Microsoft Threat Intelligence feeds are integrated into Microsoft Sentinel

Overview

Microsoft Threat Intelligence (MSTI) is the consolidated stream of indicators of compromise (IPs, domains, URLs, file hashes, certificates, email addresses) that Microsoft generates from its global signal set — Microsoft Defender Threat Intelligence (MDTI), Microsoft 365 Defender, Defender for Endpoint, Defender for Cloud, the Defender Experts hunting team, and partner contributions — and exposes to Sentinel through the Microsoft Threat Intelligence connector and the Defender Threat Intelligence connector. Once ingested, indicators land in the ThreatIntelligenceIndicator table and are matched in real time against ingested telemetry by the Microsoft-published TI Map analytics rules to surface high-fidelity matches against known-bad infrastructure. Without a TI feed integrated, Sentinel cannot perform indicator-matching detection: a threat actor leveraging tooled command-and-control infrastructure that Microsoft has already attributed walks past Sentinel because no rule joins ingested DNS/HTTP/TLS telemetry against a current indicator list. The same applies to phishing infrastructure, credential-harvest sites, and ransomware staging IPs. Integration is delivered through one of three documented connectors: the MicrosoftThreatIntelligence data connector (ingests Microsoft-curated indicators), the ThreatIntelligence (TIP) connector for Microsoft Graph Security TI Indicators API, or the ThreatIntelligenceTaxii connector for STIX/TAXII feeds.

Remediation

• Microsoft Sentinel threat intelligence overview
• Connect Microsoft Defender Threat Intelligence to Microsoft Sentinel
• Connect threat intelligence platforms to Microsoft Sentinel
• Connect Microsoft Sentinel to STIX/TAXII threat intelligence feeds

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Threat intelligence
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
ATT&CK	T1071 Application Layer Protocol, T1566 Phishing
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.