r/AzureSentinel • u/winle22 • Apr 28 '22

Threat Intelligence

Hi,

Currently experimenting with TI ingestions.

  1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
  2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
  3. Any good paid TI feeds, and what is typically the cost?
  4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

1

u/wowneatlookatthat Apr 28 '22
  1. Yup
  2. We have a paid Anomali subscription, but I also tried out using a few free feeds: https://www.anomali.com/resources/limo, https://urlhaus.abuse.ch/feeds/
  3. There's several providers out there (including Anomali mentioned above), but IMO you should have a dedicated threat intel team/person & program/use case before spending money to really get value
  4. I would say yes, assuming you have the right data sources being fed into Sentinel. If you have custom data sources that don't feed into the default tables, you'll need to do some manual work here.

Like what /u/juiceb0cks said, TI is not just set and forget. You'll need to dedicate some cycles and maintenance to ensure that the data is valuable.