Forum Discussion

HA13029's avatar
HA13029
Brass Contributor
Apr 05, 2025

Generic Logic App to ingest IOCs in text format

Hi all, I configured Sentinel to ingest IOC from different Threat Intelligence sources (free) using TAXII connector. I would like to ingest others feeds in text format (like https://raw.githubuserc...
playbooks
threat intelligence
HA13029's avatar
HA13029
Brass Contributor
Apr 08, 2025

Hi cyb3rmik3,

In fact, I already used it for some external feeds (mainly malwarebazaar hash latest feeds).

Logic app introduces some issues (like duplicate, etc) you mention above.

The main question is: how much data (KB, Mbits) can import using externaldata ?

Regards,

HA

cyb3rmik3's avatar
cyb3rmik3
MVP
Apr 09, 2025

Hello HA13029,

 

according to Microsoft (https://github.com/MicrosoftDocs/dataexplorer-docs/tree/main/data-explorer/kusto/query)

Use the externaldata operator to retrieve small reference tables of up to 100 MB from an external storage artifact.

 

Other than that, standard query limits (https://learn.microsoft.com/kusto/concepts/query-limits) apply to external data queries as well.

 

If I have answered your question, please mark your post as Solved

If you like my response, please consider giving it a like

Resources