{
    "id": "ThreatIntelligenceTaxii",
    "title": "Threat intelligence - TAXII",
    "publisher": "Microsoft",
    "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send the supported STIX object types from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2224105&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelIndicators",
            "baseQuery": "ThreatIntelIndicators | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") "
        },
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelObjects",
            "baseQuery": "ThreatIntelObjects | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") "
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelIndicators | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            and ExpirationDateTime > now() | join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "ThreatIntelIndicators | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            and TimeGenerated >= ago(1d) | summarize count()"
        },
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelObjects | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            and ExpirationDateTime > now() | join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "ThreatIntelObjects | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            and TimeGenerated >= ago(1d) | summarize count()"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "ThreatIntelligenceTaxii"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelIndicators",
            "lastDataReceivedQuery": "ThreatIntelIndicators | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ThreatIntelObjects",
            "lastDataReceivedQuery": "ThreatIntelObjects | where SourceSystem !in (\"SecurityGraph\", \"Azure Sentinel\", \"Microsoft Sentinel\") \n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "TaxiiConnector",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2,
                "5": 2,
                "6": 1,
                "7": 1,
                "8": 2
            }
        }
    },
    "permissions": {
        "customs": [
            {
                "name": "TAXII Server",
                "description": "TAXII 2.0 or TAXII 2.1 Server URI and Collection ID."
            }
        ],
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Configure TAXII servers to stream STIX 2.0 or 2.1 STIX objects to Microsoft Sentinel",
            "description": "You can connect your TAXII servers to Microsoft Sentinel using the built-in TAXII connector. For detailed configuration instructions, see the [full documentation](https://docs.microsoft.com/azure/sentinel/import-threat-intelligence#adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence---taxii-data-connector). \n\nEnter the following information and select Add to configure your TAXII server.",
            "instructions": [
                {
                    "parameters": {},
                    "type": "ThreatIntelligenceTaxii"
                }
            ]
        }
    ]
}