{
    "id": "MicrosoftDefenderThreatIntelligence",
    "title": "Microsoft Defender Threat Intelligence",
    "publisher": "Microsoft",
    "logo": {
        "type": 258,
        "options": null
    },
    "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelIndicators",
            "baseQuery": "ThreatIntelIndicators\n                      | where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")"
        },
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelObjects",
            "baseQuery": "ThreatIntelObjects\n                      | where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")"
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelIndicators\n| where ExpirationDateTime > now()\n| where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n| where ExpirationDateTime > now()\n| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "ThreatIntelIndicators\n| where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n| where TimeGenerated >= ago(1d) | summarize count()​​"
        },
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelObjects\n| where ExpirationDateTime > now()\n| where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n| where ExpirationDateTime > now()\n| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "ThreatIntelObjects\n| where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n| where TimeGenerated >= ago(1d) | summarize count()​​"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "MicrosoftThreatIntelligence"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelIndicators",
            "lastDataReceivedQuery": "ThreatIntelIndicators \n                | where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ThreatIntelObjects",
            "lastDataReceivedQuery": "ThreatIntelObjects \n                | where SourceSystem in (\"Microsoft Defender Threat Intelligence\", \"Microsoft Emerging Threat Feed\")\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "msticonnector",
            "featureStates": {
                "1": 3,
                "2": 3,
                "3": 3,
                "4": 3,
                "5": 3,
                "6": 0,
                "7": 2,
                "8": 2
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel."
        },
        {
            "instructions": [
                {
                    "type": "MicrosoftThreatIntelligence",
                    "parameters": {
                        "connectorKind": "MicrosoftThreatIntelligence"
                    }
                }
            ]
        }
    ]
}