New Crowdstrike connectors by ericlamer · Pull Request #13536 · Azure/Azure-Sentinel

ericlamer · 2026-01-30T16:20:19Z

Required items, please complete

Change(s):

Added 4 new connectors for Crowdstrike, all connectors are using multi config.

Reason for Change(s):

New connectors

Version Updated:

First commit

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

ericlamer · 2026-01-30T16:26:13Z

@ericlamer please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree [company="Robert Half"]

ericlamer · 2026-01-30T16:27:22Z

microsoft-github-policy-service agree company="your company"

microsoft-github-policy-service agree company="Robert Half"

v-maheshbh · 2026-02-02T11:59:59Z

Hi @ericlamer
Kindly accept the CLA at the earliest to enable further progress.

Thanks!

ericlamer · 2026-02-02T12:53:44Z

@microsoft-github-policy-service agree company="Robert Half"

v-maheshbh · 2026-02-09T07:14:47Z

Hi @ericlamer

Kindly refer to the CCF folder naming conventions and follow the solution structure provided below. and kindly add the release notes.
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/Data%20Connectors/CloudflareLog_CCF

Thanks!

ericlamer · 2026-02-09T12:59:52Z

Hi, Is there an easy way to split a template into seperate files? Thanks.

…

_______________________ Eric Lamer Cybersecurity Architect (SIEM) ***@***.******@***.***> Work number: 925-494-9193 [cid:4ce0647f-d6ef-419c-969d-c5697cb41ac2][cid:ab785468-274f-49a0-843e-ca66d8845cdf][cid:5cb49850-efe9-4146-9a48-d02d64448286][cid:b22d98af-9df7-4813-82c4-ed175e8e7175][cid:669dc833-b78f-45d7-a987-1a29989bee8b][cid:013d37b3-777f-4a4b-98b0-dece5388bb75]

________________________________ From: v-maheshbh ***@***.***> Sent: Monday, February 9, 2026 2:15 AM To: Azure/Azure-Sentinel ***@***.***> Cc: Lamer, Eric (HQP) ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] New Crowdstrike connectors (PR #13536) [https://avatars.githubusercontent.com/u/207855009?s=20&v=4]v-maheshbh left a comment (Azure/Azure-Sentinel#13536)<#13536 (comment)> Hi @ericlamer<https://github.com/ericlamer> Kindly refer to the CCF folder naming conventions and follow the solution structure provided below.https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/Data%20Connectors/CloudflareLog_CCF Thanks! — Reply to this email directly, view it on GitHub<#13536 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BDLILMSRZS63O5IDXJICIT34LAXYDAVCNFSM6AAAAACTOSC6U6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQNRZG43TSMZZGQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

v-maheshbh · 2026-02-20T08:45:01Z

Hi @ericlamer

Kindly review the above comments and refer to the solution for guidance.

Thanks!

ericlamer · 2026-03-04T20:30:52Z

Hi @ericlamer

Kindly review the above comments and refer to the solution for guidance.

Thanks!

Hi,

I was on vacation, will review my code and resubmit soon.

Thanks.

Copilot

Pull request overview

Adds new CrowdStrike Falcon multi-configuration codeless data connector assets (ARM templates + supporting JSON fragments and docs) for Microsoft Sentinel.

Changes:

