Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Microsoft Defender Threat Intelligence

Voir sur GitHub ↗Fichier original ↗

Une incohérence a été détectée dans les sources : variantes ou fichier invalide. Vérifiez les fichiers et le commit indiqués ci-dessous.

Description

Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc.
Statut déclaré
2
Auteur / éditeur déclaré
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

ThreatIntelIndicatorsThreatIntelObjects

Permissions déclarées

read and write permissions.
Workspace
Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques114
Dataverse - TI map IP to DataverseActivityMediumDataverse - TI map URL to DataverseActivityMediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumGreyNoise TI map IP entity to OfficeActivityMediumGreyNoise TI Map IP Entity to SigninLogsMediumPower Apps - Multiple users access a malicious link after launching new appHighPreview - TI map Domain entity to Cloud App EventsMediumPreview - TI map Email entity to Cloud App EventsMediumPreview - TI map IP entity to Cloud App EventsMediumPreview - TI map URL entity to Cloud App EventsMediumThreat Connect TI map Domain entity to DnsEventsMediumThreatConnect TI map Email entity to OfficeActivityMediumThreatConnect TI map Email entity to SigninLogsMediumThreatConnect TI Map URL Entity to OfficeActivity DataMediumTI Map Domain entity to Cloud App EventsMediumTI Map Domain Entity to DeviceNetworkEventsMediumTI Map Domain Entity to DeviceNetworkEventsMediumTI Map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map Domain entity to Dns Events (ASIM DNS Schema)MediumTI Map Domain entity to DnsEventsMediumTI map Domain entity to DnsEventsMediumTI map Domain entity to EmailEventsMediumTI Map Domain entity to EmailEventsMediumTI map Domain entity to EmailUrlInfoMediumTI Map Domain entity to EmailUrlInfoMediumTI Map Domain entity to PaloAltoMediumTI map Domain entity to PaloAltoMediumTI Map Domain entity to PaloAlto CommonSecurityLogMediumTI map Domain entity to PaloAlto CommonSecurityLogMediumTI map Domain entity to SecurityAlertMediumTI Map Domain entity to SecurityAlertMediumTI map Domain entity to SyslogMediumTI Map Domain entity to SyslogMediumTI Map Domain entity to Web Session Events (ASIM Web Session schema)MediumTI map Domain entity to Web Session Events (ASIM Web Session schema)MediumTI Map Email entity to AzureActivityMediumTI map Email entity to AzureActivityMediumTI Map Email entity to Cloud App EventsMediumTI map Email entity to EmailEventsMediumTI Map Email entity to EmailEventsMediumTI map Email entity to OfficeActivityMediumTI Map Email entity to OfficeActivityMediumTI Map Email entity to PaloAlto CommonSecurityLogMediumTI map Email entity to PaloAlto CommonSecurityLogMediumTI Map Email entity to SecurityAlertMediumTI map Email entity to SecurityAlertMediumTI Map Email entity to SecurityEventMediumTI map Email entity to SecurityEventMediumTI map Email entity to SigninLogsMediumTI Map Email entity to SigninLogsMediumTI Map File Hash to CommonSecurityLog EventMediumTI map File Hash to CommonSecurityLog EventMediumTI map File Hash to DeviceFileEvents EventMediumTI Map File Hash to DeviceFileEvents EventMediumTI Map File Hash to Security EventMediumTI map File Hash to Security EventMediumTI Map IP entity to AppServiceHTTPLogsMediumTI map IP entity to AppServiceHTTPLogsMediumTI Map IP entity to AWSCloudTrailMediumTI map IP entity to AWSCloudTrailMediumTI map IP entity to Azure Key Vault logsMediumTI Map IP entity to Azure Key Vault logsMediumTI Map IP Entity to Azure SQL Security Audit EventsMediumTI Map IP Entity to Azure SQL Security Audit EventsMediumTI Map IP Entity to AzureActivityMediumTI Map IP Entity to AzureActivityMediumTI map IP entity to AzureFirewallMediumTI Map IP entity to AzureFirewallMediumTI Map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)MediumTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)MediumTI Map IP entity to Cloud App EventsMediumTI Map IP Entity to CommonSecurityLogMediumTI Map IP Entity to CommonSecurityLogMediumTI Map IP Entity to DeviceNetworkEventsMediumTI Map IP Entity to DeviceNetworkEventsMediumTI map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP Entity to DnsEventsMediumTI Map IP Entity to DnsEventsMediumTI Map IP Entity to Duo SecurityMediumTI Map IP Entity to Duo SecurityMediumTI Map IP entity to GitHub_CLMediumTI map IP entity to GitHub_CLMediumTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to OfficeActivityMediumTI Map IP entity to OfficeActivityMediumTI Map IP Entity to SigninLogsMediumTI Map IP Entity to SigninLogsMediumTI Map IP Entity to VMConnectionMediumTI Map IP Entity to VMConnectionMediumTI Map IP Entity to W3CIISLogMediumTI Map IP Entity to W3CIISLogMediumTI Map IP entity to Web Session Events (ASIM Web Session schema)MediumTI map IP entity to Web Session Events (ASIM Web Session schema)MediumTI Map IP entity to Workday(ASimAuditEventLogs)MediumTI map IP entity to Workday(ASimAuditEventLogs)MediumTI Map URL Entity to AuditLogsMediumTI Map URL Entity to AuditLogsMediumTI Map URL entity to Cloud App EventsMediumTI Map URL Entity to DeviceNetworkEventsMediumTI Map URL Entity to DeviceNetworkEventsMediumTI Map URL Entity to EmailUrlInfoMediumTI Map URL Entity to EmailUrlInfoMediumTI Map URL Entity to OfficeActivity Data [Deprecated]MediumTI Map URL Entity to PaloAlto DataMediumTI Map URL Entity to PaloAlto DataMediumTI Map URL Entity to SecurityAlert DataMediumTI Map URL Entity to SecurityAlert DataMediumTI Map URL Entity to Syslog DataMediumTI Map URL Entity to Syslog DataMediumTI Map URL Entity to UrlClickEventsMediumTI Map URL Entity to UrlClickEventsMediumTI Map URL entity to Web Session Events (ASIM Web Session schema)Medium
Solutions3
Workbooks1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
MicrosoftDefenderThreatIntelligence
Autres fichiers source 2Solutions/Threat Intelligence (NEW)/Data Connectors/template_MicrosoftDefenderThreatIntelligence.jsonsource ↗Solutions/Threat Intelligence (NEW)/Data/Solution_ThreatIntelligenceUpdated.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.