Frends iPaaS Audit Logs data connector (via Codeless Connector Framework)

[KanenasCS]

Change(s):

• Added a new data coonector "Frends iPaaS Audit Logs" with a Codeless Connector
  Framework (CCF) data connector.
• New RestApiPoller data connector polling the Frends Platform API Audit
  Trail Log endpoint (GET /api/v1/audit-log) using OAuth 2.0 client
  credentials against Microsoft Entra ID (token audience: the Application
  ID URI registered with Frends; scope api:///.default).
• New custom table FrendsAuditLogs_CL (TimeGenerated, ActionName, UserName,
  EventTimestampUtc, Parameters) with DCR ingestion-time transformation
  mapping the raw audit entry (actionName, userName, timestamp, parameters)
  and guaranteeing a non-null TimeGenerated.
• Data Connector Definition (connector page UI) collecting Entra Tenant ID,
  Client ID, Client Secret and Frends tenant name at Connect-time — no
  credentials in the deployment template.
• Polling in 5-minute windows via startDateTimeUtc/endDateTimeUtc with
  PageSize=200 (Frends API maximum).

Reason for Change(s):

• Frends iPaaS (frends.com) is an integration platform whose Tenant audit
  trail (configuration changes, user and system actions) is security-
  relevant, and no Microsoft Sentinel data connector currently exists
  for it.
• To monitor Frends administrative activity (process
  deployments, permission and configuration changes) alongside other
  sources in Microsoft Sentinel, using the fully SaaS CCF — no Function
  Apps or Logic Apps to operate.

Version Updated:

• N/A — new data connector, no Detections/Analytic Rule templates modified.
  (Solution version 1.0.0; data connector definition and connections
  versions 1.0.0.)

Testing Completed:

• Yes. Deployed to a Microsoft Sentinel environment with no custom parsers,
  functions or tables. Verified: ARM deployment succeeds (table, DCE, DCR,
  connector definition and content templates created), connector page
  renders and accepts credentials, OAuth2 client-credentials token
  acquisition succeeds, events ingest into FrendsAuditLogs_CL with correct
  TimeGenerated mapping, and sample/graph queries return data. No custom
  parser or function is required by this solution.

Checked that the validations are passing and have addressed any issues that are present:

• Yes.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Microsoft Sentinel Codeless Connector Framework (CCF) data connector to ingest Frends iPaaS tenant audit trail logs via the Frends Platform API.

Changes:

• Introduces an ARM template that provisions the custom table, DCE/DCR (+ transformKql), solution content package, connector definition UI, and RestApiPoller connection.
• Adds a README documenting prerequisites, deployment, connection steps, and IP allowlisting guidance.
• Adds custom table schema reference files (including KQL validation test asset).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
DataConnectors/Frends iPaaS/README.md	Documents the connector architecture, prerequisites, deployment/connect flow, and troubleshooting.
DataConnectors/Frends iPaaS/FrendsAuditLogs_Sentinel_CCF.json	Main ARM template for table + DCE/DCR + CCF connector definition and connection templates.
DataConnectors/Frends iPaaS/FrendsAuditLogs_CL.json	Custom table schema reference for FrendsAuditLogs_CL.
.script/tests/KqlvalidationsTests/CustomTables/FrendsAuditLogs_CL.json	Adds the custom table schema to KQL validation test inputs.