{
    "id": "ThreatIntelligence",
    "title": "Threat Intelligence Platforms",
    "publisher": "Microsoft",
    "logo": {
        "type": 258,
        "options": null
    },
    "descriptionMarkdown": "Microsoft Sentinel integrates with Microsoft Graph Security API data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send threat indicators to Microsoft Sentinel from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MindMeld, MISP, or other integrated applications. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2223729&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelIndicators",
            "baseQuery": "ThreatIntelIndicators | where SourceSystem == \"SecurityGraph\""
        },
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelObjects",
            "baseQuery": "ThreatIntelObjects | where SourceSystem == \"SecurityGraph\""
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelIndicators\n| where ExpirationDateTime > now()\n| where SourceSystem == \"SecurityGraph\"\n| join (\n    SigninLogs\n) on $left.NetworkIP == $right.IPAddress\n| summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "CommonSecurityLog\n| where DestinationIP in\n((\n    ThreatIntelIndicators\n    | where ExpirationDateTime > now()\n    | where SourceSystem == \"SecurityGraph\"\n    | where ThreatType == \"DDoS\"\n    | project NetworkIP\n))\n| summarize count() by bin(TimeGenerated, 1d)​​"
        },
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelObjects\n| where ExpirationDateTime > now()\n| where SourceSystem == \"SecurityGraph\"\n| join (\n    SigninLogs\n) on $left.NetworkIP == $right.IPAddress\n| summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "CommonSecurityLog\n| where DestinationIP in\n((\n    ThreatIntelObjects\n    | where ExpirationDateTime > now()\n    | where SourceSystem == \"SecurityGraph\"\n    | where ThreatType == \"DDoS\"\n    | project NetworkIP\n))\n| summarize count() by bin(TimeGenerated, 1d)​​"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "ThreatIntelligence"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelIndicators",
            "lastDataReceivedQuery": "ThreatIntelIndicators | where SourceSystem == \"SecurityGraph\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ThreatIntelObjects",
            "lastDataReceivedQuery": "ThreatIntelObjects | where SourceSystem == \"SecurityGraph\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": true,
        "featureFlag": {
            "feature": "TIConnector",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ]
    },
    "instructionSteps": [
        {
            "title": "You can connect your threat intelligence data sources to Microsoft Sentinel by either:",
            "description": "- Using an integrated Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MindMeld, MISP, and others.\n\n- Calling the Microsoft Graph Security API directly from another application."
        },
        {
            "title": "Follow These Steps to Connect your Threat Intelligence:",
            "description": "1) [Register an application](https://docs.microsoft.com/graph/auth-v2-service#1-register-your-app) in Azure Active Directory.\n\n2) [Configure permissions](https://docs.microsoft.com/graph/auth-v2-service#2-configure-permissions-for-microsoft-graph) and be sure to add the ThreatIndicators.ReadWrite.OwnedBy permission to the application.\n\n3) Ask your Azure AD tenant administrator to [grant consent](https://docs.microsoft.com/graph/auth-v2-service#3-get-administrator-consent) to the application.\n\n4) Configure your TIP or other integrated application to push indicators to Microsoft Sentinel by specifying the following:\n\n    a. The application ID and secret you received when registering the app (step 1 above). \n\n    b. Set “Microsoft Sentinel” as the target.\n\n    c. Set an action for each indicator - ‘alert’ is most relevant for Microsoft Sentinel use cases \n\nFor the latest list of integrated Threat Intelligence Platforms and detailed configuration instructions, see the [full documentation](https://docs.microsoft.com/azure/sentinel/import-threat-intelligence#adding-threat-indicators-to-azure-sentinel-with-the-threat-intelligence-platforms-data-connector).\n\nClick on \"Connect\" below\n\n> Data from all regions will be sent to and stored in the workspace's region.",
            "instructions": [
                {
                    "parameters": {},
                    "type": "ThreatIntelligence"
                }
            ]
        }
    ]
}