Quokka CCF Connector is not calling API

[mvang-quokka]

Describe the bug
Our Quokka CCF Connector is not calling the API to poll data. We published this solution over a month ago and just recently discovering that it's not working. We've used debug logs on our side to see what's going on and the root cause is the CCF connector is not calling the API at all after the initial connection.

To Reproduce
Steps to reproduce the behavior:

1. Go to Content Hubs
2. Install Quokka Qscout QscoutAppEventsConnector
3. Using an org id and org API key we provide to connect
4. The deployment succeeds (connection is authenticated)
5. Nothing happens. No new API polling calls. No error logs. Not from our side or Sentinel
6. We placed a logger middleware in our API to record any incoming request and nothing was coming from Sentinel (except the initial connection)

Expected behavior
After the initial connection, it should keep polling data in the query timeframe we established. If there is any error that prevents the connector from continuing polling, it should be made aware.

Additional context
The connector we deployed manually during development was working. This involved creating the Custom Logs table, DCR, and DCE, and specifying them in the deployment template. However, when we use the CCF pattern using the createSolutionV3.ps1 tool, the resulting template produced the erroneous connector. We've tried editing the resources files in many ways but nothing made it work. Would really appreciate any help with our solution.
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Quokka

We can provide a sample org id and api key as well

[mvang-quokka]

This is what I came to after tweaking the CCF resource files following recent existing solutions. This only includes the data connector we're trying to fix, without the analytic rule or workbook we have. Any idea on what could be going wrong?

