Échangeons
← Sentinel Explorer
↳ Source GitHubSolution

Threat Intelligence

Voir sur GitHub ↗Fichier original ↗

Description

The Threat Intelligence solution contains data connectors for import of supported STIX objects into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.
Version
3.1.3
Auteur / éditeur déclaré
Microsoft - support@microsoft.com
Niveau de support
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Connecteurs

ThreatIntelligenceTaxiiThreatIntelligenceMicrosoftDefenderThreatIntelligencePremiumMicrosoftDefenderForThreatIntelligence

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques52
Preview - TI map Domain entity to Cloud App EventsMediumPreview - TI map Email entity to Cloud App EventsMediumPreview - TI map IP entity to Cloud App EventsMediumPreview - TI map URL entity to Cloud App EventsMediumTI Map Domain Entity to DeviceNetworkEventsMediumTI map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map Domain entity to DnsEventsMediumTI map Domain entity to EmailEventsMediumTI map Domain entity to EmailUrlInfoMediumTI map Domain entity to PaloAltoMediumTI map Domain entity to PaloAlto CommonSecurityLogMediumTI map Domain entity to SecurityAlertMediumTI map Domain entity to SyslogMediumTI map Domain entity to Web Session Events (ASIM Web Session schema)MediumTI map Email entity to AzureActivityMediumTI map Email entity to EmailEventsMediumTI map Email entity to OfficeActivityMediumTI map Email entity to PaloAlto CommonSecurityLogMediumTI map Email entity to SecurityAlertMediumTI map Email entity to SecurityEventMediumTI map Email entity to SigninLogsMediumTI map File Hash to CommonSecurityLog EventMediumTI map File Hash to DeviceFileEvents EventMediumTI map File Hash to Security EventMediumTI map IP entity to AppServiceHTTPLogsMediumTI map IP entity to AWSCloudTrailMediumTI map IP entity to Azure Key Vault logsMediumTI Map IP Entity to Azure SQL Security Audit EventsMediumTI Map IP Entity to AzureActivityMediumTI map IP entity to AzureFirewallMediumTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)MediumTI Map IP Entity to CommonSecurityLogMediumTI Map IP Entity to DeviceNetworkEventsMediumTI map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP Entity to DnsEventsMediumTI Map IP Entity to Duo SecurityMediumTI map IP entity to GitHub_CLMediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to OfficeActivityMediumTI Map IP Entity to SigninLogsMediumTI Map IP Entity to VMConnectionMediumTI Map IP Entity to W3CIISLogMediumTI map IP entity to Web Session Events (ASIM Web Session schema)MediumTI map IP entity to Workday(ASimAuditEventLogs)MediumTI Map URL Entity to AuditLogsMediumTI Map URL Entity to DeviceNetworkEventsMediumTI Map URL Entity to EmailUrlInfoMediumTI Map URL Entity to OfficeActivity Data [Deprecated]MediumTI Map URL Entity to PaloAlto DataMediumTI Map URL Entity to SecurityAlert DataMediumTI Map URL Entity to Syslog DataMediumTI Map URL Entity to UrlClickEventsMedium
Connecteurs8
Workbooks1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
azure-sentinel-solution-threatintelligence-taxii
Autres fichiers source 2Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.jsonsolution-manifest ↗Solutions/Threat Intelligence/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.