Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent

Previously, we introduced the public preview of the Microsoft Sentinel connector builder agent as an extension for VS Code. This tool helps developers create Microsoft Sentinel codeless connectors quickly, using low-code and AI-enhanced prompts. In this article, we’ll take you through an engaging lab that utilises a mock Network Log API, showing you just how easy the Sentinel connector builder agent makes the process of developing Codeless Connector Framework (CCF) pull connectors. Instead of struggling with manual setup and configuration files, you’ll follow a guided, conversational workflow in VS Code to produce connector artifacts, test them with a live API, and deploy them directly into Microsoft Sentinel. This lab covers the entire journey from API setup to the validated deployment of the connector, demonstrating how swiftly you can achieve a functional integration. For more help beyond this lab, check out our MS Learn documentation.

The lab revolves around a mock Network Log API hosted as an Azure Function App. This setup is designed to provide us with a live API that we can leverage to build, verify, and test the Sentinel CCF connector builder agent from start to finish. The API offers 50 synthetic network activity records that mimic actual product data, including elements like web traffic, DNS requests, blocked remote access attempts, malware command-and-control signals, VPN activity, and various other common network events. This makes it a perfect representation of the type of telemetry that many teams aim to incorporate into Microsoft Sentinel.

The API is specifically designed to resemble what a customer might provide for telemetry retrieval. It employs API key authentication via the X-API-Key header, returns paginated results through a nextLink model, and delivers a consistent response format that the builder agent can seamlessly translate into pull connector configurations.

Our repository has everything required for the walkthrough. It includes an ARM template to deploy the Function App, reference documentation for the API, and a sample connector package demonstrating the generated polling configuration, table schema, DCR, and connector definition. The main aim of the lab is simple: harness the builder agent to create a CCF pull connector that feeds this API into the custom NetworkLogAPIGetNetworkLogs_CL table in Sentinel.

Check out the complete walkthrough here: Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent

Originally published on: Microsoft Sentinel Blog, August 11th, 2026