The Codeless Connector Framework (CCF) lets you build a Microsoft Sentinel data connector without standing up a Function App or Logic App to shuttle logs. Most of the effort ends up in three places, and none of them is the part people expect.
1. The poller config
Getting RestApiPoller auth and pagination right is the bulk of the work. Token refresh,
cursor vs. page-number pagination, and rate-limit backoff all live here. Get this wrong and
you ingest nothing — or everything, twice.
2. The DCR transform
transformKql in the Data Collection Rule is where raw API responses become a usable table.
Keep transforms lean: parse what you need, drop what you don’t, and normalize field names so
your detections don’t have to special-case each source.
3. Proving it end to end
A connector that deploys isn’t a connector that works. Send a synthetic event through the DCE, confirm it lands in the target table, and query it back before you call it done.
Placeholder article — replace with your own connector write-up.
CCF removes a lot of glue code, but the discipline is the same as ever: validate ingestion with real data before trusting the dashboard.