Threat Intelligence Platforms

You can connect your threat intelligence data sources to Microsoft Sentinel by either:

- Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MindMeld, MISP, and others. - Calling the Microsoft Graph Security API directly from another application.

Follow These Steps to Connect your Threat Intelligence:

1) [Register an application](https://docs.microsoft.com/graph/auth-v2-service#1-register-your-app) in Azure Active Directory. 2) [Configure permissions](https://docs.microsoft.com/graph/auth-v2-service#2-configure-permissions-for-microsoft-graph) and be sure to add the ThreatIndicators.ReadWrite.OwnedBy permission to the application. 3) Ask your Azure AD tenant administrator to [grant consent](https://docs.microsoft.com/graph/auth-v2-service#3-get-administrator-consent) to the application. 4) Configure your TIP or other integrated application to push indicators to Microsoft Sentinel by specifying the following: a. The application ID and secret you received when registering the app (step 1 above). b. Set “Microsoft Sentinel” as the target. c. Set an action for each indicator - ‘alert’ is most relevant for Microsoft Sentinel use cases For the latest list of integrated Threat Intelligence Platforms and detailed configuration instructions, see the [full documentation](https://docs.microsoft.com/azure/sentinel/import-threat-intelligence#adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence-platforms-data-connector). Click on "Connect" below > Data from all regions will be sent to and stored in the workspace's region.