Empowering collective defense through seamless threat intel sharing
We’re excited to announce a key milestone in advancing the threat intelligence platform within Microsoft Sentinel: You can now export threat intelligence to trusted destinations with ease. This milestone enables bi-directional sharing, allowing security teams not only to ingest intelligence but also to contribute back to partners, Information Sharing and Analysis Centers (ISACs), and multi-tenant environments—strengthening collective defense across the ecosystem.
Together with this release, we’re also excited to announce a strategic partnership with Cyware, delivering advanced onward-sharing capabilities for customers who want to curate and distribute threat intelligence at scale.
What is threat intelligence export?
Traditionally, Microsoft Sentinel has supported importing threat intel from external sources (partners, governments, ISACs, or internal tenants) via Structured Threat Information eXpression (STIX) via Trusted Automated eXchange of Intelligence Information (TAXII). With this new export feature, you can now share curated threat intel back to trusted destinations. This empowers security teams to contribute threat intel to other organizations in support of collective defense, or to their own central platform to add or enrich threat intelligence.
How it works
- Open the ‘Threat Intelligence’ solution in the Content Hub, and install/update to the latest version (to get the TAXII export connector)
- In Threat Intelligence Management, select one or multiple threat intel objects from your repository.
- Click the new Export button.
- Configure a trusted destination (currently TAXII v2.1 platforms are supported)
- Confirm and complete the export.
- Track success and details via ‘View export history’ button (visible for each exported object on Threat Intelligence Management)
Export to Cyware Intel Exchange threat intelligence platform
Microsoft is pleased to announce an expansion of its partnership with Cyware. This new Microsoft Sentinel capability also allows easy export of threat intelligence to Cyware Intel Exchange platform. Customers were already able to import threat intelligence from Cyware using the ‘TAXII import’ connector. With TI Export, it is now possible to also export threat intel back to Cyware, supported by the Cyware Intel Exchange bi-directional integration.
Customers leveraging Cyware can make use of even more advanced capabilities, such as creating a dedicated feed of threat intelligence which can then be continuously streamed to any SIEM/TIP (Sentinel or other platforms). This allows continuous distribution of threat intelligence.
Anuj Goel, CEO of Cyware, says “Our expanded partnership with Microsoft enables our customers to easily share actionable threat intelligence between Sentinel and Cyware Intel Exchange platform, empowering them with a streamlined workflow and higher-quality threat intelligence for detection and response scenarios.”
Learn more
- For more information, see Exporting threat intel.
- To get started, navigate to the Defender portal, and select Intel Management (under Threat Intelligence).
- To learn more about Microsoft Sentinel and Cyware Intel Exchange integration, see Cyware blog.
- To learn more about Cyware, visit www.cyware.com
FAQ
- What pre-requisites are required for threat intelligence export?
- Microsoft Sentinel is required.
- You must have the latest version of the ‘Threat Intelligence’ solution installed from the Content Hub
- Each destination needs to be configured in the new ‘TI Export’ connector, available in the ‘Threat Intelligence’ solution in the content hub.
- A TAXII-supported destination that you can write TI to is required (v2.1).
- What permissions are needed to export threat intel?
- Microsoft Sentinel contributor role is required.
- Can I share to non-TAXII destinations?
- Not at this time, but this is part of our plans.
Microsoft