Get in touch
← Sentinel Explorer
↳ GitHub sourceSolution

Threat Intelligence

View on GitHub ↗Original file ↗

Description

The Threat Intelligence solution contains data connectors for import of supported STIX objects into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.
Version
3.1.3
Declared author / publisher
Microsoft - support@microsoft.com
Support tier
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

ThreatIntelligenceTaxiiThreatIntelligenceMicrosoftDefenderThreatIntelligencePremiumMicrosoftDefenderForThreatIntelligence

Related content

Links established from declared identifiers and solution manifests.

Analytics rules52
Preview - TI map Domain entity to Cloud App EventsMediumPreview - TI map Email entity to Cloud App EventsMediumPreview - TI map IP entity to Cloud App EventsMediumPreview - TI map URL entity to Cloud App EventsMediumTI Map Domain Entity to DeviceNetworkEventsMediumTI map Domain entity to Dns Events (ASIM DNS Schema)MediumTI map Domain entity to DnsEventsMediumTI map Domain entity to EmailEventsMediumTI map Domain entity to EmailUrlInfoMediumTI map Domain entity to PaloAltoMediumTI map Domain entity to PaloAlto CommonSecurityLogMediumTI map Domain entity to SecurityAlertMediumTI map Domain entity to SyslogMediumTI map Domain entity to Web Session Events (ASIM Web Session schema)MediumTI map Email entity to AzureActivityMediumTI map Email entity to EmailEventsMediumTI map Email entity to OfficeActivityMediumTI map Email entity to PaloAlto CommonSecurityLogMediumTI map Email entity to SecurityAlertMediumTI map Email entity to SecurityEventMediumTI map Email entity to SigninLogsMediumTI map File Hash to CommonSecurityLog EventMediumTI map File Hash to DeviceFileEvents EventMediumTI map File Hash to Security EventMediumTI map IP entity to AppServiceHTTPLogsMediumTI map IP entity to AWSCloudTrailMediumTI map IP entity to Azure Key Vault logsMediumTI Map IP Entity to Azure SQL Security Audit EventsMediumTI Map IP Entity to AzureActivityMediumTI map IP entity to AzureFirewallMediumTI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)MediumTI Map IP Entity to CommonSecurityLogMediumTI Map IP Entity to DeviceNetworkEventsMediumTI map IP entity to DNS Events (ASIM DNS schema)MediumTI Map IP Entity to DnsEventsMediumTI Map IP Entity to Duo SecurityMediumTI map IP entity to GitHub_CLMediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to OfficeActivityMediumTI Map IP Entity to SigninLogsMediumTI Map IP Entity to VMConnectionMediumTI Map IP Entity to W3CIISLogMediumTI map IP entity to Web Session Events (ASIM Web Session schema)MediumTI map IP entity to Workday(ASimAuditEventLogs)MediumTI Map URL Entity to AuditLogsMediumTI Map URL Entity to DeviceNetworkEventsMediumTI Map URL Entity to EmailUrlInfoMediumTI Map URL Entity to OfficeActivity Data [Deprecated]MediumTI Map URL Entity to PaloAlto DataMediumTI Map URL Entity to SecurityAlert DataMediumTI Map URL Entity to Syslog DataMediumTI Map URL Entity to UrlClickEventsMedium
Connectors8
Workbooks1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
azure-sentinel-solution-threatintelligence-taxii
Additional source files 2Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.jsonsolution-manifest ↗Solutions/Threat Intelligence/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.