Add entities to threat intelligence in Microsoft Sentinel

When investigating an incident, you examine entities and their context as an important part of understanding the scope and nature of the incident. In the course of the investigation, you may discover a domain name, URL, file, or IP address in the incident that should be labeled and tracked as an indicator of compromise (IOC), a threat indicator.

For example, you may discover an IP address performing port scans across your network, or functioning as a command and control node, sending and/or receiving transmissions from large numbers of nodes in your network.

Microsoft Sentinel allows you to flag these types of entities as malicious, right from within your incident investigation, and add it to your threat indicator lists. You'll then be able to view the added indicators both in Logs and in the Threat Intelligence blade, and use them across your Microsoft Sentinel workspace.

Important

Adding entities as TI indicators is currently in PREVIEW. The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

Add an entity to your indicators list

The new incident details page gives you another way to add entities to threat intelligence, in addition to the investigation graph. Both ways are shown below.

  1. From the Microsoft Sentinel navigation menu, select Incidents.

  2. Select an incident to investigate. In the incident details panel, select View full details to open the incident details page.

    Screenshot of incident details page.

  3. Find the entity from the Entities widget that you want to add as a threat indicator. (You can filter the list or enter a search string to help you locate it.)

  4. Select the three dots to the right of the entity, and select Add to TI (Preview) from the pop-up menu.

    Only the following types of entities can be added as threat indicators:

    • Domain name
    • IP address (IPv4 and IPv6)
    • URL
    • File (hash)

    Screenshot of adding an entity to threat intelligence.

Whichever of the two interfaces you choose, you will end up here:

  1. The New indicator side panel will open. The following fields will be populated automatically:

    • Type

      • The type of indicator represented by the entity you're adding.
        Drop-down with possible values: ipv4-addr, ipv6-addr, URL, file, domain-name
      • Required; automatically populated based on the entity type.
    • Value

      • The name of this field changes dynamically to the selected indicator type.
      • The value of the indicator itself.
      • Required; automatically populated by the entity value.
    • Tags

      • Free-text tags you can add to the indicator.
      • Optional; automatically populated by the incident ID. You can add others.
    • Name

      • Name of the indicator—this is what will be displayed in your list of indicators.
      • Optional; automatically populated by the incident name.
    • Created by

      • Creator of the indicator.
      • Optional; automatically populated by the user logged into Microsoft Sentinel.

    Fill in the remaining fields accordingly.

    • Threat type

      • The threat type represented by the indicator.
      • Optional; free text.
    • Description

      • Description of the indicator.
      • Optional; free text.
    • Revoked

      • Revoked status of the indicator. Mark checkbox to revoke the indicator, clear checkbox to make it active.
      • Optional; boolean.
    • Confidence

      • Score reflecting confidence in the correctness of the data, by percent.
      • Optional; integer, 1-100
    • Kill chain

    • Valid from

      • The time from which this indicator is considered valid.
      • Required; date/time
    • Valid until

      • The time at which this indicator should no longer be considered valid.
      • Optional; date/time

    Screenshot of entering information in new threat indicator panel.

  2. When all the fields are filled in to your satisfaction, select Apply. You'll see a confirmation message in the upper-right-hand corner that your indicator was created.

  3. The entity will be added as a threat indicator in your workspace. You can find it in the list of indicators in the Threat intelligence page, and also in the ThreatIntelligenceIndicators table in Logs.

Next steps

In this article, you learned how to add entities to your threat indicator lists. For more information, see: