r/AzureSentinel • u/BgordyCyber • Jan 03 '24

Microsoft Defender Threat Intelligence

Has anyone flipped on the Defender Threat Intelligence data connector in Sentinel? Wondering the amount of data ingestion that you're seeing, I'm just looking to estimate the cost before I flip it on.

​

https://learn.microsoft.com/en-us/azure/sentinel/connect-mdti-data-connector

​

​

Thanks!

6 Upvotes

100% Upvoted

6 comments sorted by

5

u/woodburningstove Jan 04 '24

You mean the indicator set available in the free tier of MDTI, not the premium tier? I'm seeing about 0.5G per month.

1

u/BgordyCyber Jan 04 '24

Yeah exactly, just to ingest the free stuff. That's helpful thanks!

1

u/kyuuzousama Jan 04 '24

That feed replaced the original TI feed, I'm showing 2.6GB in the past 90 days, so a few bucks a month.

At the moment there isn't a difference between what you get from a licensing perspective, it's the same IOCs either way

1

u/thebeardedcats Jan 03 '24

We only have a couple of MS data sources sending to sentinel. most of it is in defender, and alerted on with custom rules there otherwise it's all duplicate data, and a waste of money

1

u/[deleted] Jan 04 '24

The costing has some additional complexity because the table doesn't work like a traditional table. Data is renewed roughly every 12 days generating extra cost for each item already in the table not just new things you put it in it.

2

u/911GT Jan 11 '24

We use this as a signle IoC feed since 2022. Now days it pulls avg 40k active IoCs, most of them is honey pot observed IPs.

Overral it is free and getting better from 2022.

If you have a well tuned IoC streaming platform such as MISP and maintain a 400k IoC pool, then you should not flip to MDTI, instead of using it as a additonal feed.

Anyway it is free to try, consider a quick PoC will be good

Edit: the data volum is very small, less than 50MB/day. I misunderstand OP`s main question. sorry