DATA CONNECTOR TITLE

You can connect your threat intelligence data sources to Microsoft Sentinel by either:

>Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, and others. >Calling the Microsoft Sentinel data plane API directly from another application.

Follow These Steps to Connect to your Threat Intelligence:

1. Get AAD Access Token

To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token - Notice: Please request AAD access token with scope value: https://management.azure.com/.default

2. Send indicators to Sentinel

You can send indicators by calling our Upload Indicators API. For more information about the API, click here. >HTTP method: POST >Endpoint: https://sentinelus.azure-api.net/workspaces/{WORKSPACEID}/threatintelligenceindicators:upload?api-version=2022-07-01 >WORKSPACEID: the workspace that the indicators are uploaded to (can be copied from the following). >Header Value 1: "Authorization" = "Bearer [AAD Access Token from step 1]" > Header Value 2: "Content-Type" = "application/json" >Body: The body is a JSON object containing an array of indicators in STIX format. For more information about the API, click here

Workspace ID