Forum Discussion

Haim Goldshtein

Icon for Microsoft rank

Microsoft

May 05, 2019

Pushing custom Indicator of Compromise (IoCs) to Microsoft Defender ATP

Submit your own IOCs to Microsoft Defender ATP to create alerts and perform remediation actions. 5 Minutes Low complexity Many organizations maintain internal lists of ...

Submit-Indicator.zip1 KB

Brass Contributor

Jun 03, 2019

Haim Goldshtein Dan Michelson

I've followed these instructions from Palo Alto https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Configure-MineMeld-to-Send-Indicators-to-Microsoft/ta-p/244121

I can see the IOC's pushed into ATP but I see the below within SecurityCenter

I'm sure this functionality has previously worked from when I've manually added IOC's

Any ideas?

Thanks

Thanks!

Dan Michelson
Microsoft
Jun 03, 2019
DannyC_Gamma

Please check first how many items you are pushing.

Currently, there is a limit of 5K items in the list. If the batch you are trying to push is larger than the remaining room in the list, it may fail.
- DannyC_Gamma
  Brass Contributor
  Jun 03, 2019
  Dan Michelson
  
  I was more referring to the message that I'd crudely highlighted in the screen grab
  
  Blocking IP addresses, domains, or URLs is not yet available for this tenant.
  
  I'm sure I've had the ability to do these previously - at present, I can only block hashes. Is the URL/Domain blocking functionality going to be (re)made available soon?
  
  Thanks
  Danny
  - Haim Goldshtein
    Microsoft
    Jun 04, 2019
    DannyC_Gamma
    
    Hi Danny,
    
    Blocking IPs, URL & Domains are features you need to turn on for you tenant.
    
    if the feature is turned off, when going to Indicators page-> IP TAB you will see the following warning message:
    
    to turn on the feature, you should go to Advance Feature tab, and turn Network Protection on:
    
    Thank you for bring that up, I'll add that procedure to the blog.
    
    Please check it and let me know if it works for you.
    
    Thanks,
    
    Haim

Share

Resources