Threat intelligence integration in Microsoft Sentinel

Microsoft Sentinel gives you a few different ways to use threat intelligence feeds to enhance your security analysts' ability to detect and prioritize known threats.

• Use one of many available integrated threat intelligence platform (TIP) products.
• Connect to TAXII servers to take advantage of any STIX-compatible threat intelligence source.
• Connect directly to the Microsoft Defender Threat Intelligence feed.
• Make use of any custom solutions that can communicate directly with the Microsoft Graph Security tiIndicators API.
• You can also connect to threat intelligence sources from playbooks, in order to enrich incidents with TI information that can help direct investigation and response actions.

Tip

If you have multiple workspaces in the same tenant, such as for Managed Security Service Providers (MSSPs), it may be more cost effective to connect threat indicators only to the centralized workspace.

When you have the same set of threat indicators imported into each separate workspace, you can run cross-workspace queries to aggregate threat indicators across your workspaces. Correlate them within your MSSP incident detection, investigation, and hunting experience.

TAXII threat intelligence feeds

To connect to TAXII threat intelligence feeds, follow the instructions to connect Microsoft Sentinel to STIX/TAXII threat intelligence feeds, together with the data supplied by each vendor linked below. You may need to contact the vendor directly to obtain the necessary data to use with the connector.

Accenture Cyber Threat Intelligence

• Learn about Accenture CTI integration with Microsoft Sentinel.

Cybersixgill Darkfeed

• Learn about Cybersixgill integration with Microsoft Sentinel @Cybersixgill
• To connect Microsoft Sentinel to Cybersixgill TAXII Server and get access to Darkfeed, contact Cybersixgill to obtain the API Root, Collection ID, Username and Password.

ESET

• Learn about ESET's threat intelligence offering.
• To connect Microsoft Sentinel to the ESET TAXII server, obtain the API root URL, Collection ID, Username and Password from your ESET account. Then follow the general instructions and ESET's knowledge base article.

Financial Services Information Sharing and Analysis Center (FS-ISAC)

• Join FS-ISAC to get the credentials to access this feed.

Health intelligence sharing community (H-ISAC)

• Join the H-ISAC to get the credentials to access this feed.

IBM X-Force

• Learn more about IBM X-Force integration

IntSights

• Learn more about the IntSights integration with Microsoft Sentinel @IntSights
• To connect Microsoft Sentinel to the IntSights TAXII Server, obtain the API Root, Collection ID, Username and Password from the IntSights portal after you configure a policy of the data you wish to send to Microsoft Sentinel.

Kaspersky

• Learn about Kaspersky integration with Microsoft Sentinel

Pulsedive

• Learn about Pulsedive integration with Microsoft Sentinel

ReversingLabs

• Learn about ReversingLabs TAXII integration with Microsoft Sentinel

Sectrio

• Learn more about Sectrio integration
• Step by step process for integrating Sectrio's TI feed into Microsoft Sentinel

SEKOIA.IO

• Learn about SEKOIA.IO integration with Microsoft Sentinel

ThreatConnect

• Learn more about STIX and TAXII @ThreatConnect
• TAXII Services documentation @ThreatConnect

Integrated threat intelligence platform products

To connect to Threat Intelligence Platform (TIP) feeds, follow the instructions to connect Threat Intelligence platforms to Microsoft Sentinel. The second part of these instructions calls for you to enter information into your TIP solution. See the links below for more information.

Agari Phishing Defense and Brand Protection

• To connect Agari Phishing Defense and Brand Protection, use the built-in Agari data connector in Microsoft Sentinel.

Anomali ThreatStream

• To download ThreatStream Integrator and Extensions, and the instructions for connecting ThreatStream intelligence to the Microsoft Graph Security API, see the ThreatStream downloads page.

AlienVault Open Threat Exchange (OTX) from AT&T Cybersecurity

• AlienVault OTX makes use of Azure Logic Apps (playbooks) to connect to Microsoft Sentinel. See the specialized instructions necessary to take full advantage of the complete offering.

EclecticIQ Platform

• EclecticIQ Platform integrates with Microsoft Sentinel to enhance threat detection, hunting and response. Learn more about the benefits and use cases of this two-way integration.

GroupIB Threat Intelligence and Attribution

• To connect GroupIB Threat Intelligence and Attribution to Microsoft Sentinel, GroupIB makes use of Azure Logic Apps. See the specialized instructions necessary to take full advantage of the complete offering.

MISP Open Source Threat Intelligence Platform

• Push threat indicators from MISP to Microsoft Sentinel using the TI upload indicators API with MISP2Sentinel.
• Azure Marketplace link for MISP2Sentinel.
• Learn more about the MISP Project.

Palo Alto Networks MineMeld

• To configure Palo Alto MineMeld with the connection information to Microsoft Sentinel, see Sending IOCs to the Microsoft Graph Security API using MineMeld and skip to the MineMeld Configuration heading.

Recorded Future Security Intelligence Platform

• Recorded Future makes use of Azure Logic Apps (playbooks) to connect to Microsoft Sentinel. See the specialized instructions necessary to take full advantage of the complete offering.

ThreatConnect Platform

• See the Microsoft Graph Security Threat Indicators Integration Configuration Guide for instructions to connect ThreatConnect to Microsoft Sentinel.

ThreatQuotient Threat Intelligence Platform

• See Microsoft Sentinel Connector for ThreatQ integration for support information and instructions to connect ThreatQuotient TIP to Microsoft Sentinel.

Incident enrichment sources

Besides being used to import threat indicators, threat intelligence feeds can also serve as a source to enrich the information in your incidents and provide more context to your investigations. The following feeds serve this purpose, and provide Logic App playbooks to use in your automated incident response. Find these enrichment sources in the Content hub.

For more information about how to find and manage the solutions, see Discover and deploy out-of-the-box content.

HYAS Insight

• Find and enable incident enrichment playbooks for HYAS Insight in the Microsoft Sentinel GitHub repository. Search for subfolders beginning with "Enrich-Sentinel-Incident-HYAS-Insight-".
• See the HYAS Insight Logic App connector documentation.

Microsoft Defender Threat Intelligence

• Find and enable incident enrichment playbooks for Microsoft Defender Threat Intelligence in the Microsoft Sentinel GitHub repository.
• See the MDTI Tech Community blog post for more information.

Recorded Future Security Intelligence Platform

• Find and enable incident enrichment playbooks for Recorded Future in the Microsoft Sentinel GitHub repository. Search for subfolders beginning with "RecordedFuture_".
• See the Recorded Future Logic App connector documentation.

ReversingLabs TitaniumCloud

• Find and enable incident enrichment playbooks for ReversingLabs in the Microsoft Sentinel GitHub repository.
• See the ReversingLabs Intelligence Logic App connector documentation.

RiskIQ Passive Total

• Find and enable incident enrichment playbooks for RiskIQ Passive Total in the Microsoft Sentinel GitHub repository.
• See more information on working with RiskIQ playbooks.
• See the RiskIQ PassiveTotal Logic App connector documentation.

Virus Total

• Find and enable incident enrichment playbooks for Virus Total in the Microsoft Sentinel GitHub repository. Search for subfolders beginning with "Get-VTURL".
• See the Virus Total Logic App connector documentation.

Next steps

In this document, you learned how to connect your threat intelligence provider to Microsoft Sentinel. To learn more about Microsoft Sentinel, see the following articles.

• Learn how to get visibility into your data and potential threats.
• Get started detecting threats with Microsoft Sentinel.