Sentinel Connector Studio

A client-side web application that guides you through visually building a Microsoft Sentinel Codeless Connector Framework (CCF) connector (Push or RestApiPoller), complete with analytic rules, hunting queries, ASIM parsers, and workbooks. The tool produces a deployable ARM template (mainTemplate.json) that can be deployed directly to Azure via the portal, CLI, or API.

No backend required — everything runs in the browser and can be deployed as a static site (GitHub Pages, Azure Static Web Apps, Vercel, etc.).

Try it here

Who is this for?

• ISV developers building data connectors for their products
• Security engineers pushing data from internal tools into Microsoft Sentinel

The UX is designed for users who may have no prior experience with ARM templates, Data Collection Rules, or Sentinel connector definitions.

Features

• Guided multi-step wizard — walks you through each part of the connector configuration
• Push and Pull connectors — build Push (CCF) or RestApiPoller connectors
• Live ARM template preview — see the generated template update in real time as you fill out the form
• JSON schema inference — paste a sample JSON event and the app auto-generates the table schema
• KQL transform editor — syntax-highlighted editor with template snippets for common patterns
• Bundled content
  • Analytic rules — define Scheduled and NRT analytic rules with entity mappings, MITRE ATT&CK tactics, and custom KQL queries
  • Hunting queries — define hunting queries with KQL, MITRE ATT&CK tactics/techniques, and required data connectors
  • ASIM parsers — create Advanced Security Information Model (ASIM) parsers to normalize your connector's data into standard schemas
  • Workbooks — include Azure Monitor Workbooks by pasting gallery template JSON exported from the Azure portal
• Smart defaults — table names, stream names, connectivity queries, permissions, and instruction steps are all auto-generated
• Session persistence — your work is saved to localStorage so you can resume across sessions
• Save / Load projects — export your project as a .json file, reload it later, or load from a URL
• Multiple export options — download the ARM template, a full solution package (ZIP), or individual resource files
• Packager sidecar — optional Docker container that runs createSolutionV3.ps1 automatically to produce a deployable ARM template
• Deep link support — link directly to a project via URL query parameter (?project=<url>)