Forum Discussion
TI Connector data received unexpectendly
When I look at the data connectors list, it shows that the Threat Intelligence - TAXII connector is disabled, but the Last Data Received attribute shows todays date and there is 60k of data every day this week. The connector configuration values are all empty and a TAXII server is not listed.
Can someone help me reconcile these discrepancies?
1 Reply
- Is it another SourceSystem that's sending them?
ThreatIntelligenceIndicator
| summarize count() by SourceSystem
But you probably just need to contact support: https://github.com/Azure/Azure-Sentinel/issues/2689