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "author": "Quokka - mvang@quokka.io",
    "comments": "Solution template for Quokka"
  },
  "parameters": {
    "location": {
      "type": "string",
      "minLength": 1,
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`.  We instead use the `workspace-location` which is derived from the LA workspace"
      }
    },
    "workspace-location": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
      }
    },
    "workspace": {
      "defaultValue": "",
      "type": "string",
      "metadata": {
        "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
      }
    },
    "resourceGroupName": {
      "type": "string",
      "defaultValue": "[resourceGroup().name]",
      "metadata": {
        "description": "resource group name where Microsoft Sentinel is setup"
      }
    },
    "subscription": {
      "type": "string",
      "defaultValue": "[last(split(subscription().id, '/'))]",
      "metadata": {
        "description": "subscription id where Microsoft Sentinel is setup"
      }
    }
  },
  "variables": {
    "email": "mvang@quokka.io",
    "_email": "[variables('email')]",
    "_solutionName": "Quokka",
    "_solutionVersion": "3.0.0",
    "solutionId": "quokka.azure-sentinel-solution-quokka",
    "_solutionId": "[variables('solutionId')]",
    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
    "dataConnectorCCPVersion": "1.0.0",
    "_dataConnectorContentIdConnectorDefinition1": "QscoutAppEventsCCFDefinition",
    "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
    "_dataConnectorContentIdConnections1": "QscoutAppEventsCCFDefinitionConnections",
    "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]",
    "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
    "blanks": "[replace('b', 'b', '')]",
    "TemplateEmptyObject": "[json('{}')]",
    "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
      "apiVersion": "2023-04-01-preview",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]",
      "location": "[parameters('workspace-location')]",
      "dependsOn": [
        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
      ],
      "properties": {
        "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
        "displayName": "QscoutAppEventsConnector",
        "contentKind": "DataConnector",
        "mainTemplate": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "[variables('dataConnectorCCPVersion')]",
          "parameters": {},
          "variables": {},
          "resources": [
            {
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
              "apiVersion": "2022-09-01-preview",
              "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
              "location": "[parameters('workspace-location')]",
              "kind": "Customizable",
              "properties": {
                "connectorUiConfig": {
                  "id": "QscoutAppEventsCCFDefinition",
                  "title": "QscoutAppEventsConnector",
                  "publisher": "Quokka",
                  "descriptionMarkdown": "Ingest Qscout application events into Microsoft Sentinel",
                  "graphQueriesTableName": "QscoutAppEvents_CL",
                  "graphQueries": [
                    {
                      "metricName": "Events received",
                      "legend": "Data connector events",
                      "baseQuery": "{{graphQueriesTableName}}"
                    }
                  ],
                  "sampleQueries": [
                    {
                      "description": "All event logs",
                      "query": "{{graphQueriesTableName}} | take 10"
                    }
                  ],
                  "dataTypes": [
                    {
                      "name": "{{graphQueriesTableName}}",
                      "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
                    }
                  ],
                  "connectivityCriteria": [
                    {
                      "type": "HasDataConnectors"
                    }
                  ],
                  "availability": {
                    "isPreview": true
                  },
                  "permissions": {
                    "resourceProvider": [
                      {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                          "write": true,
                          "read": true,
                          "delete": true
                        }
                      }
                    ],
                    "customs": [
                      {
                        "name": "Qscout Organization ID",
                        "description": "The API requires your organization ID in Qscout."
                      },
                      {
                        "name": "Qscout Organization API Key",
                        "description": "The API requires your organization API key in Qscout."
                      }
                    ]
                  },
                  "instructionSteps": [
                    {
                      "description": ">**NOTE:** This connector uses Codeless Connector Framework (CCF) to connect to the Qscout app events feed and ingest data into Microsoft Sentinel"
                    },
                    {
                      "description": "Provide the required values below:\n",
                      "instructions": [
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "Qscout Organization ID",
                            "placeholder": "123456",
                            "type": "text",
                            "name": "organizationId"
                          }
                        },
                        {
                          "type": "Textbox",
                          "parameters": {
                            "label": "Qscout Organization API Key",
                            "placeholder": "abcdxyz",
                            "type": "password",
                            "name": "apiKey"
                          }
                        },
                        {
                          "type": "ConnectionToggleButton",
                          "parameters": {
                            "connectLabel": "Connect",
                            "name": "connect"
                          }
                        }
                      ]
                    }
                  ]
                }
              }
            },
            {
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
