XdrLogRaider — new community solution (Defender XDR portal-internal /apiproxy telemetry connector) by akefallonitis · Pull Request #14668 · Azure/Azure-Sentinel

akefallonitis · 2026-07-13T08:38:18Z

XdrLogRaider — new community solution (DRAFT)

This PR adds a new Microsoft Sentinel community solution: XdrLogRaider, an Azure Function data connector that ingests Microsoft Defender XDR portal-internal /apiproxy/* audit and reporting telemetry into per-Category Defender_<Category>_CL custom Log Analytics tables.

Author / support: Alex Kefallonitis — community-supported (support.tier: Community).
Project repository: https://github.com/akefallonitis/xdrlograider (MIT).

What it does

Self-hosted PowerShell Function App in the customer's own Azure subscription.
Unattended Entra service-account authentication (TOTP or Passkey/FIDO2 MFA) with transparent SSO refresh; read-only by design — no action verbs are ever invoked on the portal; zero telemetry to the maintainer.
Ingests 11 Defender categories into Defender_<Category>_CL tables, one typed row per event with raw JSON preserved, with dynamic per-tenant capability discovery.

⚠️ Data-source disclosure — flagging for maintainer review

This connector authenticates to and reads from Microsoft Defender XDR portal-internal /apiproxy/* endpoints, which are undocumented and unsupported and may change or break without notice. I'm raising this explicitly and up front, because the Microsoft Sentinel team is best placed to decide whether and how you'd like a community connector on this surface represented in the Content Hub. It is a community, non-Microsoft project, read-only, intended for authorized use within the customer's own tenant. I'm very happy to adjust anything — connector kind, template structure, scope, or framing — per your guidance.

Packaging notes

Packaged with Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 (version 3.0.1).
The Function App code (function-app.zip) is committed under Solutions/XdrLogRaider/Data Connectors/ and referenced by an in-repo raw.githubusercontent.com/Azure/Azure-Sentinel/master/... URL (as IllumioSaaS / NordPass do). Happy to switch to an aka.ms/sentinel-XdrLogRaider-functionapp redirect if you'd prefer to mint one.
One known arm-ttk finding remains — IDs Should Be Derived From ResourceIDs on the tool-generated metadata resource (the common Sentinel-solution metadata pattern). Guidance welcome.

Opening as a draft to invite the review and the data-source discussion before finalizing.

…piproxy telemetry connector) New Azure Function data connector solution that ingests Microsoft Defender XDR portal-internal /apiproxy/* audit and reporting telemetry into per-Category Defender_<Category>_CL custom Log Analytics tables. Community-supported, read-only, self-hosted in the customer's own subscription/tenant with unattended Entra service-account auth (TOTP or Passkey MFA) and transparent SSO refresh. Packaged with the V3 solution tool. NOTE: the data source is Defender's undocumented, unsupported portal-internal /apiproxy surface (disclosed in the connector description).

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds the new XdrLogRaider community Microsoft Sentinel solution, packaging an Azure Function-based data connector for ingesting Defender XDR portal-internal /apiproxy/* telemetry into custom Log Analytics tables.

Changes:

Introduces solution metadata + release notes for Content Hub packaging.
Adds solution package artifacts (ARM mainTemplate + createUiDefinition + test parameters).
Adds the data connector definition (GenericUI) for Defender_* custom tables.

Reviewed changes

Copilot reviewed 7 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
Solutions/XdrLogRaider/SolutionMetadata.json	Adds Content Hub solution metadata (publisher/support/categories).
Solutions/XdrLogRaider/ReleaseNotes.md	Adds initial release notes entry.
Solutions/XdrLogRaider/Package/testParameters.json	Adds ARM-TTK-friendly parameters for validation/testing.
Solutions/XdrLogRaider/Package/mainTemplate.json	Adds the solution/package ARM template and embedded data connector resources.
Solutions/XdrLogRaider/Package/createUiDefinition.json	Adds UI definition for selecting the target workspace and install flow text.
Solutions/XdrLogRaider/Data/Solution_XdrLogRaider.json	Adds solution packaging manifest used by the solution tooling.
Solutions/XdrLogRaider/Data Connectors/XdrLogRaider_API_FunctionApp.json	Adds the GenericUI data connector definition (queries, data types, instructions).

