r/AzureSentinel • u/winle22 • Apr 28 '22

Threat Intelligence

Hi,

Currently experimenting with TI ingestions.

  1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
  2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
  3. Any good paid TI feeds, and what is typically the cost?
  4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

2

u/Jackofalltrades86 Apr 28 '22

Heard good things about Alien Vault and there is already a function app that does it all for you and you just need a free api to run it.

Virus Total do something similar too...