Forum Discussion
Solved
RE: Free Threat Intelligent Feeds
Do any of you know, of any FREE STIX/TAXII threat intelligence feeds that can connect to Microsoft Sentinel?
I ideally need them in CSV or JSON format, which can be uploaded through the Threat Intelligence page and MAP to the ThreatIntelligenceIndicator table for querying.
- Why would you need the CSV if they are coming from a TAXII server? Microsoft Sentinel has the capability to ingest data from TAXII servers and send it directly to the ThreatIntelligenceIndicator table.
Hello JMSHW0420 ,
You may want to have a look at MISP (MISP Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing (misp-project.org)) It leverages the both STIX and TAXII standards and you can feed it with many free TI sources, while cultivating the development of your own IoCs.
There are several guides to integrate MISP with Sentinel, I found this more helpful: Integrating open source threat feeds with MISP and Sentinel - Microsoft Community Hub.
Hope this helps.
- GBushey
Microsoft
Why would you need the CSV if they are coming from a TAXII server? Microsoft Sentinel has the capability to ingest data from TAXII servers and send it directly to the ThreatIntelligenceIndicator table.
