Microsoft Sentinel
Cloud and workloadsSentinel Tables Connectors Reference
In brief
The table now labels the Netskope Web Transactions connector as deprecated, removes several older connector entries, and adds new connectors plus Snowflake V3 tables.
What Defender admins need to know
Review integrations, queries, and documentation that reference the deprecated Netskope tables or removed Snowflake V2, Okta, and SentinelOne entries.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| CommonSecurityLog | Cisco ASA/FTD via AMAClaroty xDomeInfoblox Cloud Data Connector via AMAInfoblox IQ for Threat Defense Insight Data Connector via AMASilverfort Admin ConsoleVirtualMetric DataStream for Microsoft Sentinel data lakeVirtualMetric DataStream for Microsoft SentinelVirtualMetric Director ProxyZscaler Internet Access Cloud NSS Audit Log Push ConnectorZscaler Internet Access Cloud NSS CASB Activity Log Push ConnectorZscaler Internet Access Cloud NSS CASB CRM Log Push ConnectorZscaler Internet Access Cloud NSS CASB Cloud Storage Log Push ConnectorZscaler Internet Access Cloud NSS CASB Collaboration Log Push ConnectorZscaler Internet Access Cloud NSS CASB Email Log Push ConnectorZscaler Internet Access Cloud NSS CASB File Sharing Log Push ConnectorZscaler Internet Access Cloud NSS CASB ITSM Log Push ConnectorZscaler Internet Access Cloud NSS CASB Repo Log Push ConnectorZscaler Internet Access Cloud NSS DNS Log Push ConnectorZscaler Internet Access Cloud NSS Email DLP Log Push ConnectorZscaler Internet Access Cloud NSS Endpoint DLP Log Push ConnectorZscaler Internet Access Cloud NSS Firewall Log Push ConnectorZscaler Internet Access Cloud NSS Tunnel Log Push ConnectorZscaler Internet Access Cloud NSS Web Log Push Connector | Yes | Yes |
| CommvaultAlerts_CL | CommvaultSecurityIQ | Yes | Yes |
| CommvaultAlertsCCF_CL | Commvault Security IQ (via Codeless Connector Framework) | Yes | Yes |
| ConfluenceAuditLogs_CLConfluenceAuditLogs | Atlassian Confluence Audit (via Codeless Connector Framework) | YesNo | YesNo |
| ContraForceEvents_CL | ContraForce Events | No | No |
| ContrastADRAttackEvents_CL | Contrast ADR Push Connector | Yes | Yes |
| ContrastADRIncidents_CL | Contrast ADR Push Connector | Yes | Yes |
| DigitalShadows_V2_CL | Digital Shadows Searchlight | No | No |
| DnsEvents | DNS | Yes | Yes |
| DnsInventory | DNS | Yes | Yes |
| DomainToolsThreatIntelDomains_CL | DomainTools Threat Intelligence Domain Feed | No | No |
| DoppelTable_CL | Doppel Data Connector | No | No |
| dossier_atp_CL | Infoblox Data Connector via REST API | No | No |
| dossier_atp_threat_CL | Infoblox Data Connector via REST API | No | No |
| F5Telemetry_ASM_CL | F5 BIG-IP | No | No |
| F5Telemetry_LTM_CL | F5 BIG-IP | Yes | Yes |
| F5Telemetry_system_CL | F5 BIG-IP | Yes | Yes |
| FCRisks_CL | FireCompass Risks | No | No |
| FilewallExchange_CL | Filewall for Microsoft 365 | Yes | Yes |
| FinanceOperationsActivity_CL | Dynamics 365 Finance and Operations | Yes | Yes |
| FireworkV2_CL | Flare Push Connector | Yes | Yes |
| MuleSoftCloudhubLogs | MuleSoft CloudHub Logs (Push Connector via Codeless Connector Framework) | No | No |
| NCProtectUAL_CL | NC Protect | No | No |
| Netskope_WebTx_metrics_CL | Netskope Data Connector | No | No |
| NetskopeAISecOps_CL | Netskope AI SecOps | No | No |
| NetskopeAlerts_CL | Netskope Alerts and Events | Yes | Yes |
| NetskopeClientStatus_CL | Netskope Client Status | No | No |
| NetskopeWebTransactions_CL | Netskope Web Transactions (via Blob Storage) | Yes | Yes |
| NetskopeWebtxData_CL | Netskope Web Transactions Data Connector[DEPRECATED] Netskope Web Transactions Data Connector (using Azure Function) | No | No |
| NetskopeWebtxErrors_CL | Netskope Web Transactions Data Connector[DEPRECATED] Netskope Web Transactions Data Connector (using Azure Function) | No | No |
