← All posts
sentinel · ccf · kql

Field notes: building a Sentinel CCF connector

What actually matters when you move a connector to the Codeless Connector Framework.

The Codeless Connector Framework (CCF) lets you build a Microsoft Sentinel data connector without standing up a Function App or Logic App to shuttle logs. Most of the effort ends up in three places, and none of them is the part people expect.

1. The poller config

Getting RestApiPoller auth and pagination right is the bulk of the work. Token refresh, cursor vs. page-number pagination, and rate-limit backoff all live here. Get this wrong and you ingest nothing — or everything, twice.

2. The DCR transform

transformKql in the Data Collection Rule is where raw API responses become a usable table. Keep transforms lean: parse what you need, drop what you don’t, and normalize field names so your detections don’t have to special-case each source.

3. Proving it end to end

A connector that deploys isn’t a connector that works. Send a synthetic event through the DCE, confirm it lands in the target table, and query it back before you call it done.

Placeholder article — replace with your own connector write-up.

CCF removes a lot of glue code, but the discipline is the same as ever: validate ingestion with real data before trusting the dashboard.