Integrating open source threat feeds with MISP and Sentinel

Question

Hi Team,

Please suggest which one is the best method to integrate MISP to sentinel.

Either Logic App's or Python Script.

Please share the details step by step to understand.

Best Regards,
Ravi Teja

Answer 1

Hi @Ravi Teja ,

Microsoft does not have an official guide for integrating MISP with Sentinel, but either Logic Apps or a Python script should be fine for this. You could use Microsoft Graph to ingest the threat indicators into Sentinel and specify the attributes in the Logic App. The Microsoft Graph Security API allows you to import custom threat indicators from various sources such as IOCs received in MISP and make these IOCs available in Microsoft Sentinel and other Azure services.

There is a LinkedIn post here where someone was able to achieve this using Logic Apps and documented the steps. https://www.linkedin.com/pulse/how-ingest-misp-iocs-azure-sentinel-using-security-arshad/

You may also have seen this post that describes how to achieve the same using a Python script and setting up a Data Connector in Microsoft Sentinel. https://www.vanimpe.eu/2022/04/20/misp-and-microsoft-sentinel/

While Microsoft doesn't have an official guide for integration with MISP Threat Sharing specifically, it does have examples using other data sources such as AlienVault OTX which also connects via Logic Apps.

Let me know if there was any more specific guidance that you were looking for.

-

If the information provided was helpful to you, please consider marking as answer so that others in the community with similar questions can more easily find a solution.