| NetworkAccessTraffic | Microsoft Entra ID | Yes | Yes |
| NexposeInsightVMCloud_assets_CL | Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) | Yes | Yes |
| NexposeInsightVMCloud_vulnerabilities_CL | Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions) | Yes | Yes |
| ObsidianThreat_CL | Obsidian Datasharing Connector | No | No |
| OCI_LogsV2_CL | Oracle Cloud Infrastructure (via Codeless Connector Framework) | Yes | Yes |
| OfficeActivity | Microsoft 365 (formerly, Office 365) | Yes | Yes |
| Okta_CL | [DEPRECATED] Okta Single Sign-On (using Azure Function) (using Azure Functions) | Yes | Yes |
| OktaSSO | Okta Single Sign-On (via Codeless Connector Framework) | No | No |
| Onapsis_Defend_CL | Onapsis Defend: Integrate Unmatched SAP Threat Detection & Intel with Microsoft Sentinel | Yes | Yes |
| OneLoginEventsV2_CL | OneLogin IAM Platform (via Codeless Connector Framework) | Yes | Yes |
| SalesforceServiceCloudV3_CL | Salesforce Service Cloud (via Codeless Connector Framework) | Yes | Yes |
| Samsung_Knox_Audit_CL | Samsung Knox Asset Intelligence | Yes | Yes |
| SAPBTPAuditLog_CL | SAP BTP | Yes | Yes |
| SAPBTPAVL_CL | Application Vulnerability Report for SAP BTP | No | No |
| SAPETDAlerts_CL | SAP Enterprise Threat Detection, cloud edition | Yes | Yes |
| SAPETDInvestigations_CL | SAP Enterprise Threat Detection, cloud edition | Yes | Yes |
| SAPLogServ_CL | SAP LogServ (RISE), S/4HANA Cloud private edition | Yes | Yes |
| SecurityIncident | Derdack SIGNL4Microsoft Defender XDR | Yes | Yes |
| Seg_Cg_CL | Mimecast Secure Email Gateway | Yes | Yes |
| Seg_Dlp_CL | Mimecast Secure Email Gateway | Yes | Yes |
| SentinelOne_CL | [DEPRECATED] SentinelOne (using Azure Function) (using Azure Functions) | Yes | Yes |
| SentinelOneActivities_CL | SentinelOne (via Codeless Connector Framework)SentinelOne V2 (via Codeless Connector Framework) | Yes | Yes |
| SentinelOneAgents_CL | SentinelOne (via Codeless Connector Framework)SentinelOne V2 (via Codeless Connector Framework) | Yes | Yes |
| SentinelOneAlerts_CL | SentinelOne (via Codeless Connector Framework) | Yes | Yes |
| ServiceNowCmdbRelCi | ServiceNow CMDB (via Codeless Connector Framework) | No | No |
| SigninLogs | Microsoft Entra ID | Yes | Yes |
| SlackAuditV2_CL | SlackAudit (via Codeless Connector Framework) | Yes | Yes |
| SnowflakeLoadV2_CLSnowflakeLoadV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeLoginV2_CLSnowflakeLoginV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeMaterializedViewV2_CLSnowflakeMaterializedViewV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeQueryV2_CLSnowflakeQueryV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeRoleGrantV2_CLSnowflakeRoleGrantV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeRolesV2_CLSnowflakeRolesV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeTableStorageMetricsV2_CLSnowflakeTableStorageMetricsV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeTablesV2_CLSnowflakeTablesV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeUserGrantV2_CLSnowflakeUserGrantV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SnowflakeUsersV2_CLSnowflakeUsersV3_CL | Snowflake (via Codeless Connector Framework) | YesNo | YesNo |
| SOCPrimeAuditLogs_CL | SOC Prime Platform Audit Logs Data Connector | Yes | Yes |
| Sonrai_Tickets_CL | Sonrai Data Connector | No | No |
| SophosEP_CL | [DEPRECATED] Sophos Endpoint Protection (using Azure Function) (using Azure Functions) | Yes | Yes |
| Tenable_WAS_Asset_CL | Tenable Vulnerability Management (using Azure Functions) | Yes | Yes |
| Tenable_WAS_Vuln_CL | Tenable Vulnerability Management (using Azure Functions) | Yes | Yes |
| TheHiveData | TheHive (via Codeless Connector Framework) | No | No |
| TheomAlerts_CL | Theom | No | No |
| ThinkstCanaryIncidents_CL | Thinkst Canary | Yes | Yes |
| ThreatIntelIndicators | CrowdStrike Falcon Adversary Intelligence (using Azure Functions)Cyjax Threat Intelligence IOC Connector (using Azure Functions)Feedly IoCGreyNoise Threat IntelligenceJoeSandboxThreatIntelligence (using Azure Functions)PRODAFT USTA - IoC Threat Intelligence | Yes | No |
| ThreatIntelligenceIndicator | Datalake2SentinelLuminar IOCs and Leaked Credentials (using Azure Functions)MISP2SentinelMicrosoft Defender Threat IntelligenceMimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)Premium Microsoft Defender Threat IntelligenceThreat Intelligence PlatformsThreat Intelligence Upload API (Preview)Threat intelligence - TAXIIVMRayThreatIntelligence (using Azure Functions) | Yes | No |
@@ -213,7 +213,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | [CommonSecurityLog](/en-us/azure/azure-monitor/reference/tables/CommonSecurityLog) | [Cisco ASA/FTD via AMA](/en-us/azure/sentinel/data-connectors-reference#cisco-asaftd-via-ama)[Claroty xDome](/en-us/azure/sentinel/data-connectors-reference#claroty-xdome)[Infoblox Cloud Data Connector via AMA](/en-us/azure/sentinel/data-connectors-reference#infoblox-cloud-data-connector-via-ama)[Infoblox IQ for Threat Defense Insight Data Connector via AMA](/en-us/azure/sentinel/data-connectors-reference#infoblox-iq-for-threat-defense-insight-data-connector-via-ama)[Silverfort Admin Console](/en-us/azure/sentinel/data-connectors-reference#silverfort-admin-console)[VirtualMetric DataStream for Microsoft Sentinel data lake](/en-us/azure/sentinel/data-connectors-reference#virtualmetric-datastream-for-microsoft-sentinel-data-lake)[VirtualMetric DataStream for Microsoft Sentinel](/en-us/azure/sentinel/data-connectors-reference#virtualmetric-datastream-for-microsoft-sentinel)[VirtualMetric Director Proxy](/en-us/azure/sentinel/data-connectors-reference#virtualmetric-director-proxy)[Zscaler Internet Access Cloud NSS Audit Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-audit-log-push-connector)[Zscaler Internet Access Cloud NSS CASB Activity Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-activity-log-push-connector)[Zscaler Internet Access Cloud NSS CASB CRM Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-crm-log-push-connector)[Zscaler Internet Access Cloud NSS CASB Cloud Storage Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-cloud-storage-log-push-connector)[Zscaler Internet Access Cloud NSS CASB Collaboration Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-collaboration-log-push-connector)[Zscaler Internet Access Cloud NSS CASB Email Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-email-log-push-connector)[Zscaler Internet Access Cloud NSS CASB File Sharing Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-file-sharing-log-push-connector)[Zscaler Internet Access Cloud NSS CASB ITSM Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-itsm-log-push-connector)[Zscaler Internet Access Cloud NSS CASB Repo Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-casb-repo-log-push-connector)[Zscaler Internet Access Cloud NSS DNS Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-dns-log-push-connector)[Zscaler Internet Access Cloud NSS Email DLP Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-email-dlp-log-push-connector)[Zscaler Internet Access Cloud NSS Endpoint DLP Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-endpoint-dlp-log-push-connector)[Zscaler Internet Access Cloud NSS Firewall Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-firewall-log-push-connector)[Zscaler Internet Access Cloud NSS Tunnel Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-tunnel-log-push-connector)[Zscaler Internet Access Cloud NSS Web Log Push Connector](/en-us/azure/sentinel/data-connectors-reference#zscaler-internet-access-cloud-nss-web-log-push-connector) | Yes | Yes |
