Extending Sentinel Data Integration: Azure Blob Storage Support for CCF Connectors
Organizations need robust data ingestion and analysis capabilities as security operations grow. Microsoft Sentinel's Codeless Connector Framework (CCF) helps ISVs build integrations faster and simplifies customer deployment. CCF now supports Azure Blob Storage, introducing a new data delivery method for Sentinel. Previously, CCF connectors integrated directly with partner APIs. Now, ISVs can build connectors that read data from Azure Blob Storage. This offers new flexibility in security data collection. In this model, ISVs write data to Azure Blob Storage. The Sentinel connector reads from this storage layer, utilizing Azure-native components. Event Grid and storage queues process events and forward them via data collection rules to Log Analytics. This creates a durable data layer between the source and Sentinel. This approach enables more resilient and scalable data ingestion scenarios.