Microsoft Sentinel

Sentinel Tables Connectors Reference

1 October 2026Doc update+3 / −2 lines

In brief

The reference now lists CiscoMerakiFileScannedEvents_CL and changes F5Telemetry_LTM_CL and RFI_PlaybookAlertResults_V2_CL from No/No to Yes/Yes in the two status columns.

What Defender admins need to know

Administrators should use the updated reference when checking these connector tables and their documented statuses.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| CiscoETD_CL | Cisco ETD | No | No | | CiscoETDv2_CL | Cisco Email Threat Defense (ETD) | Yes | Yes | | CiscoMerakiAirMarshalEvents_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiFileScannedEvents_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiNetworkClients_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiOrganizationNetworks_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | CiscoMerakiOrganizations_CL | Cisco Meraki Events (using REST API) (via Codeless Connector Framework) | Yes | Yes | | ExchangeHttpProxy_CL | Microsoft Exchange HTTP Proxy Logs [Deprecated] Microsoft Exchange Logs and Events | Yes | Yes | | ExtraHop_Detections_CL | ExtraHop Detections Data Connector | Yes | Yes | | F5Telemetry_ASM_CL | F5 BIG-IP | No | No | | F5Telemetry_LTM_CL | F5 BIG-IP | NoYes | NoYes | | F5Telemetry_system_CL | F5 BIG-IP | Yes | Yes | | FilewallExchange_CL | Filewall for Microsoft 365 | Yes | Yes | | FinanceOperationsActivity_CL | Dynamics 365 Finance and Operations | Yes | Yes | | RedSiftAuth_CL | Red Sift Events (CCP Push) | No | No | | RedSiftEmailForensics_CL | Red Sift Events (CCP Push) | No | No | | RelevanceSystemAlerts_CL | Google Threat Intelligence Relevance System Alerts | Yes | Yes | | RFI_PlaybookAlertResults_V2_CL | Recorded Future Identity - Playbook Alert Importer | NoYes | NoYes | | RSAIDPlus_AdminLogs_CL | RSA ID Plus Admin Logs Connector | No | No | | Rubrik_Anomaly_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes | | Rubrik_Events_Data_CL | Rubrik Security Cloud Security Events (Push)Rubrik Security Cloud data connector (using Azure Functions) | Yes | Yes |

@@ -187,6 +187,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | CiscoETD\_CL | [Cisco ETD](/en-us/azure/sentinel/data-connectors-reference#cisco-etd) | No | No |
 | CiscoETDv2\_CL | [Cisco Email Threat Defense (ETD)](/en-us/azure/sentinel/data-connectors-reference#cisco-email-threat-defense-etd) | Yes | Yes |
 | CiscoMerakiAirMarshalEvents\_CL | [Cisco Meraki Events (using REST API) (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#cisco-meraki-events-using-rest-api-via-codeless-connector-framework) | Yes | Yes |
+| CiscoMerakiFileScannedEvents\_CL | [Cisco Meraki Events (using REST API) (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#cisco-meraki-events-using-rest-api-via-codeless-connector-framework) | Yes | Yes |
 | CiscoMerakiNetworkClients\_CL | [Cisco Meraki Events (using REST API) (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#cisco-meraki-events-using-rest-api-via-codeless-connector-framework) | Yes | Yes |
 | CiscoMerakiOrganizationNetworks\_CL | [Cisco Meraki Events (using REST API) (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#cisco-meraki-events-using-rest-api-via-codeless-connector-framework) | Yes | Yes |
 | CiscoMerakiOrganizations\_CL | [Cisco Meraki Events (using REST API) (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#cisco-meraki-events-using-rest-api-via-codeless-connector-framework) | Yes | Yes |
@@ -352,7 +353,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | ExchangeHttpProxy\_CL | [Microsoft Exchange HTTP Proxy Logs](/en-us/azure/sentinel/data-connectors-reference#microsoft-exchange-http-proxy-logs)[\[Deprecated\] Microsoft Exchange Logs and Events](/en-us/azure/sentinel/data-connectors-reference#deprecated-microsoft-exchange-logs-and-events) | Yes | Yes |
 | ExtraHop\_Detections\_CL | [ExtraHop Detections Data Connector](/en-us/azure/sentinel/data-connectors-reference#extrahop-detections-data-connector) | Yes | Yes |
 | F5Telemetry\_ASM\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | No | No |
-| F5Telemetry\_LTM\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | No | No |
+| F5Telemetry\_LTM\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | Yes | Yes |
 | F5Telemetry\_system\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | Yes | Yes |
 | FilewallExchange\_CL | [Filewall for Microsoft 365](/en-us/azure/sentinel/data-connectors-reference#filewall-for-microsoft-365) | Yes | Yes |
 | FinanceOperationsActivity\_CL | [Dynamics 365 Finance and Operations](/en-us/azure/sentinel/data-connectors-reference#dynamics-365-finance-and-operations) | Yes | Yes |
@@ -542,7 +543,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | RedSiftAuth\_CL | [Red Sift Events (CCP Push)](/en-us/azure/sentinel/data-connectors-reference#red-sift-events-ccp-push) | No | No |
 | RedSiftEmailForensics\_CL | [Red Sift Events (CCP Push)](/en-us/azure/sentinel/data-connectors-reference#red-sift-events-ccp-push) | No | No |
 | RelevanceSystemAlerts\_CL | [Google Threat Intelligence Relevance System Alerts](/en-us/azure/sentinel/data-connectors-reference#google-threat-intelligence-relevance-system-alerts) | Yes | Yes |
-| RFI\_PlaybookAlertResults\_V2\_CL | [Recorded Future Identity - Playbook Alert Importer](/en-us/azure/sentinel/data-connectors-reference#recorded-future-identity---playbook-alert-importer) | No | No |
+| RFI\_PlaybookAlertResults\_V2\_CL | [Recorded Future Identity - Playbook Alert Importer](/en-us/azure/sentinel/data-connectors-reference#recorded-future-identity---playbook-alert-importer) | Yes | Yes |
 | RSAIDPlus\_AdminLogs\_CL | [RSA ID Plus Admin Logs Connector](/en-us/azure/sentinel/data-connectors-reference#rsa-id-plus-admin-logs-connector) | No | No |
 | Rubrik\_Anomaly\_Data\_CL | [Rubrik Security Cloud Security Events (Push)](/en-us/azure/sentinel/data-connectors-reference#rubrik-security-cloud-security-events-push)[Rubrik Security Cloud data connector (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#rubrik-security-cloud-data-connector-using-azure-functions) | Yes | Yes |
 | Rubrik\_Events\_Data\_CL | [Rubrik Security Cloud Security Events (Push)](/en-us/azure/sentinel/data-connectors-reference#rubrik-security-cloud-security-events-push)[Rubrik Security Cloud data connector (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#rubrik-security-cloud-data-connector-using-azure-functions) | Yes | Yes |