              "apiVersion": "2022-01-01-preview",
              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
              "properties": {
                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
                "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
                "kind": "DataConnector",
                "version": "[variables('dataConnectorCCPVersion')]",
                "source": {
                  "sourceId": "[variables('_solutionId')]",
                  "name": "[variables('_solutionName')]",
                  "kind": "Solution"
                },
                "author": {
                  "name": "Quokka",
                  "email": "[variables('_email')]"
                },
                "support": {
                  "name": "Quokka",
                  "tier": "Partner",
                  "link": "https://www.quokka.io/contact-us#customer-support"
                },
                "dependencies": {
                  "criteria": [
                    {
                      "version": "[variables('dataConnectorCCPVersion')]",
                      "contentId": "[variables('_dataConnectorContentIdConnections1')]",
                      "kind": "ResourcesDataConnector"
                    }
                  ]
                }
              }
            },
            {
              "name": "QscoutAppEventsDCR",
              "apiVersion": "2022-06-01",
              "type": "Microsoft.Insights/dataCollectionRules",
              "location": "[parameters('workspace-location')]",
              "kind": "[variables('blanks')]",
              "properties": {
                "streamDeclarations": {
                  "Custom-QscoutAppEvents_CL": {
                    "columns": [
                      {
                        "name": "app_id",
                        "type": "string"
                      },
                      {
                        "name": "org_id",
                        "type": "string"
                      },
                      {
                        "name": "package",
                        "type": "string"
                      },
                      {
                        "name": "version",
                        "type": "string"
                      },
                      {
                        "name": "platform",
                        "type": "string"
                      },
                      {
                        "name": "mdm_source",
                        "type": "string"
                      },
                      {
                        "name": "mdm_device_id",
                        "type": "string"
                      },
                      {
                        "name": "device_os_build_version",
                        "type": "string"
                      },
                      {
                        "name": "result_type",
                        "type": "string"
                      },
                      {
                        "name": "results",
                        "type": "dynamic"
                      },
                      {
                        "name": "received_at",
                        "type": "datetime"
                      }
                    ]
                  }
                },
                "dataSources": "[variables('TemplateEmptyObject')]",
                "destinations": {
                  "logAnalytics": [
                    {
                      "workspaceResourceId": "[variables('workspaceResourceId')]",
                      "name": "clv2ws1"
                    }
                  ]
                },
                "dataFlows": [
                  {
                    "streams": [
                      "Custom-QscoutAppEvents_CL"
                    ],
                    "destinations": [
                      "clv2ws1"
                    ],
                    "transformKql": "source\n| extend TimeGenerated = todatetime(received_at)\n",
                    "outputStream": "Custom-QscoutAppEvents_CL"
                  }
                ],
                "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]"
              }
            },
            {
              "name": "QscoutAppEvents_CL",
              "apiVersion": "2022-10-01",
              "type": "Microsoft.OperationalInsights/workspaces/tables",
              "location": "[parameters('workspace-location')]",
              "kind": null,
              "properties": {
                "schema": {
                  "name": "QscoutAppEvents_CL",
                  "columns": [
                    {
                      "name": "TimeGenerated",
                      "type": "datetime",
                      "description": "The timestamp (UTC) reflecting the time when the event was ingested"
                    },
                    {
                      "name": "app_id",
                      "type": "string"
                    },
                    {
                      "name": "org_id",
                      "type": "string",
                      "description": "Unique identifier of the organization"
                    },
                    {
                      "name": "package",
                      "type": "string",
                      "description": "The package name of the application"
                    },
                    {
                      "name": "version",
                      "type": "string",
                      "description": "The version of the application"
                    },
                    {
                      "name": "platform",
                      "type": "string",
                      "description": "The platform of the device (e.g., iOS, Android)"
                    },
                    {
                      "name": "mdm_source",
                      "type": "string",
                      "description": "The Mobile Device Management source"
                    },
                    {
                      "name": "mdm_device_id",
                      "type": "string",
                      "description": "The unique identifier of the device in MDM"
                    },
                    {
                      "name": "device_os_build_version",
                      "type": "string",
                      "description": "The OS build version of the device"
                    },
                    {
                      "name": "result_type",
                      "type": "string",
