MISP Integration

Question

MISP Integration

Ali Salem Panah 40

Hi Technical Team,

Recently, I attempted to integrate MISP with Sentinel. Below are the steps I followed based on this link

Installation Part :
1. steps 1 - 5
Grant the necessary permissions
1. steps 1- 8 (using the Upload Indicators API)
Threat intelligence data connector
1. steps 1 - 5
Azure Function
1. steps 2 - 11
MISP
1. API key

Everything appears to be working properly, as shown in the screenshot, but the feeds are not ingesting into Sentinell Screenshot 2024-12-02 at 15.22.31

Screenshot 2024-12-02 at 15.23.38

Akhilesh Vallamkonda 15,320 Reputation points Microsoft External Staff Moderator

2024-12-06T17:15:36.0866667+00:00

Hi @Ali Salem Panah
Thank you for reaching us!

Can you please check that you have add Microsoft Sentinel Contributor role and User, group, or service principal under Assign access to and select your application under members.
and check is both MISP and Sentinel are up to date.
Akhilesh Vallamkonda 15,320 Reputation points Microsoft External Staff Moderator

2024-12-09T01:41:07.4966667+00:00

Hi @Ali Salem Panah
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ali Salem Panah 40 Reputation points

2024-12-09T11:55:32.7+00:00

Hi, yes, I solved the problem. There was an issue with my script. I was following some instructions where the script was being modified to include the tenant ID, client security, and other information, but it turned out this wasn't necessary. I simply deployed the function folder without modification using Visual Studio, and my issue is now fixed.

However, I have another question regarding integrating Wing Security with Sentinel. There is no documentation available for this. Could you help me with it?

Accepted answer

0 additional answers

Your answer

Akhilesh Vallamkonda 15,320 Reputation points Microsoft External Staff Moderator

2024-12-06T17:15:36.0866667+00:00

Hi @Ali Salem Panah
Thank you for reaching us!

Can you please check that you have add Microsoft Sentinel Contributor role and User, group, or service principal under Assign access to and select your application under members.
and check is both MISP and Sentinel are up to date.
Akhilesh Vallamkonda 15,320 Reputation points Microsoft External Staff Moderator

2024-12-09T01:41:07.4966667+00:00

Hi @Ali Salem Panah
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ali Salem Panah 40 Reputation points

2024-12-09T11:55:32.7+00:00

Hi, yes, I solved the problem. There was an issue with my script. I was following some instructions where the script was being modified to include the tenant ID, client security, and other information, but it turned out this wasn't necessary. I simply deployed the function folder without modification using Visual Studio, and my issue is now fixed.

However, I have another question regarding integrating Wing Security with Sentinel. There is no documentation available for this. Could you help me with it?

Answer 1

Hi @Ali Salem Panah

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.Issue:

integrated MISP with Sentinel the feeds are not ingesting into Sentinell

Solution:

You have resolved the issue by modified your script by updating the tenant ID, client security, and other information

The other side about the documents, we don't have any documentation or a direct partnership with this ISV at the moment. For help with integrating their solution with Microsoft Sentinel, we suggest contacting Wing Security.

If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Share via

MISP Integration

0 additional answers

Your answer