+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2023-04-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+              "properties": {
+                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+                "contentId": "[variables('_dataConnectorContentId1')]",
+                "kind": "DataConnector",
+                "version": "[variables('dataConnectorVersion1')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "XdrLogRaider",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Alex Kefallonitis",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "name": "Alex Kefallonitis",
+                  "email": "al.kefallonitis@gmail.com",
+                  "tier": "Community",
+                  "link": "https://github.com/akefallonitis/xdrlograider/issues"
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_dataConnectorContentId1')]",
+        "contentKind": "DataConnector",
+        "displayName": "Microsoft Defender XDR (XdrLogRaider)",
+        "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
+        "id": "[variables('_dataConnectorcontentProductId1')]",
+        "version": "[variables('dataConnectorVersion1')]"
+      }
+    },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+      "dependsOn": [
+        "[variables('_dataConnectorId1')]"
+      ],
+      "location": "[parameters('workspace-location')]",
+      "properties": {
+        "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+        "contentId": "[variables('_dataConnectorContentId1')]",
+        "kind": "DataConnector",
+        "version": "[variables('dataConnectorVersion1')]",
+        "source": {
+          "kind": "Solution",
+          "name": "XdrLogRaider",
+          "sourceId": "[variables('_solutionId')]"
+        },
+        "author": {
+          "name": "Alex Kefallonitis",
+          "email": "[variables('_email')]"
+        },
+        "support": {
+          "name": "Alex Kefallonitis",
+          "email": "al.kefallonitis@gmail.com",
+          "tier": "Community",
+          "link": "https://github.com/akefallonitis/xdrlograider/issues"
+        }
+      }
+    },
+    {
+      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+      "apiVersion": "2021-03-01-preview",
+      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+      "location": "[parameters('workspace-location')]",
+      "kind": "GenericUI",
+      "properties": {
+        "connectorUiConfig": {
+          "title": "Microsoft Defender XDR (XdrLogRaider)",


+                  "availability": {
+                    "status": 1,
+                    "isPreview": false
+                  },


+  "availability": {
+    "status": 1,
+    "isPreview": true
+  },


+    "Data Connectors/XdrLogRaider_API_FunctionApp.json"
+  ],
+  "Metadata": "SolutionMetadata.json",
+  "BasePath": "C:\\Users\\alkef\\Desktop\\Repos\\Azure-Sentinel\\Solutions\\XdrLogRaider",


+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History**                                   |
+|-------------|--------------------------------|------------------------------------------------------|
+| 3.0.1       | 13-07-2026                     | Initial Solution release. Adds the XdrLogRaider Azure Function data connector for Microsoft Defender XDR portal-internal `/apiproxy/*` telemetry (per-Category `Defender_<Category>_CL` tables). |


+    "defaultValue": "",
+    "type": "string",
+    "metadata": {
+      "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"


+    "type": "string",
+    "defaultValue": "",
+    "metadata": {
+      "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"


+            "options": {
+              "link": {
+                "label": "Learn more about connecting data sources",
+                "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"


…stom tables, logo) - Connector card permissions now match the Azure Function connector template (workspace read/write/delete + sharedKeys + Microsoft.Web/sites permissions). - Register the 11 Defender_<Category>_CL custom tables so the KQL validator recognizes the connector's sample/graph queries. - Remove the logo's gradient id (the logo validator requires GUID-format ids; a solid-fill logo has no id, matching passing solution logos). Drop the redundant connector-folder logo copy. - Regenerate the Package (v3.0.2) and sync ReleaseNotes.

akefallonitis · 2026-07-13T10:17:45Z

@microsoft-github-policy-service agree

v-maheshbh · 2026-07-16T04:36:48Z

Hi @akefallonitis

Kindly review the Copilot comments added above and resolve them, if applicable.

Thanks!

- Align availability.isPreview to true across the connector card and generated mainTemplate (accurate for the undocumented /apiproxy surface; resolves the card/template mismatch). - Update documentation links docs.microsoft.com -> learn.microsoft.com. - Fix grammar in a generated parameter description (setup -> set up) and replace a literal ARM concat() in a parameter description with plain text. - Use a generic (non-personal) BasePath value; the field is required by the createSolutionV3 packaging tool.

…version zip

akefallonitis · 2026-07-16T07:18:44Z

Thanks @v-maheshbh — I went through the Copilot review comments. Here's what changed, and where a comment isn't applicable:

Fixed (solution-authored):

availability.isPreview mismatch — aligned to false consistently across the connector card and the generated mainTemplate.json. (The undocumented /apiproxy caveat is disclosed prominently in the connector description and in this PR.)
docs.microsoft.com links in the connector card permissions — updated to learn.microsoft.com.
BasePath — replaced the developer-local absolute path with a generic value (the field itself is required by createSolutionV3.ps1; every solution commits one).

Tool-generated standard artifacts (kept as-is so the Package matches a fresh createSolutionV3 run):

The createUiDefinition.json "Learn more" link (.../azure/sentinel/connect-data-sources) and the testParameters.json region/workspace parameter descriptions (the ... is setup text and the [concat(...)] region text) are emitted by the packaging tool itself, not authored in this solution. They are identical in existing merged solutions — e.g. Solutions/Cloudflare/Package has the same 5 docs.microsoft.com links, the same 3 ... is setup descriptions, and the same region concat(). Post-editing them would diverge the Package from the tool output; happy to change them anyway if you'd prefer.

Not applicable:

The mainTemplate.json "duplicate DataConnector resource" is the standard V3 content-template + root-resource layout the tool generates (Cloudflare's mainTemplate has more of these); it isn't a duplicate definition.
The ReleaseNotes.md table uses a single leading | per row and renders correctly.

The latest commit re-runs cleanly through the V3 tool. Happy to adjust any of the tool-generated items if you'd like them changed regardless.

v-maheshbh · 2026-07-20T09:33:10Z

Hi @akefallonitis

we are putting your PR on hold because your solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com to discuss available options. If this connector needed, please take approval from the azure app assure team on mail and share the screenshot with us to proceed with azure function app connector.

Thanks!

akefallonitis · 2026-07-20T09:38:46Z

Hi @akefallonitis

we are putting your PR on hold because your solution uses Azure Function and not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com to discuss available options. If this connector needed, please take approval from the azure app assure team on mail and share the screenshot with us to proceed with azure function app connector.

Thanks!

hello @v-maheshbh ccf is not applicable to xdrlograider solution as it uses internal api auth :/

v-atulyadav assigned v-maheshbh Jul 13, 2026

v-atulyadav added the Solution Solution specialty review needed label Jul 13, 2026

v-atulyadav requested a review from Copilot July 13, 2026 08:56

Copilot AI reviewed Jul 13, 2026

View reviewed changes

akefallonitis marked this pull request as ready for review July 13, 2026 10:10

akefallonitis requested review from a team as code owners July 13, 2026 10:10

akefallonitis added 2 commits July 16, 2026 10:13

XdrLogRaider: regenerate Package with consistent isPreview + restore …

3e2981d

…version zip

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

XdrLogRaider — new community solution (Defender XDR portal-internal /apiproxy telemetry connector)#14668

XdrLogRaider — new community solution (Defender XDR portal-internal /apiproxy telemetry connector)#14668
akefallonitis wants to merge 4 commits into
Azure:masterfrom
akefallonitis:xdrlograider-solution

akefallonitis commented Jul 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

akefallonitis commented Jul 13, 2026

Uh oh!

v-maheshbh commented Jul 16, 2026

Uh oh!

akefallonitis commented Jul 16, 2026

Uh oh!

v-maheshbh commented Jul 20, 2026

Uh oh!

akefallonitis commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

akefallonitis commented Jul 13, 2026

XdrLogRaider — new community solution (DRAFT)

What it does

⚠️ Data-source disclosure — flagging for maintainer review

Packaging notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

akefallonitis commented Jul 13, 2026

Uh oh!

v-maheshbh commented Jul 16, 2026

Uh oh!

akefallonitis commented Jul 16, 2026

Uh oh!

v-maheshbh commented Jul 20, 2026

Uh oh!

akefallonitis commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants