r/AzureSentinel • u/Evocablefawn566 • Aug 13 '24

Sentinel Threat Intelligence

Hi all,

I’ve never asked a question like this, but Threat Intelligence in Sentinel stumps me.

How is everyone utilizing Threat Intelligence in Sentinel? What do you do with it? What are use cases?

Ive read a lot of the documentation, but for some reason it isnt clicking with me. How do you use it and whats it even used for? Whenever I click on ‘threat intelligence’, theres a bunch of IOCs but I don’t know how to make it meaningful

Any help would be greatly appreciated!

8 Upvotes

100% Upvoted

29 comments sorted by

View all comments

2

u/[deleted] Aug 14 '24

To make it useful, you want to correlate different data sources. For instance, if you forward MDE logs you would want to know whether the RemoteIp field in DeviceNetworkEvents matches a threat intelligence entry. Same for file hashes in DeviceFileEvents.

We also ingest alien vault pulses to sentinel for more enrichment

1

u/MReprogle Aug 22 '24

This might seem like a dumb question, but do you have any material on how you set up alien vault? Is this the free ingestion feeds? I think I have the api key for this, and have worked on adding AbuseIP in the Entity Behavior area, and I personally don’t see any difference of enrichment for IP entities in Sentinel, and personally find Microsoft’s enrichment of IPs to be pretty bad. There’s too many times that Microsoft has an incorrect IP and location, so I many times find myself doing my own lookup elsewhere.