I’ve built a Microsoft Sentinel Codeless Connector Framework (CCF) data connector for Action1, packaged in an ARM template for easy deployment (with LLM help).

RMM and patch-management platforms have privileged access across an organisation’s endpoints. In recent years, high-profile incidents involving RMM platforms have demonstrated how damaging this trusted access can become when compromised.

This makes monitoring suspicious activity in RMM and patch management platforms important.

I noticed the opportunity to do a little personal project: building some Sentinel integrations for Action1. To do this I have used the lovely API the team at Action1 have kindly made available to even the free-tier users (thanks to the Action1 team for that!).

The first stage is the data connector, which ingests Action1 audit events into a custom Log Analytics table, providing a foundation for detections and automated response.

The connector is deployed using a single-deployment Azure ARM template, containing the Custom Table, DCE, DCR including ingestion time parsing, and Sentinel CCF Data Connector template.

The table schema and DCR are defined twice within the template, with the outside declarations being immediately built by Azure, and the inner declarations remaining present for structural compliance with the CCF template structure. The outside declarations are the ones being created, for the time being.

Next update: threat modelling, security use cases, and detections.
Following that: security automations, MCP, and agentic vulnerability/patch management with a focus on self-hosted open-weight models.

Open to all contributions, please raise a PR with improvements if you want to add them:
https://github.com/NathanReevesFSC/A1SentinelCommunitySolution