How to Integrate Threat Intelligence IOCs into Sentinel SIEM via Third-Party API

Question

The current Sentinel user guide (https://learn.microsoft.com/en-us/azure/sentinel/) details how to integrate threat intelligence IOCs into Sentinel via 1) TAXII feed and 2) threat intelligence platform.

I am trying to ingest IOCs into Sentinel via a third-party API using a vendor-provided API URL, Access Token, and Secret Key.  The third-party IOCs are not stored on a dedicated TAXII server and do not have a corresponding Collection ID needed to set up the Microsoft TAXII feed option. The vendor threat intel portal is not a Threat Intel Platform and cannot push IOCs to the Microsoft Graph Security tilndicators API. 

What is the best way to ingest these third-party IOCs into Sentinel?

Answer 1

Would a file import work for you (at least in the short term)? [https://learn.microsoft.com/en-us/azure/sentinel/indicators-bulk-file-import You can probably automate that with a Logic App.

If this answers your question please Accept the answer. Thanks