[v-krishnachi (v-krishnachi)]

Summary

Updates the Atlassian Organization Audit Events CCF connector to reduce historical backlog polling and mitigate Atlassian API rate limiting.

The connector previously used an unbounded persistent cursor with ascending sorting. For high-volume Atlassian organizations, a new connection could therefore paginate through a large historical backlog before reaching current events. Paginated requests were also not explicitly throttled, which could result in HTTP 429 responses.

Changes

• Added a from query parameter using CCF’s {_QueryWindowStartTime} value so new connections start from a recent time boundary.
• Added queryTimeFormat: UnixTimestampInMills to format the from value as Unix epoch milliseconds, as required by Atlassian.
• Increased the Atlassian request limit and CCF pageSize from 200 to 500, the documented maximum supported by /events-stream.
• Added pageSizeParameterName: limit to keep the CCF page size and API request parameter aligned.
• Added paginatedCallsPerSecond: 0.8, limiting pagination to approximately 48 requests per minute and keeping it below Atlassian’s documented limit of 50 requests per minute per API path.
• Added pagingQueryParamOnly: true so subsequent cursor requests use the paging parameters without repeatedly applying the initial time boundary.
• Preserved PersistentToken pagination so polling continues from the last saved Atlassian cursor across polling cycles.
• Bumped the solution and connector package version from 3.0.3 to 3.0.4.
• Regenerated Package/mainTemplate.json and added the 3.0.3 solution package.
• Updated the solution release notes.

Expected behavior

For a new or reset connection:

1. The initial request starts from a recent CCF query-window boundary instead of the beginning of Atlassian’s retained history.
2. The connector requests up to 500 events per page.
3. Subsequent pages continue through Atlassian’s cursor.
4. Paginated requests are limited to approximately 48 requests per minute.
5. The persistent cursor is retained across polling cycles for continuous collection.

This reduces historical backlog processing and the likelihood of HTTP 429 responses. It also reduces the number of API calls required to retrieve the same event volume by up to 60% compared with the previous 200-event page size.

Customer impact

• No table schema or DCR field mapping changes.
• No KQL parser changes.
• Existing data in AtlassianAuditEvents_CL is unaffected.
• Existing connections with an already persisted historical cursor might need to be deleted and recreated after the updated package is deployed for the new initial from boundary to take effect.
• Some duplicate delivery can still occur under at-least-once ingestion semantics after a transient failure; this change reduces the rate-limit and backlog conditions that contributed to repeated page processing but does not introduce stateful ingestion deduplication.

Documentation validation

• Microsoft CCF documents UnixTimestampInMills as a supported QueryTimeFormat constant. The spelling is intentional.
• Atlassian documents the /events-stream from parameter as Unix epoch time in milliseconds.
• Atlassian documents the /events-stream limit range as 1–500, with 500 as the maximum.
• Atlassian documents a polling API limit of 50 requests per minute per API path.

References:

• Microsoft CCF request configuration: https://learn.microsoft.com/en-us/azure/sentinel/data-connector-connection-rules-reference#request-configuration
• Atlassian /events-stream API: https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-stream-get
• Atlassian API rate limits: https://developer.atlassian.com/cloud/admin/organization/rest/intro/#rate-limits

Validation performed

• Regenerated the 3.0.3 solution package using the repository V3 packaging tool.
• Confirmed the source poller configuration and generated ARM template contain matching request and pagination settings.
• Confirmed the generated ZIP contains the updated template.
• JSON syntax validation passed.
• KQL validation passed for 5 files.
• ARM-TTK passed all 48 checks.
• Microsoft branding, document-link, solution, workbook, playbook, field-type, classic Application Insights, and hyperlink validations passed.
• git diff --check passed.

Validation summary: 11 passed, 0 failed, 6 skipped. The skipped checks were not applicable or unavailable in the local environment (.NET Core 3.1 and TruffleHog were not installed).

Files changed

• Solutions/AtlassianOrganizationAudit/Data Connectors/AtlassianOrganizationAuditConnector_CCF/AtlassianOrganizationAudit_PollerConfig.json
• Solutions/AtlassianOrganizationAudit/Data/Solution_AtlassianOrganizationAudit.json
• Solutions/AtlassianOrganizationAudit/Package/mainTemplate.json
• Solutions/AtlassianOrganizationAudit/Package/3.0.3.zip
• Solutions/AtlassianOrganizationAudit/ReleaseNotes.md

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

Review effort: Lite
Findings: 1 · 2

Open (3)

• The value UnixTimestampInMills looks like a typo (commonly Millis/Milliseconds). If this is… · New
• The limit increase to 500 (and matching pageSize=500 below) changes the request shape and could… · New
• The PR description still contains the template placeholders (Change(s)/Reason/Testing/etc.) rather… · New

What changed in this PR

Updates the Atlassian Organization Audit connector polling configuration to reduce historical event polling and mitigate API rate limiting, plus associated version bumps.

Changes:

• Bumped solution and connector versions to 3.0.3 across package metadata.
• Updated poller request/pagination parameters (limit, from, pagination throttling, time format).
• Added a 3.0.3 entry to release notes documenting the change.

File	Description
Solutions/​AtlassianOrganizationAudit/​ReleaseNotes.md	Adds release note entry for 3.0.3 describing the polling/pagination update.
Solutions/​AtlassianOrganizationAudit/​Package/​mainTemplate.json	Bumps solution versions and updates poller query/pagination settings in the ARM template.
Solutions/​AtlassianOrganizationAudit/​Data/​Solution_AtlassianOrganizationAudit.json	Updates solution and CCF connector version metadata to 3.0.3.
Solutions/​AtlassianOrganizationAudit/​Data Connectors/​AtlassianOrganizationAuditConnector_CCF/​AtlassianOrganizationAudit_PollerConfig.json	Updates the runtime poller config (throttle, time format, paging, query params).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-krishnachi (v-krishnachi)]

created new pull request as branch was behind the master and conflicts created lot additional files added.

#15234