Threat Intelligence - MS Security Graph

Question

&nbsp;Hi community,&nbsp;i integrate Azure SEntinel in our test environment and i also want ot use TI feeds from MS Security Graph. I read a lot but i can´t found tangible instructions to activate the feeds.&nbsp;i have done these steps,&nbsp;1)&nbsp;Register an application&nbsp;in Azure Active Directory.2)&nbsp;Configure permissions&nbsp;and be sure to add the ThreatIndicators.ReadWrite.OwnedBy permission to the application.3) Ask your Azure AD tenant administrator to&nbsp;grant consent&nbsp;to the application.&nbsp;How can i configure step 4 regarding Microsoft SEcurity Graph? Thanks a lot !&nbsp;4) Configure your TIP or other integrated application to push indicators to Azure Sentinel by specifying the following:a. The application ID and secret you received when registering the app (step 1 above).

b. Set “Azure Sentinel” as the target.

c. Set an action for each indicator - ‘alert’ is most relevant for Azure Sentinel use cases &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

ofer_shezaf · Answer

Garfield-P
&nbsp;
DId you look into those guides and examples?
&nbsp;

Webinar:&nbsp;YouTube,&nbsp;MP4,&nbsp;Presentation
"bring your threat intelligence to Azure Sentinel."
"Ingesting Alien Vault OTX Threat Indicators into Azure Sentinel"

&nbsp;

dean_gross · Answer

Its been 2 years and the instructions have not gotten any better. Asking us to go watch another video is not a great experience. The instructions are making some assumptions about our level of knowledge about TI platforms which is minimal for many new users of Sentinel.

mikhailf · Answer

Hello Dean,Today there is an integration with Alien Vault TIP using Logic App.You can find its template with a pretty good explanation here: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ingesting-alien-vault-otx-threat-indicators-into-azure-sentinel/ba-p/1086566

Forum Discussion

Threat Intelligence - MS Security Graph

Share

Resources