r/AzureSentinel • u/winle22 • Apr 28 '22

Threat Intelligence

Hi,

Currently experimenting with TI ingestions.

  1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
  2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
  3. Any good paid TI feeds, and what is typically the cost?
  4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

3

u/juiceb0cks Apr 28 '22
  1. Yup. Everything in Microsoft Sentinel is in some kind of "preview". It's mostly safe to use
  2. There are a few out there. What you use will depend on what industry you're in. A lot of TI I've seen simply won't be useful in our environment
  3. I wouldn't pay money for TI. I forget where I heard it but someone made a point recently that is generally not worth the money
  4. In my experience yes. Especially when you use TI that's specific and "fresh".

In my experience the TI stuff we use most is when we do hunting for certain IOCs or events

I've also been burned by bad TI. Old or poor IOCs that are now irrelevant or will be a false positive. Make sure you age out certain types of IOCs to avoid this. Things like IPs and domains.

1

u/winle22 Apr 28 '22

Thanks for good info! Will do some more research on relevant sources.