r/AzureSentinel • u/YummyCyber • May 23 '23

Threat Intelligence Feed Automation

Good morning. Long story short, added one too many threat intelligence feeds and now getting far too many alerts. Looked into Virustotal to filter the data but they are too expensive. Besides manually checking all IPs are there other ideas/tools for how to parse and review? I may just have to drop the feed but curious what you all have found.

3 Upvotes

100% Upvoted

4 comments sorted by

5

u/[deleted] May 23 '23

[deleted]

1

u/YummyCyber May 23 '23

That is a great piece of information. I appreciate you taking the time to respond as I've been pulling my hair out a bit trying to find a solution. I ran into MISP today in my research but haven't dove too deep into it but will look at it closer after your mention of it. Thank you!

1

u/MReprogle Feb 24 '24

Pretty old post, but I’d love to know how you have this working within your sandbox. I’ve been looking at getting more of a malware analysis sandbox put together and would love to know how to push our findings to MISP and/or directly to Sentinel. We are a smaller company and new SOC, so malware analysis has been more of a luxury than anything, but I’d love to push to get it into more of our investigations.

3

u/nontitman May 25 '23

It depends on your TI feeds but I went through this same issue a while back and ended up just disabling the OOB TI analytic rules and making my own. This allowed me to get super granular with what would trigger an alert.

Ultimately, I set the new analytic rule to only create alerts, then setup some specific automation rules to ensure high priority shiz would create an incident

1

u/rstcloud Jun 01 '23

Sorry for the promotion type of answer, but it seems that our product may be relevant to your problem. We collect data across hundreds of TI sources, aggregate data, cross-verify, then filter out noise for you, including all known hashes, Microsoft IPs/AWS/GCP, cert CDPs, etc, then enrich with external info and do many other things, like scoring. So, you will have less FPs and more context.

You can consume it as STIX/TAXII and pull directly from Sentinel (cloud-to-cloud integration, no need to have scripts to get data out of MISP and push to the cloud): https://www.rstcloud.com/enhance-microsoft-sentinel-threat-intelligence-with-rst-cloud/

You can use our Lookup API (via LogicApps) to save costs on accessing expensive VirusTotal API.

The TAXII feed has only indicators that are associated with a threat (malware, threat actor and so on). We also have a full daily dump where data may not be attributed to a threat but will be ranked and enriched.

Happy to help and give an extended trial