Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Data Connectors Reference

17 October 2026Doc updateAction required+173 / −44 lines

In brief

The documentation now lists required CrowdStrike REST API scopes, links to upgrade notes, adds Pathlock deployment guidance, removes the Red Canary connector section, and adds SilentPush Feeds details.

What Defender admins need to know

CrowdStrike administrators should verify the listed API scopes and use the updated parser for existing queries. Administrators deploying affected connectors should follow the revised vendor guidance.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Prerequisites:

  • Crowdstrike OAuth2 API Client and Scopes: #### Required API Scopes In your CrowdStrike Falcon console, go to Support and resources > API clients and keysIntegrations, select your API client, and enable the following scopes with ReadApp Logs access:, Alerts, Cases, Detections, Hosts, Spotlight Vulnerabilities. For more information, see API. are required for REST API.

Setup Instructions:

For detailed instructions on retrieving the Base API URL, Client ID, and Client Secret, please refer to the Connector Tutorial.

Solution version 3.4.0 and later uses the CrowdStrike V2 tables. Please use updated parser for any existing queries. ReferFor more information, refer to the releaseupgrade notes of the solution herehere

Manage CrowdStrike Connections

By combining business-context intelligence with advanced analytics, Pathlock enables enterprises to strengthen detection accuracy, streamline response actions, and maintain continuous control across their SAP environments—without adding complexity or redundant monitoring layers.

For detailed guidance on how to deploy this connector, refer to the Pathlock help portal.

Log Analytics table(s):

| Table | DCR support | Lake-only ingestion |

2. Maintain the data collection endpoint details and authentication info in your central instance of Pathlock's Cybersecurity Application Controls: Threat Detection and Response

Share the data collection endpoint URL and authentication info with the Pathlock administrator to configure the plug and play forwarding in Threat Detection and Response to send data to the data collection endpoint. For detailed deployment guidance, refer to the Pathlock help portal. Please do not hesitate to contact Pathlock if support is needed.

  • Use this value to configure as Tenant ID in the LogIngestionAPI credential.: <variable value provided at install time>
  • Entra Application ID: <variable value provided at install time>

Proofpoint TAP (via Codeless Connector Framework)

Supported by:Microsoft CorporationProofpoint, Inc.

The Proofpoint Targeted Attack Protection (TAP) connector provides the capability to ingest Proofpoint TAP logs and events into Microsoft Sentinel. The connector provides visibility into Message and Click events in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.

Proofpoint TAP (via Codeless Connector Framework)

Supported by:Proofpoint, Inc.Microsoft Corporation

The Proofpoint Targeted Attack Protection (TAP) connector provides the capability to ingest Proofpoint TAP logs and events into Microsoft Sentinel. The connector provides visibility into Message and Click events in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.

portal.azure.com

Red Canary Threat Detection (via Codeless Connector Framework)Sift Events (CCF Push)

Supported by:Red CanaryRed Sift

  • Data Connectors Grid (configure in portal)

SilentPush Feeds

The Red CanarySupported by:SilentPush

Native codeless data connector enables Red Canary to publish detections into Microsoft Sentinel usingfor monitoring Silent Push threat actor feeds. Supports feed exports in CSV format with a header row (e.g. *_enriched.csv). Not compatible with headerless plaintext indicator lists (e.g. *_ips.txt, *_domains.txt) -- use the Codeless Connector Framework push pattern and the Azure Monitor Logs Ingestion API.SilentPush Export Enrichment playbooks for those instead.

Log Analytics table(s):

Table DCR support Lake-only ingestion
RedCanaryDetections_CLSLP_Feeds_CL YesNo YesNo

Data collection rule support:Workspace transform DCR Not currently supported

Prerequisites:

Setup Instructions:

Connect to Silent Push and collect feed

In order to start collecting Silent Push feeds, please provide the required information below. Note: the feed you select must export as a CSV file with a header row (e.g. an *_enriched.csv export) -- headerless plaintext indicator lists (e.g. *_ips.txt, *_domains.txt) are not supported here, use the SilentPush Export Enrichment playbooks for those instead.

  • API key: (YOUR-SILENT-PUSH-API-KEY)
  • Data source: (organization-exports)
  • Feed file name: (e.g. 01234567-0123-4567-8901-012345678901_enriched.csv)
  • Enable/Disable Connection

Silverfort Admin Console

Supported by:Silverfort

  • Enable/Disable Connection

Theom

Supported by:Microsoft

Theom Data Connector enables organizations to connect their Theom environment to Microsoft Sentinel. This solution enables users to receive alerts on data security risks, create an app registrationand enrich incidents, check statistics and trigger SOAR playbooks in Microsoft Entra ID. Typically requiresSentinel

Log Analytics table(s):

TableDCR supportLake-only ingestion
TheomAlerts_CLNoNo

Data collection rule support: Not currently supported

Setup Instructions:

  1. In Theom UI Console click on Manage -> Alerts on the Application Developer role or higher.side bar.
  2. Select Sentinel tab.
  3. Click on Active button to enable the configuration.
  4. Enter Primary key as Authorization Token
  5. Enter Endpoint URL as https://<Workspace ID>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01
  6. Click on SAVE SETTINGS
  • Workspace ID: <variable value provided at install time>
  • Microsoft AzurePrimary Key: Permission<variable value provided at install time>

Theom (via Codeless Connector Framework)

Supported by:Microsoft

Theom Data Connector enables organizations to assignconnect their Theom environment to Microsoft Sentinel. This solution enables users to receive alerts on data security risks, create and enrich incidents, check statistics and trigger SOAR playbooks in Microsoft Sentinel.

