yes | | CloudAppEvents | Microsoft Defender XDR | Yes | Yes | | Cloudflare_CL | Cloudflare (Preview) (using Azure Functions) | Yes | Yes | | CloudGuard_SecurityEvents_CL | Check Point CloudGuard CNAPP Connector for Microsoft Sentinel | Yes | Yes | | CognniIncidents_CL | Cognni | Yes | Yes | | Cohesity_CL | Cohesity (using Azure Functions) | Yes | Yes | | CommonSecurityLog | Cisco ASA/FTD via AMAClaroty xDomeInfoblox Cloud Data Connector via AMAInfoblox SOC Insight Data Connector via AMAInfoblox IQ for Threat Defense Insight Data Connector via AMASilverfort Admin ConsoleVirtualMetric DataStream for Microsoft Sentinel data lakeVirtualMetric DataStream for Microsoft SentinelVirtualMetric Director ProxyZscaler Internet Access Cloud NSS Audit Log Push ConnectorZscaler Internet Access Cloud NSS CASB Activity Log Push ConnectorZscaler Internet Access Cloud NSS CASB CRM Log Push ConnectorZscaler Internet Access Cloud NSS CASB Cloud Storage Log Push ConnectorZscaler Internet Access Cloud NSS CASB Collaboration Log Push ConnectorZscaler Internet Access Cloud NSS CASB Email Log Push ConnectorZscaler Internet Access Cloud NSS CASB File Sharing Log Push ConnectorZscaler Internet Access Cloud NSS CASB ITSM Log Push ConnectorZscaler Internet Access Cloud NSS CASB Repo Log Push ConnectorZscaler Internet Access Cloud NSS DNS Log Push ConnectorZscaler Internet Access Cloud NSS Email DLP Log Push ConnectorZscaler Internet Access Cloud NSS Endpoint DLP Log Push ConnectorZscaler Internet Access Cloud NSS Firewall Log Push ConnectorZscaler Internet Access Cloud NSS Tunnel Log Push ConnectorZscaler Internet Access Cloud NSS Web Log Push Connector[Deprecated] Infoblox SOC Insight Data Connector via Legacy Agent | Yes | Yes | | CommvaultAlerts_CL | CommvaultSecurityIQ | Yes | Yes | | CommvaultAlertsCCF_CL | Commvault Security IQ (via Codeless Connector Framework) | NoYes | NoYes | | ConfluenceAuditLogs_CL | Atlassian Confluence Audit (via Codeless Connector Framework) | Yes | Yes | | ContraForceEvents_CL | ContraForce Events | No | No | | ContrastADRAttackEvents_CL | Contrast ADR Push Connector | Yes | Yes | | ContrastADRIncidents_CL | Contrast ADR Push Connector | Yes | Yes | | CopilotActivity | Microsoft Copilot | No | Yes | | CortexXpanseAlerts_CL | Palo Alto Cortex Xpanse (via Codeless Connector Framework) | Yes | Yes | | CriblInternal_CL | Cribl | No | No | | CrowdStrike_Additional_Events_CL | CrowdStrike Falcon Data Replicator (User Managed AWS-S3) (via Codeless Connector Framework) | Yes | Yes | | CrowdStrikeAlertsCrowdStrikeAlertsV2_CL | CrowdStrike API Data Connector (via Codeless Connector Framework) | Yes | Yes | | CrowdStrikeReplicatorV2 | CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3) (using Azure Functions) | No | No | | CyberArk_AuditEvents_CL | CyberArk AuditCyberArkAudit (using Azure Functions)Idira Audit | Yes | Yes | | CyberArk_EPMEvents_CL | CyberArk EPM | Yes | Yes | | CyberArkEPM_Events_CL | CyberArkEPM (using Azure Functions) | NoYes | NoYes | | CyberpionActionItems_CL | IONIX Security Logs (via Codeless Connector Framework)[DEPRECATED] IONIX Security Logs (Push) | Yes | Yes | | CyberSixgill_Alerts_CL | Cybersixgill Actionable Alerts (using Azure Functions) | No | No | | CybleVisionAlerts_CL | Cyble Vision Alerts | No | No | | DataminrPulse_Alerts_CL | Dataminr Pulse Alerts Data Connector (using Azure Functions) | No | No | | DataverseActivity | Microsoft Dataverse | Yes | Yes | | datawizaserveraccess_CL | Datawiza DAP | No | No | | Detections_Data_CCF_CL | Vectra RUX Security Data Connector (via Codeless Connector Framework) | Yes | Yes | | Detections_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | DeviceEvents | Microsoft Defender XDR | Yes | Yes | | DigitalShadows_V2_CL | Digital Shadows Searchlight | No | No | | dossier_tld_risk_CL | Infoblox Data Connector via REST API | No | No | | dossier_whitelist_CL | Infoblox Data Connector via REST API | No | No | | dossier_whois_CL | Infoblox Data Connector via REST API | No | No | | DragonCopilot | Dragon Copilot | Yes | Yes | | DragosAlerts_CL | Dragos Notifications via Cloud Sitestore | Yes | Yes | | DruvaSecurityEvents_CL | Druva Events Connector | Yes | Yes | | DuoActivity_CL | Cisco Duo Activity Logs | Yes | Yes | | DuoAuthentication_CL | Cisco Duo Authentication | Yes | Yes | | DuoTelephony_CL | Cisco Duo Telephony Logs | Yes | Yes | | Dynamics365Activity | Dynamics365 | Yes | No | | DynatraceAttacks_CL | Dynatrace Attacks V1[Deprecated] Dynatrace Attacks V1 | No | No | | DynatraceAttacksV2_CL | Dynatrace Attacks V2 | No | No | | DynatraceAttacksV3_CL | Dynatrace Attacks V3 | No | No | | DynatraceAuditLogs_CL | Dynatrace Audit Logs V1[Deprecated] Dynatrace Audit Logs V1 | Yes | Yes | | DynatraceAuditLogsV2_CL | Dynatrace Audit Logs V2 | No | No | | DynatraceAuditLogsV3_CL | Dynatrace Audit Logs V3 | No | No | | DynatraceProblems_CL | Dynatrace Problems V1[Deprecated] Dynatrace Problems V1 | No | No | | DynatraceProblemsV2_CL | Dynatrace Problems V2 | Yes | Yes | | DynatraceProblemsV3_CL | Dynatrace Problems V3 | No | No | | DynatraceSecurityProblems_CL | Dynatrace Runtime Vulnerabilities V1[Deprecated] Dynatrace Runtime Vulnerabilities V1 | No | No | | DynatraceSecurityProblemsV2_CL | Dynatrace Runtime Vulnerabilities V2 | No | No | | DynatraceSecurityProblemsV3_CL | Dynatrace Runtime Vulnerabilities V3 | No | No | | EgressDefend_CL | Egress Defend | Yes | Yes | | EgressDefend_v4_CL | Egress Defend v2 | No | No | | ElasticAgentEvent | Elastic Agent | No | No | | ElasticAgentLogsV2_CL | Elastic Agent (via Codeless Connector Framework) | No | No | | EmailEvents | Microsoft Defender XDR | Yes | Yes | | emiocintel_CL | Check Point EM ThreatCloud Intelligence Feed Connector | No | No | | Entities_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | Entity_Scoring_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | ErmesBrowserSecurityEvents_CL | Ermes Browser Security Events | Yes | Yes | | ESIExchangeConfig_CL | Exchange Security Insights On-Premises Collector | No | No | | ESIExchangeOnlineConfig_CL | Exchange Security Insights Online Collector (using Azure Functions) | NoYes | NoYes | | Event | Automated Logic WebCTRLMicrosoft Exchange Admin Audit Logs by Event LogsMicrosoft Exchange Logs and Events[Deprecated] Microsoft Exchange Logs and Events | Yes | No | | eventsapplicationdata_CL | Netskope Data Connector | No | No | | eventsauditdata_CL | Netskope Data Connector | No | No | | eventsnetworkdata_CL | Netskope Data Connector | No | No | | eventspagedata_CL | Netskope Data Connector | No | No | | ExchangeHttpProxy_CL | Microsoft