Added multiconfig ARM templates for CrowdStrike API connectors (Apps, Sensor, RTR Audit, and a general API bundle).
Added standalone JSON fragments for connector definition, polling config, DCR, and table schemas.
Added README documentation for several connectors.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeRTRAudit_multiconfig_ccf/CrowdStrike_API_RTR_multi.json	Adds ARM template for the RTR Audit multiconfig codeless connector (definition + connections + DCR + table).
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeRTRAudit_multiconfig_ccf/CrowdStrikeRTRAudit_multiconfig_Table.json	Adds Log Analytics table schema fragment for RTR Audit.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeRTRAudit_multiconfig_ccf/CrowdStrikeRTRAudit_multiconfig_PollingConfig.json	Adds polling/dataConnector resource fragment for RTR Audit.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeRTRAudit_multiconfig_ccf/CrowdStrikeRTRAudit_multiconfig_Definition.json	Adds dataConnectorDefinitions fragment (UI/config) for RTR Audit.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdstrikeRTRAudit_multiconfig_ccf/CrowdStrikeRTRAudit_multiconfig_DCR.json	Adds DCR fragment for RTR Audit ingestion/transforms.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/README.md	Adds end-user documentation for the Sensor connector.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/CrowdStrike_API_Sensor_multi.json	Adds ARM template for the Sensor multiconfig codeless connector (definition + connections + DCR + table).
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/CrowdStrikeSensor_multiconfig_Table.json	Adds Log Analytics table schema fragment for Sensor.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/CrowdStrikeSensor_multiconfig_PollingConfig.json	Adds polling/dataConnector resource fragment for Sensor.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/CrowdStrikeSensor_multiconfig_Definition.json	Adds dataConnectorDefinitions fragment (UI/config) for Sensor.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeSensor_multiconfig_ccf/CrowdStrikeSensor_multiconfig_DCR.json	Adds DCR fragment for Sensor ingestion/transforms.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/README.md	Adds end-user documentation for the Apps connector.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/CrowdsStrikeApps_multiconfig_Table.json	Adds Log Analytics table schema fragment for Apps.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/CrowdStrike_API_Apps_multi.json	Adds ARM template for the Apps multiconfig codeless connector (definition + connections + DCR + table).
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/CrowdStrikeApps_multiconfig_PollingConfig.json	Adds polling/dataConnector resource fragment for Apps.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/CrowdStrikeApps_multiconfig_Definition.json	Adds dataConnectorDefinitions fragment (UI/config) for Apps.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeApps_multiconfig_ccf/CrowdStrikeApps_multiconfig_DCR.json	Adds DCR fragment for Apps ingestion/transforms.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/README.md	Adds end-user documentation for the bundled CrowdStrike API connector.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/CrowdStrike_API_Sensor_multi.json	Adds ARM template for a Sensor variant under the bundled API connector folder.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/CrowdStrikeAPI_multiconfig_Table.json	Adds table schema fragments for the bundled API connector tables.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/CrowdStrikeAPI_multiconfig_PollingConfig.json	Adds polling/dataConnector resource fragments for multiple data types in the bundled API connector.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/CrowdStrikeAPI_multiconfig_Definition.json	Adds dataConnectorDefinitions fragment (UI/config) for the bundled API connector.
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_multiconfig_ccf/CrowdStrikeAPI_multiconfig_DCR.json	Adds DCR fragment for bundled API connector ingestion/transforms.

v-maheshbh · 2026-03-26T07:26:00Z

@@ -0,0 +1,197 @@
+{
+                            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",


Hi @ericlamer The field name and ID must remain the same. Kindly rename the name field to CrowdStrikeAPIDataConnector to ensure consistency. and please follow the same naming and structure conventions used by other CCF connectors to maintain consistency.

v-maheshbh · 2026-04-01T07:18:10Z

Hi @ericlamer

Kindly review the comment added in the definition file.

Thanks!

v-maheshbh · 2026-04-22T05:09:57Z

Hi @ericlamer
Please review the comments mentioned above and update accordingly.

Thanks!

v-maheshbh · 2026-05-28T11:23:06Z

HI @ericlamer

Kindly review the above comments and address them as applicable.

Thanks!

v-maheshbh · 2026-06-05T12:06:35Z

Hi @ericlamer

Kindly review the comment added in the definition file.

Thanks!

v-maheshbh · 2026-06-17T08:59:50Z

Hi @ericlamer

Kindly review above comments.

Thanks!

slam666 and others added 4 commits January 30, 2026 11:08

Test

d19f330

New connectors

db7d30f

January-01-2026

1b032dc

Merge branch 'Azure:master' into master

ff75187

ericlamer requested review from a team as code owners January 30, 2026 16:20

v-atulyadav assigned v-maheshbh Feb 2, 2026

v-atulyadav added Solution Solution specialty review needed Codeless Connector Framework (CCF) Connector labels Feb 2, 2026

ericlamer and others added 7 commits March 13, 2026 10:32

Merge branch 'Azure:master' into master

0140a68

New files structure

5acf527

New file structure

acbaadd

New file structure

46fb246

New file structure

f27df57

New file structure

61d105c

Merge branch 'Azure:master' into master

6a3da51

v-maheshbh requested a review from Copilot March 26, 2026 07:13

Copilot AI reviewed Mar 26, 2026

View reviewed changes

v-maheshbh reviewed Mar 26, 2026

View reviewed changes

Merge branch 'Azure:master' into master

37b1893

		@@ -0,0 +1,197 @@
		{
		"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]",

Conversation

ericlamer commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ericlamer commented Jan 30, 2026

Uh oh!

ericlamer commented Jan 30, 2026

Uh oh!

v-maheshbh commented Feb 2, 2026

Uh oh!

ericlamer commented Feb 2, 2026

Uh oh!

v-maheshbh commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ericlamer commented Feb 9, 2026 via email

Uh oh!

v-maheshbh commented Feb 20, 2026

Uh oh!

ericlamer commented Mar 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

v-maheshbh Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

v-maheshbh commented Apr 1, 2026

Uh oh!

v-maheshbh commented Apr 22, 2026

Uh oh!

v-maheshbh commented May 28, 2026

Uh oh!

v-maheshbh commented Jun 5, 2026

Uh oh!

v-maheshbh commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ericlamer commented Jan 30, 2026 •

edited

Loading

v-maheshbh commented Feb 9, 2026 •

edited

Loading

v-maheshbh commented Jun 17, 2026 •

edited

Loading