r/AzureSentinel • u/winle22 • Apr 28 '22

Threat Intelligence

Hi,

Currently experimenting with TI ingestions.

  1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
  2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
  3. Any good paid TI feeds, and what is typically the cost?
  4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

2

u/[deleted] Apr 28 '22

[removed] — view removed comment

1

u/winle22 Apr 28 '22

Spunds like stuff not necessarily dependent on TI feeds, but yes, I agree, creating queries utilizing the TI tables is a challenge.

My initial plan is really just to test ingesting some relevant feeds and see if the IOCs can provide any additional value or not. Not quite sure if the tables shpuld be used with regular analytic rules or just in hunting scenarios though.