↳ GitHub sourceConnector

ContraForce Events

Description

The ContraForce Events connector ingests security service delivery events from your [ContraForce](https://www.contraforce.com) workspace into Microsoft Sentinel: incident detections from every connected security platform, administrative access changes (role and member changes), machine credential activity, and destructive workspace actions. Use it to monitor the security operations ContraForce performs on this workspace from inside your own Sentinel.

Declared author / publisher: ContraForce

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

ContraForceEvents_CL

Declared permissions

Read and Write permissions are required.

Workspace

Workspace

ContraForce service account credential

A ContraForce service-account credential with the 'Audit: Export' scope, created in the ContraForce portal under Settings > Developers. The service account must have a role on the workspace you are connecting.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

1. Create a ContraForce export credential

In the ContraForce portal, open **Settings > Developers**, select (or create) a service account that has a role on the workspace you want to connect, and add a credential with the **Audit: Export** scope. Copy the client ID and the one-time client secret. > Events follow the account they occur under: connect each customer workspace for its events, and your own organization account for organization-level events such as service account and credential activity.

2. Connect your ContraForce workspace

Enter your ContraForce portal URL (change it only if you use a regional portal, e.g. the UK platform), your ContraForce workspace ID (shown in the ContraForce portal URL and workspace settings), and the credential from step 1, then select **Connect**.

ContraForce portal URL

ContraForce workspace ID

Client ID

Client secret

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_DataConnectorDefinition.json ↗
Commit: 9800e51 ↗
Source identifier: ContraForceEvents

Additional source files 2

Solutions/ContraForce/Data Connectors/ContraForceEvents_ccp/ContraForceEvents_DataConnectorDefinition.jsonsource ↗Solutions/ContraForce/Data/Solution_ContraForce.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.