Exchange HTTP Proxy Logs[Deprecated] Microsoft Exchange Logs and Events | Yes | Yes | | ExtraHop_Detections_CL | ExtraHop Detections Data Connector | NoYes | NoYes | | F5Telemetry_ASM_CL | F5 BIG-IP | No | No | | F5Telemetry_LTM_CL | F5 BIG-IP | No | No | | F5Telemetry_system_CL | F5 BIG-IP | Yes | Yes | | Failed_Range_To_Ingest_CL | Infoblox Data Connector via REST API | No | No | | feedly_indicators_CL | Feedly IoC | No | No | | FilewallExchange_CL | Filewall for Microsoft 365 | Yes | Yes | | FinanceOperationsActivity_CL | Dynamics 365 Finance and Operations | Yes | Yes | | FireworkV2_CL | Flare Push Connector | Yes | Yes | | fluentbit_CL | Azure CloudNGFW By Palo Alto Networks | Yes | Yes | | ForcepointDLPEvents_CL | Forcepoint DLP | No | No | | ForescoutEvent | Forescout | No | No | | ForescoutHostProperties_CL | Forescout Host Property Monitor | Yes | Yes | | FortinetFortiNdrCloudRaw_CL | Fortinet FortiNDR Cloud | No | No | | FortyTwoCrunchAPIProtectionV2 | 42Crunch API Protection (Push Connector via Codeless Connector Framework) | No | No | | GambitPoliciesIssues_CL | Gambit Security Policy Issues (Push) | No | No | | GigamonV2_CL | Gigamon AMX Connector | No | No | | GitHubAdvancedSecurityAlerts_CL | GitHub (using Webhooks) V2 | Yes | Yes | | GitHubAuditLogPolling_CL | [Deprecated] GitHub Enterprise Audit Log | Yes | Yes | | GitHubAuditLogsV2_CL | GitHub Enterprise Audit Log (via Codeless Connector Framework) | Yes | Yes | | GitHubAuditLogsV3_CL | GitHub Enterprise Audit Log (via Azure Storage)GitHub Enterprise Audit Log (via Codeless Connector Framework) | Yes | Yes | | githubscanaudit_CL | GitHub (using Webhooks) | Yes | Yes | | GKEAudit | Google Kubernetes Engine (via Codeless Connector Framework) | Yes | Yes | | GoogleCloudSCC | Google Security Command Center | Yes | Yes | | GoogleWorkspaceReports | Google Workspace Activities (via Codeless Connector Framework) | Yes | Yes | | GTI_Vulnerabilities_CL | Google Threat Intelligence Vulnerabilities (CCF) | Yes | Yes | | GuardicoreAgents_CL | Akamai Guardicore | No | No | | GuardicoreApplications_CL | Akamai Guardicore | No | No | | GuardicoreAssets_CL | Akamai Guardicore | No | No | | GuardicorePolicyRules_CL | Akamai Guardicore | No | No | | GzSecurityEvents_CL | GravityZone Data Connector | Yes | Yes | | HackerViewLog_AzureV2_CL | CTM360 HackerView (Serverless) | Yes | Yes | | HalcyonAlertUpdatesV2_CL | Halcyon Connector (v2) | Yes | Yes | | IllumioInsightsSummary_CL | Illumio Insights Summary | No | No | | ImpervaWAFCloud | Imperva Cloud WAF (via Codeless Connector Framework) | No | No | | ImpervaWAFCloud_CL | Imperva Cloud WAF (using Azure Functions) | Yes | Yes | | Infoblox_Failed_Indicators_CL | Infoblox Data Connector via REST API | No | No | | InfobloxInsight_CL | Infoblox SOC Insight Data Connector via REST APIInfoblox IQ for Threat Defense Insight Data Connector via REST API | No | No | | InfoSecAnalytics_CL | InfoSecGlobal Data Connector | No | No | | IntegrationTable_CL | ESET Protect Platform (using Azure Functions) | Yes | Yes | | IntegrationTableIncidents_CL | ESET Protect Platform (using Azure Functions) | Yes | Yes | | jamfprotecttelemetryv2_CL | Jamf Protect Push Connector | Yes | Yes | | jamfprotectunifiedlogs_CL | Jamf Protect Push Connector | Yes | Yes | | JBossEvent_CL | Custom logs via AMA | No | No | | Jira_Audit_CL | Atlassian Jira Audit (using Azure Functions) | NoYes | NoYes | | Jira_Audit_v2_CL | Atlassian Jira Audit (via Codeless Connector Framework) | Yes | Yes | | JuniperIDP_CL | Custom logs via AMA | Yes | Yes | | KeeperSecurityEventNewLogs_CL | Keeper Security Push Connector | Yes | Yes | | LastPassNativePoller_CL | LastPass Enterprise - Reporting (Polling CCP) | Yes | Yes | | LightningAttackPathLinksV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | LightningAttackPaths_CL | Semperis Lightning Logs | No | No | | LightningAttackPathsV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | LightningIndicatorExecutionsV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | LightningIOEResults_CL | Semperis Lightning Logs | No | No | | LightningIOEsMetadataV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | LightningTier0AttackersV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | LightningTier0Nodes_CL | Semperis Lightning Logs | No | No | | LightningTier0NodesV2_CL | Semperis Lightning (via Codeless Connector Framework) | No | No | | Lockdown_Data_CL | Vectra XDR (using Azure Functions) | Yes | Yes | | Lookout_CL | [DEPRECATED] Lookout | No | No | | LookoutMtdV2_CL | Lookout Mobile Threat Detection Connector (via Codeless Connector Framework) (Preview) | Yes | Yes | | MulesoftCloudhubAlerts_CL | Mulesoft CloudHub Alerts Connector (via Codeless Connector Framework) | Yes | Yes | | MuleSoftCloudhubLogs | MuleSoft CloudHub Logs (Push Connector via Codeless Connector Framework) | No | No | | NCProtectUAL_CL | NC Protect | No | No | | net_assets_CL | Holm Security Asset Data (using Azure Functions) | No | No | | Netskope_WebTx_metrics_CL | Netskope Data Connector | No | No | | NetskopeAlerts_CL | Netskope Alerts and Events | Yes | Yes | | NetskopeWebTransactions_CL | Netskope Web Transaction Connector (via Blob Storage)Netskope Web Transactions (via Blob Storage) | Yes | Yes | | NetskopeWebtxData_CL | Netskope Web Transactions Data Connector | No | No | | NetskopeWebtxErrors_CL | Netskope Web Transactions Data Connector | No | No | | NetworkAccessTraffic | Microsoft Entra ID | Yes | Yes | | NexposeInsightVMCloud_assets_CL | Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) | NoYes | NoYes | | NexposeInsightVMCloud_vulnerabilities_CL | Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) | NoYes | NoYes | | NGINX_CL | Custom logs via AMA | Yes | Yes | | NordPassEventLogs_CL | NordPass | Yes | Yes | | NordStellar_CL | NordStellar (Push) | NoYes | NoYes | | ObsidianActivity_CL | Obsidian Datasharing Connector | No | No | | ObsidianThreat_CL | Obsidian Datasharing Connector | No | No | | OCI_LogsV2_CL | Oracle Cloud Infrastructure (via Codeless Connector Framework) | Yes | Yes | | OneTrustMetadataV3_CL | OneTrust | Yes | Yes | | OpenAIAuditLogs | OpenAI (via Codeless Connector Framework) | No | No | | OracleWebLogicServer_CL | Custom logs via AMA | Yes | Yes | | OrcaAlerts_CL | Orca Security Alerts (via Microsoft Entra ID)Orca Security Alerts | Yes | Yes | | PaloAltoCortexXDR_Alerts_CL | Palo Alto Cortex XDR | Yes | Yes | | PaloAltoCortexXDR_Audit_Agent_CL | Palo Alto Cortex XDR | Yes | Yes | | PaloAltoCortexXDR_Audit_Management_CL | Palo Alto Cortex XDR | Yes | Yes | | PowerPlatformAdminActivity | Microsoft Power Platform Admin Activity | Yes | Yes | | prancer_CL | Prancer Data Connector | No | No | | PrismaCloudCompute_CL | Palo Alto Prisma Cloud CWPP (using REST API) | Yes | Yes | | PRODAFTUstaCompromisedCards_CL | PRODAFT USTA - Payment Card Fraud Intelligence (via Codeless Connector Framework) | Yes | Yes | | PRODAFTUstaCompromisedCredentials_CL | PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework) | Yes | Yes | | ProjectActivity | Microsoft Project | Yes | Yes | | ProofpointPODMailLog_CL | Proofpoint On Demand Email Security (via Codeless Connector Platform) | Yes | Yes | | RadiflowEvent | Radiflow iSID via AMA | No | No | | Rapid7InsightVMCloudAssets | Rapid7 Insight Platform Vulnerability Management Reports (via Codeless Connector Framework) | Yes | Yes | | Rapid7InsightVMCloudVulnerabilities | Rapid7 Insight Platform Vulnerability Management Reports (via Codeless Connector Framework) | Yes | Yes | | RecordedFutureClassicAlerts_V2_CL | Recorded Future - Log Ingestion | Yes | Yes | | RecordedFuturePlaybookAlerts_V2_CL | Recorded Future - Log Ingestion | Yes | Yes | | RecordedFutureSandboxResults_V2_CL | Recorded Future - Log Ingestion | Yes | Yes | | RecordedFutureThreatMap_V2_CL | Recorded Future - Log Ingestion | Yes | Yes | | RecordedFutureThreatMapMalware_V2_CL | Recorded Future - Log Ingestion | Yes | Yes | | RedCanaryDetections_CL | Red Canary Threat Detection (via Codeless Connector Framework) | Yes | Yes | | RedSiftAuth_CL | Red Sift Events (CCP Push) | No | No | | RedSiftEmailForensics_CL | Red Sift Events (CCP Push) | No | No | | RelevanceSystemAlerts_CL | Google Threat Intelligence Relevance System Alerts | Yes | Yes | | RFI_PlaybookAlertResults_V2_CL | Recorded Future Identity - Playbook Alert Importer | No | No | | RSAIDPlus_AdminLogs_CL | RSA ID Plus Admin Logs Connector | No | No | | Rubrik_Anomaly_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes | | Rubrik_Events_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes | | Rubrik_Ransomware_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes | | Rubrik_ThreatHunt_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes | | SailPointIDN_Events_CLRubrikProtectionStatus_CL | SailPoint IdentityNow (using Azure Functions)Rubrik Security Cloud Protection Status (using Codeless Connector Framework) | Yes | Yes | | SailPointIDN_Triggers_CLSailPointISC_Events_CL | SailPoint IdentityNow (using Azure Functions)SailPoint Identity Security Cloud (via Codeless Connector Framework) | NoYes | NoYes | | SalesforceAuditTrailSalesforceAuditTrailV2_CL | Salesforce Audit Logs (via Codeless Connector Framework) | Yes | Yes | | SalesforceMarketingCloudAuditEvents | Salesforce Marketing Cloud (via Codeless Connector Framework) | No | No | | SalesForceRealTimeEventMonitoring_CL | SalesForce Real-Time Event Monitoring Connector (via Codeless Connector Framework) | Yes | Yes | | SalesforceServiceCloudV3_CL | Salesforce Service Cloud (via Codeless Connector Framework) | Yes | Yes | | Samsung_Knox_Audit_CL | Samsung Knox Asset Intelligence | Yes | Yes | | SentinelOneGroups_CL | SentinelOne (via Codeless Connector Framework)SentinelOne V2 (via Codeless Connector Framework) | Yes | Yes | | SentinelOneThreats_CL | SentinelOne (via Codeless Connector Framework)SentinelOne V2 (via