Microsoft URL threat intelligence - Azure Sentinel integration

Copper Contributor

Hi !

I read in some ms articles that it is possible to match urls from custom logs to mircosoft URL threat intelligence. But I can't find any guide to do this. Is there any information availbale to match urls from example firewall logs to Microsoft URL threat intelligence.



1 Reply



Using CommonSecurityLog (instead of a custom log); this finds a matching Url in ThreatIntelligenceIndicatorthat that is also in CommonSecurityLog.  This is a very basic example.


| where isnotempty(Url)
| parse Url with * "http://" strUrl "/" *
| where isnotempty(strUrl)
| summarize by RequestURLti=strUrl, Url
| join
| where isnotempty(RequestURL) and RequestURL != '/'
| summarize by RequestURL
) on $left.RequestURLti == $right.RequestURL