                      "description": "The type of result returned"
                    },
                    {
                      "name": "results",
                      "type": "dynamic",
                      "description": "The detailed results of the app event"
                    },
                    {
                      "name": "received_at",
                      "type": "datetime",
                      "description": "The timestamp when the event was received from QScout"
                    }
                  ]
                }
              }
            }
          ]
        },
        "packageKind": "Solution",
        "packageVersion": "[variables('_solutionVersion')]",
        "packageName": "[variables('_solutionName')]",
        "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]",
        "packageId": "[variables('_solutionId')]",
        "contentSchemaVersion": "3.0.0",
        "version": "[variables('dataConnectorCCPVersion')]"
      }
    },
    {
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
      "apiVersion": "2022-09-01-preview",
      "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
      "location": "[parameters('workspace-location')]",
      "kind": "Customizable",
      "properties": {
        "connectorUiConfig": {
          "id": "QscoutAppEventsCCFDefinition",
          "title": "QscoutAppEventsConnector",
          "publisher": "Quokka",
          "descriptionMarkdown": "Ingest Qscout application events into Microsoft Sentinel",
          "graphQueriesTableName": "QscoutAppEvents_CL",
          "graphQueries": [
            {
              "metricName": "Events received",
              "legend": "Data connector events",
              "baseQuery": "{{graphQueriesTableName}}"
            }
          ],
          "sampleQueries": [
            {
              "description": "All event logs",
              "query": "{{graphQueriesTableName}} | take 10"
            }
          ],
          "dataTypes": [
            {
              "name": "{{graphQueriesTableName}}",
              "lastDataReceivedQuery": "{{graphQueriesTableName}} | summarize Time = max  (TimeGenerated)\n|where isnotempty(Time)"
            }
          ],
          "connectivityCriteria": [
            {
              "type": "HasDataConnectors"
            }
          ],
          "availability": {
            "isPreview": true
          },
          "permissions": {
            "resourceProvider": [
              {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "Read and Write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                  "write": true,
                  "read": true,
                  "delete": true
                }
              }
            ],
            "customs": [
              {
                "name": "Qscout Organization ID",
                "description": "The API requires your organization ID in Qscout."
              },
              {
                "name": "Qscout Organization API Key",
                "description": "The API requires your organization API key in Qscout."
              }
            ]
          },
          "instructionSteps": [
            {
              "description": ">**NOTE:** This connector uses Codeless Connector Framework (CCF) to connect to the Qscout app events feed and ingest data into Microsoft Sentinel"
            },
            {
              "description": "Provide the required values below:\n",
              "instructions": [
                {
                  "type": "Textbox",
                  "parameters": {
                    "label": "Qscout Organization ID",
                    "placeholder": "123456",
                    "type": "text",
                    "name": "organizationId"
                  }
                },
                {
                  "type": "Textbox",
                  "parameters": {
                    "label": "Qscout Organization API Key",
                    "placeholder": "abcdxyz",
                    "type": "password",
                    "name": "apiKey"
                  }
                },
                {
                  "type": "ConnectionToggleButton",
                  "parameters": {
                    "connectLabel": "Connect",
                    "name": "connect"
                  }
                }
              ]
            }
          ]
        }
      }
    },
    {
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
      "apiVersion": "2022-01-01-preview",
      "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
      "properties": {
        "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
        "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
        "kind": "DataConnector",
        "version": "[variables('dataConnectorCCPVersion')]",
        "source": {
          "sourceId": "[variables('_solutionId')]",
          "name": "[variables('_solutionName')]",
          "kind": "Solution"
        },
        "author": {
          "name": "Quokka",
          "email": "[variables('_email')]"
        },
        "support": {
          "name": "Quokka",
          "tier": "Partner",
          "link": "https://www.quokka.io/contact-us#customer-support"
        },
        "dependencies": {
          "criteria": [
            {
              "version": "[variables('dataConnectorCCPVersion')]",
              "contentId": "[variables('_dataConnectorContentIdConnections1')]",
              "kind": "ResourcesDataConnector"
            }
          ]
        }
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
      "apiVersion": "2023-04-01-preview",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]",
      "location": "[parameters('workspace-location')]",
      "dependsOn": [
        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
      ],
      "properties": {
        "contentId": "[variables('_dataConnectorContentIdConnections1')]",
        "displayName": "QscoutAppEventsConnector",
        "contentKind": "ResourcesDataConnector",
        "mainTemplate": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "[variables('dataConnectorCCPVersion')]",
          "parameters": {
            "guidValue": {
              "defaultValue": "[[newGuid()]",
              "type": "securestring"
            },
            "innerWorkspace": {
              "defaultValue": "[parameters('workspace')]",
              "type": "securestring"
            },
            "connectorDefinitionName": {
              "defaultValue": "QscoutAppEventsConnector",