Codeless Connector Framework) | Yes | Yes | | SeraphicWebSecurity_CL | Seraphic Web Security | No | No | | ServiceNowAlmAsset | ServiceNow CMDB (via Codeless Connector Framework) | No | No | | ServiceNowCmdbCi | ServiceNow CMDB (via Codeless Connector Framework) | No | No | | ServiceNowCmdbCiComputer | ServiceNow CMDB (via Codeless Connector Framework) | No | No | | ServiceNowCmdbCiServer | ServiceNow CMDB (via Codeless Connector Framework) | No | No | | ServiceNowCmdbRelCi | ServiceNow CMDB (via Codeless Connector Framework) | No | No | | SigninLogs | Microsoft Entra ID | Yes | Yes | | SlackAuditV2_CL | SlackAudit (via Codeless Connector Framework) | Yes | Yes | | SnowflakeLoad_CLSnowflakeLoadV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeLogin_CLSnowflakeLoginV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeMaterializedView_CLSnowflakeMaterializedViewV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeQuery_CLSnowflakeQueryV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeRoleGrant_CLSnowflakeRoleGrantV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeRoles_CLSnowflakeRolesV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeTables_CLSnowflakeTableStorageMetricsV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeTableStorageMetrics_CLSnowflakeTablesV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeUserGrant_CLSnowflakeUserGrantV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SnowflakeUsers_CLSnowflakeUsersV2_CL | Snowflake (via Codeless Connector Framework) | Yes | Yes | | SOCPrimeAuditLogs_CL | SOC Prime Platform Audit Logs Data Connector | Yes | Yes | | Sonrai_Tickets_CL | Sonrai Data Connector | No | No | | SophosEP_CL | [DEPRECATED] Sophos Endpoint Protection (using Azure Function) (using Azure Functions) | Yes | Yes | | Tenable_WAS_Vuln_CL | Tenable Vulnerability Management (using Azure Functions) | Yes | Yes | | TheHiveData | TheHive (via Codeless Connector Framework) | No | No | | TheomAlerts_CL | Theom | No | No | | ThinkstCanaryIncidents_CL | Thinkst Canary | Yes | Yes | | ThreatIntelIndicators | CrowdStrike Falcon Adversary Intelligence (using Azure Functions)Cyjax Threat Intelligence IOC Connector (using Azure Functions)Feedly IoCGreyNoise Threat IntelligenceJoeSandboxThreatIntelligence (using Azure Functions)PRODAFT USTA - IoC Threat Intelligence | Yes | No | | ThreatIntelligenceIndicator | Datalake2SentinelLuminar IOCs and Leaked Credentials (using Azure Functions)MISP2SentinelMicrosoft Defender Threat IntelligenceMimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)Premium Microsoft Defender Threat IntelligenceThreat Intelligence PlatformsThreat Intelligence Upload API (Preview)Threat intelligence - TAXIIVMRayThreatIntelligence (using Azure Functions) | Yes | No | | Tomcat_CL | Custom logs via AMA | Yes | Yes | | TransmitSecurityActivity_CLTransmitSecurityActivity_V2_CL | Transmit Security Connector (using Azure Functions)Transmit Security Data Connector (via Codeless Connector Framework) | No | No | | TrellixEvents | Trellix Endpoint Security (via Codeless Connector Framework) | No | No | | TrendAI_XDR_OAT_V2_CL | TrendAI Vision One™ - OAT Detections (via Codeless Connector Framework) | Yes | Yes | | TrendAI_XDR_WORKBENCH_V2_CL | TrendAI Vision One™ - Workbench Alerts (via Codeless Connector