Migration Path for [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) Sentinel Connector

Question

Migration Path for [DEPRECATED] VMware Carbon Black Cloud (using Azure Function) Sentinel Connector

AndrewFury 0

Hello,

We have been using the VMware Carbon Black Cloud (using Azure Function) Sentinel Connector for many years to gather logs from Carbon Black.

The current connector is deprecated now though, and the only option that has been added to the Content Hub as a migration option is one that requires AWS S3 Bucket.

"VMware Carbon Black Cloud via AWS S3 (via Codeless Connector Framework)"

Is there any plans to create a connector that uses Azure services only?

Regards,

Andrew

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T23:33:28.9966667+00:00

Hello AndrewFury,

You’re correct, the Azure Function–based Carbon Black connector is now deprecated, and currently the only supported option in Content Hub is the AWS S3–based connector.

There hasn’t been any announcement yet about an Azure-only replacement.

If you prefer to stay within Azure, a practical approach is to pull data from Carbon Black using its APIs and send it to Sentinel (for example, via Azure Functions or the Log Analytics Data Collector API). This does require some custom setup but avoids introducing AWS.

You may also want to share this as feedback through Microsoft channels. Increased demand can help influence the roadmap.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-05-01T22:28:48.48+00:00

Hello AndrewFury,

Any update on this? Please confirm if you still have further queries.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-30T23:33:28.9966667+00:00

Hello AndrewFury,

You’re correct, the Azure Function–based Carbon Black connector is now deprecated, and currently the only supported option in Content Hub is the AWS S3–based connector.

There hasn’t been any announcement yet about an Azure-only replacement.

If you prefer to stay within Azure, a practical approach is to pull data from Carbon Black using its APIs and send it to Sentinel (for example, via Azure Functions or the Log Analytics Data Collector API). This does require some custom setup but avoids introducing AWS.

You may also want to share this as feedback through Microsoft channels. Increased demand can help influence the roadmap.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-05-01T22:28:48.48+00:00

Hello AndrewFury,

Any update on this? Please confirm if you still have further queries.

Answer 1

The currently available migration path from the deprecated VMware Carbon Black Cloud (using Azure Functions) connector is the VMware Carbon Black Cloud via AWS S3 (via Codeless Connector Framework) connector, which explicitly relies on AWS S3, SQS, and related AWS resources as prerequisites.

From the provided information, there is no mention of a new or replacement connector that uses only Azure-native services (for example, an updated Azure Functions–based connector or another Azure-only ingestion path) beyond the existing, now deprecated, Azure Functions connector.

For scenarios that must remain Azure-only, the documented option is to build and maintain a custom connector using Azure Functions and the Carbon Black REST APIs, following the generic Sentinel custom connector guidance. This is the same pattern used by the original VMware Carbon Black Cloud (using Azure Functions) connector and is still supported as a custom solution:

Use Azure Functions with the Carbon Black Cloud REST APIs to pull Audit, Notification, and Event logs.
Ingest the data into a Log Analytics workspace via the Azure Monitor Data Collector API.
Optionally, implement ASIM parsers so that the data can be used with Sentinel’s normalized content.

There is no documented plan in the provided material for a new, Microsoft-supported, Azure-only VMware Carbon Black Cloud connector to replace the deprecated Azure Functions–based one. For roadmap details or future plans, the appropriate path is to open a support request or engage the product group via official Microsoft Sentinel feedback/support channels.

References: