How does one connect to the "Microsoft Emerging Threat Feed " to ingest indicators into Microsoft Sentinel?

Question

How does one connect to the "Microsoft Emerging Threat Feed " to ingest indicators into Microsoft Sentinel?

Alan Hertrick 0

We are receiving the "Microsoft Emerging Threat Feed" in one subscription (set up by someone who has left our company), and we would like to set it up for another subscription but can't find info on setting the feed up in Microsoft documentation. There are 2 data connectors for Threat Intelligence, "Threat intelligence - TAXII", and "Threat Intelligence Platforms (Preview)". Not sure which one to use. Or is there another method that we need to use? The strange thing about it is the "Threat Intelligence Platforms (Preview)" connector shows 'connected' but the graph shows no data coming in; the other connector "Threat intelligence - TAXII" shows 'not connected', but the graph shows data is coming in .

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2023-02-27T20:36:01.2466667+00:00

For the one that shows "not connected", it is likely because the data is not ingested but all Threat Intelligence indicators are refreshed every 14 days by design so that they stay current. So the feeds do not show the new data but the refreshed Threat Intelligence data. (See related issue: https://github.com/Azure/Azure-Sentinel/issues/2689 )

For the Preview issue, have you made sure that you enabled the Threat Intelligence Platforms data connector under Threat Intelligence Platforms > Open Data Connector as detailed here? In addition, have you confirmed that your app has the following permissions?

If you have not done this, it may show as connected but not relay the data.

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2023-02-27T20:36:01.2466667+00:00

For the one that shows "not connected", it is likely because the data is not ingested but all Threat Intelligence indicators are refreshed every 14 days by design so that they stay current. So the feeds do not show the new data but the refreshed Threat Intelligence data. (See related issue: https://github.com/Azure/Azure-Sentinel/issues/2689 )

For the Preview issue, have you made sure that you enabled the Threat Intelligence Platforms data connector under Threat Intelligence Platforms > Open Data Connector as detailed here? In addition, have you confirmed that your app has the following permissions?

If you have not done this, it may show as connected but not relay the data.

Share via

How does one connect to the "Microsoft Emerging Threat Feed " to ingest indicators into Microsoft Sentinel?

Your answer