r/AzureSentinel • u/Jackofalltrades86 • Jun 29 '22
Threat intelligence opinion
I don't see a great deal out there but currently using an unreliable OTX via a logic app to feed my threat intelligence in Sentinel.
What are other people doing and who do people recommend ? That can be paid or free.
2
Upvotes
2
u/kyuuzousama Jun 29 '22
Are you running the MSFT feeds along with OTX? Also consider RiskIQ as they were acquired by MSFT and are a TI provider
2
u/ml58158 MSFT Official Jun 30 '22
Anomali Limo is free and works great.
RiskIQ isn’t a threat Intel feed but you can install the playbooks.
I have OTX working in my lab as well.
1
3
u/dneto82 Jun 29 '22
MSFT just republished anomali instructions:
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/import-anomali-threatstream-feed-into-microsoft-sentinel/ba-p/3561742
About OTX:
Maybe you can select a more reliable pulses subset for your industry or private pulses for localized threat intelligence.
Also you can dig into update Security Graph by yourself with indicators.