              "type": "securestring",
              "minLength": 1
            },
            "workspace": {
              "defaultValue": "[parameters('workspace')]",
              "type": "securestring"
            },
            "dcrConfig": {
              "defaultValue": {
                "dataCollectionEndpoint": "data collection Endpoint",
                "dataCollectionRuleImmutableId": "data collection rule immutableId"
              },
              "type": "object"
            },
            "organizationId": {
              "defaultValue": "organizationId",
              "type": "securestring",
              "minLength": 1
            },
            "apiKey": {
              "defaultValue": "apiKey",
              "type": "securestring",
              "minLength": 1
            }
          },
          "variables": {
            "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]"
          },
          "resources": [
            {
              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]",
              "apiVersion": "2022-01-01-preview",
              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
              "properties": {
                "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]",
                "contentId": "[variables('_dataConnectorContentIdConnections1')]",
                "kind": "ResourcesDataConnector",
                "version": "[variables('dataConnectorCCPVersion')]",
                "source": {
                  "sourceId": "[variables('_solutionId')]",
                  "name": "[variables('_solutionName')]",
                  "kind": "Solution"
                },
                "author": {
                  "name": "Quokka",
                  "email": "[variables('_email')]"
                },
                "support": {
                  "name": "Quokka",
                  "tier": "Partner",
                  "link": "https://www.quokka.io/contact-us#customer-support"
                }
              }
            },
            {
              "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'QscoutAppEventsConnector', parameters('guidValue'))]",
              "apiVersion": "2023-02-01-preview",
              "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
              "location": "[parameters('workspace-location')]",
              "kind": "RestApiPoller",
              "properties": {
                "connectorDefinitionName": "QscoutAppEventsCCFDefinition",
                "dcrConfig": {
                  "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
                  "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]",
                  "streamName": "Custom-QscoutAppEvents_CL"
                },
                "dataType": "QscoutAppEvents_CL",
                "response": {
                  "eventsJsonPaths": [
                    "$"
                  ],
                  "format": "json"
                },
                "auth": {
                  "type": "APIKey",
                  "ApiKeyName": "x-api-key",
                  "APIKey": "[[parameters('apiKey')]"
                },
                "request": {
                  "apiEndpoint": "[[concat('http://api.krwr.net/app-event-feed/export/',parameters('organizationId'))]",
                  "rateLimitQPS": 10,
                  "queryWindowInMin": 5,
                  "queryTimeFormat": "yyyy-MM-dd'T'HH:mm:ss'.00Z'",
                  "httpMethod": "GET",
                  "retryCount": 3,
                  "timeoutInSeconds": 60,
                  "headers": {
                    "Accept": "*/*"
                  }
                },
                "isActive": true
              }
            }
          ]
        },
        "packageKind": "Solution",
        "packageVersion": "[variables('_solutionVersion')]",
        "packageName": "[variables('_solutionName')]",
        "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]",
        "packageId": "[variables('_solutionId')]",
        "contentSchemaVersion": "3.0.0",
        "version": "[variables('dataConnectorCCPVersion')]"
      }
    },
    {
      "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
      "apiVersion": "2023-04-01-preview",
      "location": "[parameters('workspace-location')]",
      "properties": {
        "version": "3.0.0",
        "kind": "Solution",
        "contentSchemaVersion": "3.0.0",
        "displayName": "Quokka",
        "publisherDisplayName": "Quokka",
        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Quokka/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>The Qscout CCF data connector ingest app events logs from Quokka Qscout platform</p>\n<p><strong>Data Connectors:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
        "contentKind": "Solution",
        "contentProductId": "[variables('_solutioncontentProductId')]",
        "id": "[variables('_solutioncontentProductId')]",
        "icon": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/quokka_logo.svg\" width=\"75px\" height=\"75px\">",
        "contentId": "[variables('_solutionId')]",
        "parentId": "[variables('_solutionId')]",
        "source": {
          "kind": "Solution",
          "name": "Quokka",
          "sourceId": "[variables('_solutionId')]"
        },
        "author": {
          "name": "Quokka",
          "email": "[variables('_email')]"
        },
        "support": {
          "name": "Quokka",
          "tier": "Partner",
          "link": "https://www.quokka.io/contact-us#customer-support"
        },
        "dependencies": {
          "operator": "AND",
          "criteria": [
            {
              "kind": "DataConnector",
              "contentId": "[variables('_dataConnectorContentIdConnections1')]",
              "version": "[variables('dataConnectorCCPVersion')]"
            }
          ]
        },
        "firstPublishDate": "2025-10-30",
        "providers": [
          "Quokka"
        ],
        "categories": {
          "domains": [
            "Security - Threat Protection"
          ]
        }
      },
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
    }
  ],
  "outputs": {}
}

[mvang-quokka]

I believe to have found the issue. Adding these to the request Headers resolved the problem. Looks like the rest api poller won't send the request without a user agent? I'm going to do some sanity checks to confirm before I close this issue

{
   "Accept": "application/json",
   "User-Agent": "Microsoft-Azure-Sentinel-QscoutAppEventsCCFDefinition"
}