| CommvaultAlerts\_CL | [CommvaultSecurityIQ](/en-us/azure/sentinel/data-connectors-reference#commvaultsecurityiq) | Yes | Yes |
| CommvaultAlertsCCF\_CL | [Commvault Security IQ (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#commvault-security-iq-via-codeless-connector-framework) | Yes | Yes |
-| ConfluenceAuditLogs\_CL | [Atlassian Confluence Audit (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#atlassian-confluence-audit-via-codeless-connector-framework) | Yes | Yes |
+| ConfluenceAuditLogs | [Atlassian Confluence Audit (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#atlassian-confluence-audit-via-codeless-connector-framework) | No | No |
| ContraForceEvents\_CL | [ContraForce Events](/en-us/azure/sentinel/data-connectors-reference#contraforce-events) | No | No |
| ContrastADRAttackEvents\_CL | [Contrast ADR Push Connector](/en-us/azure/sentinel/data-connectors-reference#contrast-adr-push-connector) | Yes | Yes |
| ContrastADRIncidents\_CL | [Contrast ADR Push Connector](/en-us/azure/sentinel/data-connectors-reference#contrast-adr-push-connector) | Yes | Yes |
@@ -296,6 +296,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | DigitalShadows\_V2\_CL | [Digital Shadows Searchlight](/en-us/azure/sentinel/data-connectors-reference#digital-shadows-searchlight) | No | No |
| [DnsEvents](/en-us/azure/azure-monitor/reference/tables/DnsEvents) | [DNS](/en-us/azure/sentinel/data-connectors-reference#dns) | Yes | Yes |
| [DnsInventory](/en-us/azure/azure-monitor/reference/tables/DnsInventory) | [DNS](/en-us/azure/sentinel/data-connectors-reference#dns) | Yes | Yes |
+| DomainToolsThreatIntelDomains\_CL | [DomainTools Threat Intelligence Domain Feed](/en-us/azure/sentinel/data-connectors-reference#domaintools-threat-intelligence-domain-feed) | No | No |
| DoppelTable\_CL | [Doppel Data Connector](/en-us/azure/sentinel/data-connectors-reference#doppel-data-connector) | No | No |
| dossier\_atp\_CL | [Infoblox Data Connector via REST API](/en-us/azure/sentinel/data-connectors-reference#infoblox-data-connector-via-rest-api) | No | No |
| dossier\_atp\_threat\_CL | [Infoblox Data Connector via REST API](/en-us/azure/sentinel/data-connectors-reference#infoblox-data-connector-via-rest-api) | No | No |
@@ -355,6 +356,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | F5Telemetry\_ASM\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | No | No |
| F5Telemetry\_LTM\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | Yes | Yes |
| F5Telemetry\_system\_CL | [F5 BIG-IP](/en-us/azure/sentinel/data-connectors-reference#f5-big-ip) | Yes | Yes |
+| FCRisks\_CL | [FireCompass Risks](/en-us/azure/sentinel/data-connectors-reference#firecompass-risks) | No | No |
| FilewallExchange\_CL | [Filewall for Microsoft 365](/en-us/azure/sentinel/data-connectors-reference#filewall-for-microsoft-365) | Yes | Yes |
| FinanceOperationsActivity\_CL | [Dynamics 365 Finance and Operations](/en-us/azure/sentinel/data-connectors-reference#dynamics-365-finance-and-operations) | Yes | Yes |
| FireworkV2\_CL | [Flare Push Connector](/en-us/azure/sentinel/data-connectors-reference#flare-push-connector) | Yes | Yes |
@@ -477,10 +479,12 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | MuleSoftCloudhubLogs | [MuleSoft CloudHub Logs (Push Connector via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#mulesoft-cloudhub-logs-push-connector-via-codeless-connector-framework) | No | No |
| NCProtectUAL\_CL | [NC Protect](/en-us/azure/sentinel/data-connectors-reference#nc-protect) | No | No |
| Netskope\_WebTx\_metrics\_CL | [Netskope Data Connector](/en-us/azure/sentinel/data-connectors-reference#netskope-data-connector) | No | No |
+| NetskopeAISecOps\_CL | [Netskope AI SecOps](/en-us/azure/sentinel/data-connectors-reference#netskope-ai-secops) | No | No |
