ContraForce Events for Microsoft Sentinel

Solution: ContraForce

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	ContraForce
Support Tier	Partner
Support Link	https://www.contraforce.com/
Categories	Security - Others
Version	3.0.0
Author	ContraForce - support@contraforce.com
First Published	2026-08-07
Last Updated	2026-09-04
Solution Folder	ContraForce
Marketplace	Azure Marketplace · Popularity: 🟡 Low (13%)

The ContraForce solution for Microsoft Sentinel ingests security service delivery events from your ContraForce workspace: incident detections from every connected security platform, administrative access changes (role and member changes), machine credential activity, and destructive workspace actions. The packaged analytic rules create Microsoft Sentinel incidents for privileged access changes, machine credential activity, and destructive workspace actions, so you can monitor the security operations ContraForce performs on your workspace from inside your own Microsoft Sentinel.

Data Connectors
Tables Used
Content Items

Data Connectors

This solution provides 1 data connector(s):

ContraForce Events

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`ContraForceEvents_CL`	ContraForce Events	Analytics

Content Items

This solution includes 3 content item(s):

Content Type	Count
Analytic Rules	3

Analytic Rules

Name	Severity	Tactics	Tables Used
ContraForce - Destructive workspace action	High	Impact	`ContraForceEvents_CL`
ContraForce - Machine credential activity	Medium	Persistence, CredentialAccess	`ContraForceEvents_CL`
ContraForce - Privileged access change	Medium	PrivilegeEscalation, Persistence	`ContraForceEvents_CL`

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	07-08-2026	Initial solution release: ContraForce Events CCF data connector and three Analytic rules (privileged access change, machine credential activity, destructive workspace action).