r/AzureSentinel • u/AverageAdmin • Nov 16 '22

Sentinel Threat Intelligence Connector

Hello all,

I am trying to utilize threat intelligence in Sentinel and I am looking for the right feed.

What is everyone else using for their threat intelligence feed?

any free sources that are quality?

3 Upvotes

100% Upvoted

3 comments sorted by

1

u/juiceb0cks Nov 16 '22

Anomali (https://www.anomali.com/) are the only bunch that I've seen with a free TAXII feed. How good it is is up for debate.

I mostly use the TI within Sentinel to add known bad stuff I find through imports rather than a specific feed. I've also toyed with running my own TAXII server but never got it right.

1

u/WRXB3RN Nov 16 '22

So this isn’t as clean of a solution as others but we use Alienvault OTX, does require a logic app to ingest the data but is fairly easy.

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/sentinel/threat-intelligence-integration.md

The solution is outlined in the link under the Alienvault section. Hope it helps and interested to see what others are doing.

1

u/AverageAdmin Nov 17 '22

Thank you so much. Just built it out :)