| NetskopeAlerts\_CL | [Netskope Alerts and Events](/en-us/azure/sentinel/data-connectors-reference#netskope-alerts-and-events) | Yes | Yes |
+| NetskopeClientStatus\_CL | [Netskope Client Status](/en-us/azure/sentinel/data-connectors-reference#netskope-client-status) | No | No |
| NetskopeWebTransactions\_CL | [Netskope Web Transactions (via Blob Storage)](/en-us/azure/sentinel/data-connectors-reference#netskope-web-transactions-via-blob-storage) | Yes | Yes |
-| NetskopeWebtxData\_CL | [Netskope Web Transactions Data Connector](/en-us/azure/sentinel/data-connectors-reference#netskope-web-transactions-data-connector) | No | No |
-| NetskopeWebtxErrors\_CL | [Netskope Web Transactions Data Connector](/en-us/azure/sentinel/data-connectors-reference#netskope-web-transactions-data-connector) | No | No |
+| NetskopeWebtxData\_CL | [\[DEPRECATED\] Netskope Web Transactions Data Connector (using Azure Function)](/en-us/azure/sentinel/data-connectors-reference#deprecated-netskope-web-transactions-data-connector-using-azure-function) | No | No |
+| NetskopeWebtxErrors\_CL | [\[DEPRECATED\] Netskope Web Transactions Data Connector (using Azure Function)](/en-us/azure/sentinel/data-connectors-reference#deprecated-netskope-web-transactions-data-connector-using-azure-function) | No | No |
| [NetworkAccessTraffic](/en-us/azure/azure-monitor/reference/tables/NetworkAccessTraffic) | [Microsoft Entra ID](/en-us/azure/sentinel/data-connectors-reference#microsoft-entra-id) | Yes | Yes |
| NexposeInsightVMCloud\_assets\_CL | [Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#rapid7-insight-platform-vulnerability-management-reports-using-azure-functions) | Yes | Yes |
| NexposeInsightVMCloud\_vulnerabilities\_CL | [Rapid7 Insight Platform Vulnerability Management Reports (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#rapid7-insight-platform-vulnerability-management-reports-using-azure-functions) | Yes | Yes |
@@ -491,7 +495,6 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | ObsidianThreat\_CL | [Obsidian Datasharing Connector](/en-us/azure/sentinel/data-connectors-reference#obsidian-datasharing-connector) | No | No |
| OCI\_LogsV2\_CL | [Oracle Cloud Infrastructure (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#oracle-cloud-infrastructure-via-codeless-connector-framework) | Yes | Yes |
| [OfficeActivity](/en-us/azure/azure-monitor/reference/tables/OfficeActivity) | [Microsoft 365 (formerly, Office 365)](/en-us/azure/sentinel/data-connectors-reference#microsoft-365-formerly-office-365) | Yes | Yes |
-| Okta\_CL | [\[DEPRECATED\] Okta Single Sign-On (using Azure Function) (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#deprecated-okta-single-sign-on-using-azure-function-using-azure-functions) | Yes | Yes |
| OktaSSO | [Okta Single Sign-On (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#okta-single-sign-on-via-codeless-connector-framework) | No | No |
| Onapsis\_Defend\_CL | [Onapsis Defend: Integrate Unmatched SAP Threat Detection & Intel with Microsoft Sentinel](/en-us/azure/sentinel/data-connectors-reference#onapsis-defend-integrate-unmatched-sap-threat-detection--intel-with-microsoft-sentinel) | Yes | Yes |
| OneLoginEventsV2\_CL | [OneLogin IAM Platform (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#onelogin-iam-platform-via-codeless-connector-framework) | Yes | Yes |
@@ -557,6 +560,7 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | SalesforceServiceCloudV3\_CL | [Salesforce Service Cloud (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#salesforce-service-cloud-via-codeless-connector-framework) | Yes | Yes |
| Samsung\_Knox\_Audit\_CL | [Samsung Knox Asset Intelligence](/en-us/azure/sentinel/data-connectors-reference#samsung-knox-asset-intelligence) | Yes | Yes |
| SAPBTPAuditLog\_CL | [SAP BTP](/en-us/azure/sentinel/data-connectors-reference#sap-btp) | Yes | Yes |
