![]() ![]() You can find the new indicators in the Threat intelligence blade, accessible from the Microsoft Sentinel navigation menu. Within a few minutes, threat indicators should begin flowing into this Microsoft Sentinel workspace. You should receive confirmation that a connection to the TAXII server was established successfully, and you may repeat the last step above as many times as you want, to connect to multiple Collections from one or more TAXII servers. To configure the TAXII data connector, select the Data connectors menu.įind and select the Threat Intelligence - TAXII data connector > Open connector page button.Įnter a friendly name for this TAXII server Collection, the API Root URL, the Collection ID, a Username (if required), and a Password (if required), and choose the group of indicators and the polling frequency you want. To import threat indicators into Microsoft Sentinel from a TAXII server, follow these steps:įrom the Azure portal, navigate to the Microsoft Sentinel service.Ĭhoose the workspace to which you want to import threat indicators from the TAXII server.įind and select the Threat Intelligence solution.įor more information about how to manage the solution components, see Discover and deploy out-of-the-box content.Įnable the Threat intelligence - TAXII data connector Install the Threat Intelligence solution in Microsoft Sentinel You can use the cURL utility to browse the discovery endpoint and request the API Root. In some cases, the provider will only advertise a URL called a Discovery Endpoint. You can usually find the API Root and the Collection ID in the documentation pages of the threat intelligence provider hosting the TAXII server. TAXII 2.x servers advertise API Roots, which are URLs that host Collections of threat intelligence. Get the TAXII server API Root and Collection ID You must have a TAXII 2.0 or TAXII 2.1 API Root URI and Collection ID.You must have read and write permissions to the Microsoft Sentinel workspace to store your threat indicators.See Azure RBAC built in roles for details on this role. In order to install, update and delete standalone content or solutions in content hub, you need the Template Spec Contributor role at the resource group level.Learn more about Threat Intelligence in Microsoft Sentinel, and specifically about the TAXII threat intelligence feeds that can be integrated with Microsoft Sentinel. To import STIX formatted threat indicators to Microsoft Sentinel from a TAXII server, you must get the TAXII server API Root and Collection ID, and then enable the Threat Intelligence - TAXII data connector in Microsoft Sentinel. This connector enables a built-in TAXII client in Microsoft Sentinel to import threat intelligence from TAXII 2.x servers. If your organization receives threat indicators from solutions that support the current STIX/TAXII version (2.0 or 2.1), you can use the Threat Intelligence - TAXII data connector to bring your threat indicators into Microsoft Sentinel. The most widely adopted industry standard for the transmission of threat intelligence is a combination of the STIX data format and the TAXII protocol. See also: Connect your threat intelligence platform (TIP) to Microsoft Sentinel For information about feature availability in US Government clouds, see the Microsoft Sentinel tables in Cloud feature availability for US Government customers. ![]()
0 Comments
Leave a Reply. |