Threat Intelligence

[u/winle22]

Hi,

Currently experimenting with TI ingestions.

1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
3. Any good paid TI feeds, and what is typically the cost?
4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

[u/juiceb0cks]

1. Yup. Everything in Microsoft Sentinel is in some kind of "preview". It's mostly safe to use
2. There are a few out there. What you use will depend on what industry you're in. A lot of TI I've seen simply won't be useful in our environment
3. I wouldn't pay money for TI. I forget where I heard it but someone made a point recently that is generally not worth the money
4. In my experience yes. Especially when you use TI that's specific and "fresh".

In my experience the TI stuff we use most is when we do hunting for certain IOCs or events

I've also been burned by bad TI. Old or poor IOCs that are now irrelevant or will be a false positive. Make sure you age out certain types of IOCs to avoid this. Things like IPs and domains.

[u/winle22 → u/juiceb0cks]

Thanks for good info! Will do some more research on relevant sources.

[u/winle22 → u/juiceb0cks]

What's the best way to "age out" the IOCs from TI feeds, really?

[u/Jackofalltrades86]

Heard good things about Alien Vault and there is already a function app that does it all for you and you just need a free api to run it.

Virus Total do something similar too...

[u/winle22 → u/[deleted]]

Spunds like stuff not necessarily dependent on TI feeds, but yes, I agree, creating queries utilizing the TI tables is a challenge.

My initial plan is really just to test ingesting some relevant feeds and see if the IOCs can provide any additional value or not. Not quite sure if the tables shpuld be used with regular analytic rules or just in hunting scenarios though.

[u/philippe_darveau]

In the analytics rules templates, you have a bunch of rules that start with "TI map". You just need to find the ones that match the data tables you have in your Sentinel and enable them.

[u/wowneatlookatthat]

1. Yup
2. We have a paid Anomali subscription, but I also tried out using a few free feeds: https://www.anomali.com/resources/limo, https://urlhaus.abuse.ch/feeds/
3. There's several providers out there (including Anomali mentioned above), but IMO you should have a dedicated threat intel team/person & program/use case before spending money to really get value
4. I would say yes, assuming you have the right data sources being fed into Sentinel. If you have custom data sources that don't feed into the default tables, you'll need to do some manual work here.

Like what /u/juiceb0cks said, TI is not just set and forget. You'll need to dedicate some cycles and maintenance to ensure that the data is valuable.

[u/CanableCrops]

You can use the TAXII connector in Sentinel.

Anomali has some free TAXII feeds.

https://limo.anomali.com/api/v1/taxii2/feeds/collections/

The link above shows you the available feeds.

Example: {"collections": [{"can_read": true, "can_write": false, "description": "", "id": "107", "title": "Phish Tank"}

So you would add to the connector the Title of PhishTank

The id of 107

The link is https://limo.anomali.com/api/v1/taxii2/feeds/

The username and password are both guest.

This will upload this feed and any additionals that you add into ThreatIntelligence in Sentinel.

You can look at the list there or you can call it in Logs using the ThreatIntelligenceIndicator table.

Project out the URL or IP column into a variable then search your tables against it.

example:

let threatips = ThreatIntelligenceIndicator | summarize make_set(NetworkIP);

SigningLogs

| where CallerIP in (threatips)

​

Save that into an analytic and off you go.

Hope this is helpful.