Framework) | Yes | Yes | | TrendMicro_XDR_OAT_CL | Trend Vision One (using Azure Functions) | NoYes | NoYes | | TrendMicro_XDR_RCA_Result_CL | Trend Vision One (using Azure Functions) | No | No | | TrendMicro_XDR_RCA_Task_CL | Trend Vision One (using Azure Functions) | No | No | | TrendMicro_XDR_WORKBENCH_CL | Trend Vision One (using Azure Functions) | Yes | Yes | | TrendMicroCAS_CL | Trend Micro Cloud App Security (using Azure Functions) | Yes | Yes | | TrendMicroCASV2_CL | Trend Micro Cloud App Security (via Codeless Connector Framework) | NoYes | NoYes | | Ttp_Attachment_CL | Mimecast Targeted Threat Protection | Yes | Yes | | Ttp_Impersonation_CL | Mimecast Targeted Threat Protection | Yes | Yes | | Ttp_Url_CL | Mimecast Targeted Threat Protection | Yes | Yes | | Ubiquiti_CL | Custom logs via AMA | Yes | Yes | | union ASimAgentEventLogs, ASimAlertEventLogs, ASimAssetEntityLogs, ASimAuditEventLogs, ASimAuthenticationEventLogs, ASimDhcpEventLogs, ASimDnsActivityLogs, ASimFileEventLogs, ASimNetworkSessionLogs, ASimProcessEventLogs, ASimRegistryEventLogs, ASimUserManagementActivityLogs, ASimWebSessionLogs | Synqly Integration Connector | No | No | | UniqkeyEvents_CL | Uniqkey Security Events | Yes | Yes | | UpwindCatalogAssets_CL | Upwind Catalog Loader (Ingestion API) | Yes | Yes | | UtimacoESKMKmipServerLogs_CL | Utimaco Enterprise Secure Key Manager (ESKM) | No | No | | Vaikora_AgentSignals_CL | Vaikora AI Agent Behavioral Signals | NoYes | NoYes | | ValenceAlert_CL | SaaS Security | No | No | | ValimailEnforceEvents_CL | Valimail Enforce Configuration Events | Yes | Yes | | VaronisAlerts_CL | Varonis SaaS[Deprecated] Varonis SaaS | Yes | Yes | | VaronisAlertsV2_CL | Varonis SaaS (Push) | Yes | Yes | | VaronisResources_CL | Varonis Purview Push Connector | Yes | Yes | | vcenter_CL | Custom logs via AMA | Yes | Yes | | VectraStream_CL | Custom logs via AMA | No | No | | VMwareWorkspaceOneDeviceApps | VMware Workspace ONE (via Codeless Connector Framework) | No | No | | VMwareWorkspaceOneDevices | VMware Workspace ONE (via Codeless Connector Framework) | No | No | | W3CIISLog | IIS Logs of Microsoft Exchange Servers[Deprecated] Microsoft Exchange Logs and Events | Yes | No | | web_assets_CL | Holm Security Asset Data (using Azure Functions)Holm Security Data Connector | No | No | | WindowsEvent | Windows Forwarded Events | Yes | Yes | | WizAuditLogsV3_CL | Wiz for Microsoft Sentinel | No | No | | WizDetectionsV3_CL | Wiz for Microsoft Sentinel | Yes | Yes | | ZeroFoxPhysicalThreats_CL | ZeroFox Enterprise - Physical Threats | Yes | Yes | | ZeroFoxTelegram_CL | ZeroFox Enterprise - Telegram | Yes | Yes | | ZeroFoxVulnerabilities_CL | ZeroFox Enterprise - Vulnerabilities | Yes | Yes | | ZimperiumThreatLog_CLZimperiumIncidentLog_CL | Zimperium Mobile Threat DefenseZimperium Mobile Threat Defense CCF | NoYes | NoYes | | ZimperiumIncidentMitigationLog_CL | Zimperium Mobile Threat Defense CCF | Yes | Yes | | ZimperiumMitigationLogV2_CL | Zimperium Mobile Threat Defense CCF | Yes | Yes | | ZimperiumThreatLogV2_CL | Zimperium Mobile Threat Defense CCF | Yes | Yes | | ZNAudit_CL | Zero Networks Segment (Push) | Yes | Yes | | ZNIdentityActivity_CL | Zero Networks Segment (Push) | Yes | Yes | | ZNNetworkActivity_CL | Zero Networks Segment (Push) | Yes | Yes |