Log Analytics table(s):

TableDCR supportLake-only ingestion
TheomAlertsV2_CLNoNo

Data collection rule support: Not currently supported

Prerequisites:

  • Microsoft.Insights/dataCollectionEndpoints: Data Collection Endpoint is required for the Monitoring Metrics Publisher role onmodern push connector to receive data from the data collection rule. Typically requires Azure RBAC Owner or User Access Administrator.external security system.
  • Red CanaryMicrosoft.Insights/dataCollectionRules: AccessData Collection Rule is required to configuredefine the Microsoft Sentinel response action in Red Canary.schema and transformations for incoming data.
  • Microsoft.Authorization/roleAssignments: Role assignment is required to grant the Entra application permissions to send data to the Data Collection Rule.

Setup Instructions:

1. Create connector resourcesARM Resources and Provide the Required Permissions

DeployThis connector receives data from external security systems that push logs to Microsoft Sentinel. The external system must be configured to send raw event data to the CCF push resources required for Red Canary detection ingestion.

Automated configuration and secure data ingestionMicrosoft Sentinel Ingestion API. Clicking on Deploy createswill trigger the creation of Log Analytics table,tables and a Data Collection Rule (DCR), . It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

Learn more about the connector setup process

Azure Resource Deployment

The deployment process will create the following resources:

  • Log Analytics custom table(s)
  • Data Collection Endpoint (DCE), Microsoft
  • Data Collection Rule (DCR)
  • Entra application, application secret, and role assignment required to ingest Red Canary detections through the Azure Monitor Logs Ingestion API.ID Application Registration
  • Role assignments for data ingestion

Configuration Values

2. Configure Red Canary

UseAfter deployment, copy the generatedfollowing values to configure Red Canary to send detections to this Microsoft Sentinel workspace.your external security system:

  • Tenant ID (Directory ID): <variable value provided at install time>
  • Entra App Registration Application ID: <variable value provided at install time>
  • Entra App Registration Secret: <variable value provided at install time>
  • Data Collection Endpoint URIUrl: <variable value provided at install time>
  • Data Collection Rule Immutable ID: <variable value provided at install time>
  • Detections Stream Name (TheomAlertsV2): <variable value provided at install time>

Note: Keep these values secure. You will need them to configure your external security system.

2. Configure your external system to push logs

Use the following parameters to configure your external security system to send logs to the workspace.

Configuration Steps

  1. Access your external security system's configuration interface.
  2. Navigate to the data forwarding, integration, or SIEM settings.
  3. Select Azure Monitor or Microsoft Sentinel as the destination.
  4. Select Data Collection Endpoint as the authentication method.
  5. Configure the Red Canaryrequired fields using the values from the previous step:
    • Tenant ID: Copy from above
    • Application (Client) ID: Copy from above
    • Client Secret: Copy from above
    • Data Collection Endpoint: Copy from above
    • Data Collection Rule Immutable ID: Copy from above
    • Stream Name: Copy the appropriate stream name from above
  6. Save the configuration and enable/start the forwarder.

Validation

Note: Data will appear in the TheomAlertsV2 table in your Log Analytics workspace within a few minutes.

To verify data is being received, run the following query in your Log Analytics workspace:

TheomAlertsV2
| where TimeGenerated > ago(1h)
| take 10

Troubleshooting

If data is not appearing:

  • Verify the configuration values are correct
  • Check that the forwarder/integration is enabled and running
  • Review logs in your external security system for any errors
  • Ensure network connectivity from your system to Azure
  • Verify the Entra application has the correct permissions

Configure the Theom Microsoft Sentinel response actionIntegration

In the Theom UI console, navigate to Manage -> Alerts -> Microsoft Sentinel, click Active, and configure the integration with the values above. Red Canary should post detection records to the Logs Ingestion API endpoint using the stream name from Step 1:

Theom fieldValue from connector deployment
**Endpoint URLData Collection Endpoint Url**
**DCR Immutable IDData Collection Rule Immutable ID**
Stream NameCustom-RedCanaryDetectionsTheomAlertsV2_CL.

**Application (Client) IDEntra App Registration Application ID**
**Client SecretEntra App Registration Secret**
**Tenant IDEntra Tenant ID**
Red Sift Events (CCF Push)

Supported by:Red Sift

  • Data Connectors Grid (configureScopes
ROOT
Data FormatJSON

Then click SAVE SETTINGS in portal)

Silverfort Admin ConsoleTheom.

Supported by:Silverfort

  • Enable/Disable Connection

Thinkst Canary

Supported by:Thinkst Applied Research