Issues

• [Microsoft Exchange Security - Exchange On-Premises] Documentation and minor issues found during migration to collector 8.0.0.0

  Solution
  Azure/Azure-Sentinel#15615 · Filter by author thom2804 opened on Nov 10, 2026
  

• [Microsoft Exchange Security - Exchange On-Premises] IIS-IoCs instance fails with HTTP 400 after migration to Azure Monitor (stream Custom-ESIIISIoCs missing from connector DCR)

  Solution
  Azure/Azure-Sentinel#15614 · Filter by author thom2804 opened on Nov 10, 2026
  

• [Microsoft Exchange Security - Exchange On-Premises] Collector 8.0.0.0: [int] cast on MaximalSentinelPacketSizeMb causes rejected segments with Log Ingestion API

  Solution
  Azure/Azure-Sentinel#15613 · Filter by author thom2804 opened on Nov 10, 2026
  

• [Microsoft Exchange Security - Exchange On-Premises] IIS-IoCs "CVE0DAY-Autodiscover" check always fails (unquoted date + unexpanded %SystemDrive%)

  Solution
  Azure/Azure-Sentinel#15612 · Filter by author thom2804 opened on Nov 10, 2026
  

• [Mulesoft] CloudHub Alerts CCF connector (Solution v3.1.0) cannot authenticate and polls alert definitions instead of alert history

  Codeless Connector Framework (CCF) ConnectorConnector
  Azure/Azure-Sentinel#15605 · Filter by author ashc136 opened on Nov 10, 2026
  

• Add documented Nizlo indicators to RemoteManagementMonitoring hunting queries

  Hunting
  Azure/Azure-Sentinel#15589 · Filter by author izikipizi opened on Nov 7, 2026
  

• SOC Handbook V3.1 candidate: ARM-TTK cannot extract nested templates

  ARM Template
  Azure/Azure-Sentinel#15585 · Filter by author billmcilhargey opened on Nov 6, 2026
  

• ASIM smoke test still expects optimized Salesforce Service Cloud parser to exceed query limit

  ASIM
  Azure/Azure-Sentinel#15584 · Filter by author billmcilhargey opened on Nov 6, 2026
  

• Meraki Data Connector Generates HTTP 400 Errors for Secure Connect Networks During Network Client Collection

  Connector
  Azure/Azure-Sentinel#15565 · Filter by author d-dasa opened on Nov 6, 2026
  3

  

• PaloAltoCortexDataLakeV01 parser execution delays

  Parser
  Azure/Azure-Sentinel#15560 · Filter by author cgiamp opened on Nov 5, 2026
  

• Workbook metadata version parser attributes a valid bump to the next workbook

  Workbook
  Azure/Azure-Sentinel#15541 · Filter by author billmcilhargey opened on Nov 3, 2026
  1

  

• Anomaly found in Network Session Traffic (ASIM Network Session schema) still not working

  Analytic Rules
  Azure/Azure-Sentinel#15442 · Filter by author defend-pippa opened on Oct 27, 2026
  2

  

• Windows installation of microsoft-sentinel-log-analytics-logstash-output-plugin 2.5.1 fails with Errno::ESRCH during gem extraction

  logstachplugin
  Azure/Azure-Sentinel#15355 · Filter by author 0ldHand opened on Oct 19, 2026
  1

  

• [BUG] Microsoft Sentinel Citrix DaaS Codeless Connector – Connection Appears Successful Regardless of Customer/Site ID, but No Logs Are Ingested

  Codeless Connector Framework (CCF) ConnectorConnectorSolution
  Azure/Azure-Sentinel#15339 · Filter by author xpinux opened on Oct 16, 2026
  

• CCF connector creation rejected by new DCR authorization check (Connector creation was rejected by a security requirement...") for all connector kinds, including Content Hub solutions

  Codeless Connector Framework (CCF) ConnectorConnectorDCRSolution
  Azure/Azure-Sentinel#15338 · Filter by author louee123 opened on Oct 16, 2026
  3

  

• Azure Firewall Workbook shows data for Tables related to Azure Diagnostics and not the Resource Specific.

  Workbook
  Azure/Azure-Sentinel#15302 · Filter by author Anto4595-git opened on Oct 12, 2026
  

• Support Multiple Box Instances/Connections in Microsoft Sentinel Box Solution

  Connectorenhancementfeature requestSolution
  Azure/Azure-Sentinel#15272 · Filter by author svc-gh-secops opened on Oct 6, 2026
  

• Snowflake connector OAuth support

  Connectorenhancementfeature request
  Azure/Azure-Sentinel#15266 · Filter by author RhysPFF opened on Oct 5, 2026
  1

  

• AtlassianOrganizationAuditConnector_CCF/Atlassian REST API Poller – Persistent Pagination Replay Causing Significant Duplicate Ingestion

  Codeless Connector Framework (CCF) ConnectorConnector
  Azure/Azure-Sentinel#15207 · Filter by author inquisitive-39 opened on Sep 28, 2026
  

• Unable to create Rare Process as a Service Analytic Rule

  Analytic Rules
  Azure/Azure-Sentinel#15194 · Filter by author SudBuddy opened on Sep 24, 2026
  5

  

• Meraki Air Marshal - Missing Fields

  Connector
  Azure/Azure-Sentinel#15167 · Filter by author jamesglaves opened on Sep 22, 2026
  

• Microsoft Business Applications Dataverse Function App pagination bug

  Connector
  Azure/Azure-Sentinel#15128 · Filter by author ben1994mc opened on Sep 15, 2026
  

• Meraki API Switch

  ConnectorProblem Solution
  Azure/Azure-Sentinel#15115 · Filter by author jackbaz opened on Sep 14, 2026
  

• [CrowdStrike API CCF connector] Majority of V2_CL columns cannot be populated; device fields not extracted from the device object

  Codeless Connector Framework (CCF) ConnectorConnector
  Azure/Azure-Sentinel#15094 · Filter by author CaptainCook112 opened on Sep 10, 2026
  1

  

• Amazon Web Services S3 - Connections Not Visible in Data Connector Page

  Connector
  Azure/Azure-Sentinel#15082 · Filter by author hernerwerzog opened on Sep 9, 2026
  1