Connect the threat intelligence TAXII connector
Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send threat indicators from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes.
In the Azure portal, navigate to Microsoft Sentinel > Data connectors and then select the Threat Intelligence - TAXII connector.
To view the connector page:
Select Data connectors page.
Select Threat intelligence - TAXII.
select the Open connector page on the preview pane.
Specify the required and optional information in the text boxes.
Friendly name (for server)
API root URL
Collection ID
Username
Password
Select Add to enable the connection.
The list of configure TAXII servers shows the currently connected TAXII servers and the last indicator received time. The ellipse at the end of the configured server provides the option to remove the server configuration.
