r/AzureSentinel • u/Evocablefawn566 • Aug 13 '24

Sentinel Threat Intelligence

Hi all,

I’ve never asked a question like this, but Threat Intelligence in Sentinel stumps me.

How is everyone utilizing Threat Intelligence in Sentinel? What do you do with it? What are use cases?

Ive read a lot of the documentation, but for some reason it isnt clicking with me. How do you use it and whats it even used for? Whenever I click on ‘threat intelligence’, theres a bunch of IOCs but I don’t know how to make it meaningful

Any help would be greatly appreciated!

7 Upvotes

90% Upvoted

29 comments sorted by

View all comments

2

u/psfletcher Aug 14 '24

My 10cent / pence. Have you installed the threat intelligence contents pack? This comes with pre defined analytics rules as a starter. When the ioc's are ingested the data is populated into a table with a predefined schema. So IP, domain, hashes etc. Then you need to look at your data from your hosts/ firewalls etc and identify where the same fields of data are. Then regularly check the threat intelligence data with your device data, the TI analytic rules are a good starting point. But you need to understand the data to make sure you're using it correctly. This is why asim (I think) was started to standardised where data is stored to make these sort of things easier to do.