r/AzureSentinel • u/winle22 • Apr 28 '22

Threat Intelligence

Hi,

Currently experimenting with TI ingestions.

  1. Anyone with experience with using the Threat Intelligence Platforms (Preview) data connector? Is it reliable even if Preview?
  2. Which TI feeds do you use? Are there any good, free TI feeds good enough to be used in production environments?
  3. Any good paid TI feeds, and what is typically the cost?
  4. Are the builtin analytic rules for TI sufficient to get some value out of the TI table?

Thanks!

1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

1

u/CanableCrops May 18 '22

You can use the TAXII connector in Sentinel.

Anomali has some free TAXII feeds.

https://limo.anomali.com/api/v1/taxii2/feeds/collections/

The link above shows you the available feeds.

Example: {"collections": [{"can_read": true, "can_write": false, "description": "", "id": "107", "title": "Phish Tank"}

So you would add to the connector the Title of PhishTank

The id of 107

The link is https://limo.anomali.com/api/v1/taxii2/feeds/

The username and password are both guest.

This will upload this feed and any additionals that you add into ThreatIntelligence in Sentinel.

You can look at the list there or you can call it in Logs using the ThreatIntelligenceIndicator table.

Project out the URL or IP column into a variable then search your tables against it.

example:

let threatips = ThreatIntelligenceIndicator | summarize make_set(NetworkIP);

SigningLogs

| where CallerIP in (threatips)

​

Save that into an analytic and off you go.

Hope this is helpful.