+| SAPBTPAVL\_CL | [Application Vulnerability Report for SAP BTP](/en-us/azure/sentinel/data-connectors-reference#application-vulnerability-report-for-sap-btp) | No | No |
| SAPETDAlerts\_CL | [SAP Enterprise Threat Detection, cloud edition](/en-us/azure/sentinel/data-connectors-reference#sap-enterprise-threat-detection-cloud-edition) | Yes | Yes |
| SAPETDInvestigations\_CL | [SAP Enterprise Threat Detection, cloud edition](/en-us/azure/sentinel/data-connectors-reference#sap-enterprise-threat-detection-cloud-edition) | Yes | Yes |
| SAPLogServ\_CL | [SAP LogServ (RISE), S/4HANA Cloud private edition](/en-us/azure/sentinel/data-connectors-reference#sap-logserv-rise-s4hana-cloud-private-edition) | Yes | Yes |
@@ -567,7 +571,6 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | SecurityIncident | [Derdack SIGNL4](/en-us/azure/sentinel/data-connectors-reference#derdack-signl4)[Microsoft Defender XDR](/en-us/azure/sentinel/data-connectors-reference#microsoft-defender-xdr) | Yes | Yes |
| Seg\_Cg\_CL | [Mimecast Secure Email Gateway](/en-us/azure/sentinel/data-connectors-reference#mimecast-secure-email-gateway) | Yes | Yes |
| Seg\_Dlp\_CL | [Mimecast Secure Email Gateway](/en-us/azure/sentinel/data-connectors-reference#mimecast-secure-email-gateway) | Yes | Yes |
-| SentinelOne\_CL | [\[DEPRECATED\] SentinelOne (using Azure Function) (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#deprecated-sentinelone-using-azure-function-using-azure-functions) | Yes | Yes |
| SentinelOneActivities\_CL | [SentinelOne (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#sentinelone-via-codeless-connector-framework)[SentinelOne V2 (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#sentinelone-v2-via-codeless-connector-framework) | Yes | Yes |
| SentinelOneAgents\_CL | [SentinelOne (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#sentinelone-via-codeless-connector-framework)[SentinelOne V2 (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#sentinelone-v2-via-codeless-connector-framework) | Yes | Yes |
| SentinelOneAlerts\_CL | [SentinelOne (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#sentinelone-via-codeless-connector-framework) | Yes | Yes |
@@ -582,16 +585,16 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | ServiceNowCmdbRelCi | [ServiceNow CMDB (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#servicenow-cmdb-via-codeless-connector-framework) | No | No |
| [SigninLogs](/en-us/azure/azure-monitor/reference/tables/SigninLogs) | [Microsoft Entra ID](/en-us/azure/sentinel/data-connectors-reference#microsoft-entra-id) | Yes | Yes |
| SlackAuditV2\_CL | [SlackAudit (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#slackaudit-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeLoadV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeLoginV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeMaterializedViewV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeQueryV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeRoleGrantV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeRolesV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeTableStorageMetricsV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeTablesV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeUserGrantV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
-| SnowflakeUsersV2\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | Yes | Yes |
+| SnowflakeLoadV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeLoginV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeMaterializedViewV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeQueryV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeRoleGrantV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeRolesV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeTableStorageMetricsV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeTablesV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeUserGrantV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
+| SnowflakeUsersV3\_CL | [Snowflake (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#snowflake-via-codeless-connector-framework) | No | No |
| SOCPrimeAuditLogs\_CL | [SOC Prime Platform Audit Logs Data Connector](/en-us/azure/sentinel/data-connectors-reference#soc-prime-platform-audit-logs-data-connector) | Yes | Yes |
| Sonrai\_Tickets\_CL | [Sonrai Data Connector](/en-us/azure/sentinel/data-connectors-reference#sonrai-data-connector) | No | No |
| SophosEP\_CL | [\[DEPRECATED\] Sophos Endpoint Protection (using Azure Function) (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#deprecated-sophos-endpoint-protection-using-azure-function-using-azure-functions) | Yes | Yes |
@@ -623,7 +626,6 @@ The following table lists the tables ingested into Microsoft Sentinel via data c | Tenable\_WAS\_Asset\_CL | [Tenable Vulnerability Management (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#tenable-vulnerability-management-using-azure-functions) | Yes | Yes |
| Tenable\_WAS\_Vuln\_CL | [Tenable Vulnerability Management (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#tenable-vulnerability-management-using-azure-functions) | Yes | Yes |
| TheHiveData | [TheHive (via Codeless Connector Framework)](/en-us/azure/sentinel/data-connectors-reference#thehive-via-codeless-connector-framework) | No | No |
-| TheomAlerts\_CL | [Theom](/en-us/azure/sentinel/data-connectors-reference#theom) | No | No |
| ThinkstCanaryIncidents\_CL | [Thinkst Canary](/en-us/azure/sentinel/data-connectors-reference#thinkst-canary) | Yes | Yes |
| [ThreatIntelIndicators](/en-us/azure/azure-monitor/reference/tables/ThreatIntelIndicators) | [CrowdStrike Falcon Adversary Intelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#crowdstrike-falcon-adversary-intelligence--using-azure-functions)[Cyjax Threat Intelligence IOC Connector (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#cyjax-threat-intelligence-ioc-connector-using-azure-functions)[Feedly IoC](/en-us/azure/sentinel/data-connectors-reference#feedly-ioc)[GreyNoise Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#greynoise-threat-intelligence)[JoeSandboxThreatIntelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#joesandboxthreatintelligence-using-azure-functions)[PRODAFT USTA - IoC Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#prodaft-usta---ioc-threat-intelligence) | Yes | No |
| [ThreatIntelligenceIndicator](/en-us/azure/azure-monitor/reference/tables/ThreatIntelligenceIndicator) | [Datalake2Sentinel](/en-us/azure/sentinel/data-connectors-reference#datalake2sentinel)[Luminar IOCs and Leaked Credentials (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#luminar-iocs-and-leaked-credentials-using-azure-functions)[MISP2Sentinel](/en-us/azure/sentinel/data-connectors-reference#misp2sentinel)[Microsoft Defender Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#microsoft-defender-threat-intelligence)[Mimecast Intelligence for Microsoft - Microsoft Sentinel (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#mimecast-intelligence-for-microsoft---microsoft-sentinel-using-azure-functions)[Premium Microsoft Defender Threat Intelligence](/en-us/azure/sentinel/data-connectors-reference#premium-microsoft-defender-threat-intelligence)[Threat Intelligence Platforms](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence-platforms)[Threat Intelligence Upload API (Preview)](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence-upload-api-preview)[Threat intelligence - TAXII](/en-us/azure/sentinel/data-connectors-reference#threat-intelligence---taxii)[VMRayThreatIntelligence (using Azure Functions)](/en-us/azure/sentinel/data-connectors-reference#vmraythreatintelligence-using-azure-functions) | Yes | No |