{
  "Name": "Threat Intelligence (NEW)",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\" height=\"75px\">",
  "Description": "Microsoft Sentinel has recently improved its threat intelligence hunting experience by incorporating support for STIX objects like Threat Actor, Attack Pattern, Identity, and Relationship. As a result, we have updated our TI Solutions to leverage the new ThreatIntelIndicator table.\n[Work with STIX objects and indicators to enhance threat intelligence and threat hunting in Microsoft Sentinel (Preview) - Microsoft Sentinel | Microsoft Learn](https://learn.microsoft.com/azure/sentinel/work-with-stix-objects-indicators).\n\n The Threat Intelligence solution contains data connectors for import of supported STIX objects into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.",
  "Data Connectors": [
    "Data Connectors/template_ThreatIntelligenceTaxii.json",
    "Data Connectors/template_ThreatIntelligence.json",
    "Data Connectors/template_ThreatIntelligenceUploadIndicators.json",
    "Data Connectors/template_MicrosoftDefenderThreatIntelligence.json",
    "Data Connectors/template_ThreatIntelligenceTaxiiExport.json"
  ],
  "Workbooks": ["Workbooks/ThreatIntelligenceNew.json"],
  "Analytic Rules": [
    "Analytic Rules/DomainEntity_CloudAppEvents_Updated.yaml",
    "Analytic Rules/DomainEntity_CommonSecurityLog.yaml",
    "Analytic Rules/DomainEntity_DeviceNetworkEvents_Updated.yaml",
    "Analytic Rules/DomainEntity_DnsEvents.yaml",
    "Analytic Rules/DomainEntity_EmailEvents_Updated.yaml",
    "Analytic Rules/DomainEntity_EmailUrlInfo_Updated.yaml",
    "Analytic Rules/DomainEntity_PaloAlto.yaml",
    "Analytic Rules/DomainEntity_Syslog.yaml",
    "Analytic Rules/DomainEntity_SecurityAlert.yaml",
    "Analytic Rules/DomainEntity_imWebSession.yaml",
    "Analytic Rules/EmailEntity_AzureActivity.yaml",
    "Analytic Rules/EmailEntity_CloudAppEvents_Updated.yaml",
    "Analytic Rules/EmailEntity_EmailEvents_Updated.yaml",
    "Analytic Rules/EmailEntity_OfficeActivity.yaml",
    "Analytic Rules/EmailEntity_PaloAlto.yaml",
    "Analytic Rules/EmailEntity_SecurityAlert.yaml",
    "Analytic Rules/EmailEntity_SecurityEvent.yaml",
    "Analytic Rules/EmailEntity_SigninLogs.yaml",
    "Analytic Rules/FileHashEntity_CommonSecurityLog.yaml",
    "Analytic Rules/FileHashEntity_DeviceFileEvents_Updated.yaml",
    "Analytic Rules/FileHashEntity_SecurityEvent.yaml",
    "Analytic Rules/IPEntity_AWSCloudTrail.yaml",
    "Analytic Rules/IPEntity_AppServiceHTTPLogs.yaml",
    "Analytic Rules/IPEntity_AzureActivity.yaml",
    "Analytic Rules/IPEntity_AzureFirewall.yaml",
    "Analytic Rules/IPEntity_AzureKeyVault.yaml",
    "Analytic Rules/IPEntity_AzureNetworkAnalytics.yaml",
    "Analytic Rules/IPEntity_AzureSQL.yaml",
    "Analytic Rules/IPEntity_CloudAppEvents_Updated.yaml",
    "Analytic Rules/IPEntity_CustomSecurityLog.yaml",
    "Analytic Rules/IPEntity_DeviceNetworkEvents_Updated.yaml",
    "Analytic Rules/IPEntity_DnsEvents.yaml",
    "Analytic Rules/IPEntity_DuoSecurity.yaml",
    "Analytic Rules/IPEntity_OfficeActivity.yaml",
    "Analytic Rules/IPEntity_SigninLogs_Updated.yaml",
    "Analytic Rules/IPEntity_W3CIISLog.yaml",
    "Analytic Rules/IPEntity_VMConnection.yaml",
    "Analytic Rules/IPEntity_Workday_Updated.yaml",
    "Analytic Rules/IPEntity_imNetworkSession.yaml",
    "Analytic Rules/IPEntity_imWebSession.yaml",
    "Analytic Rules/Threat Intel Matches to GitHub Audit Logs.yaml",
    "Analytic Rules/URLEntity_AuditLogs.yaml",
    "Analytic Rules/URLEntity_CloudAppEvents_Updated.yaml",
    "Analytic Rules/URLEntity_DeviceNetworkEvents_Updated.yaml",
    "Analytic Rules/URLEntity_EmailUrlInfo_Updated.yaml",
    "Analytic Rules/URLEntity_PaloAlto.yaml",
    "Analytic Rules/URLEntity_SecurityAlerts.yaml",
    "Analytic Rules/URLEntity_Syslog.yaml",
    "Analytic Rules/URLEntity_UrlClickEvents_Updated.yaml",
    "Analytic Rules/imDns_DomainEntity_DnsEvents.yaml",
    "Analytic Rules/imDns_IPEntity_DnsEvents.yaml",
    "Analytic Rules/URLEntity_imWebSession.yaml"
  ],
  "Parsers": ["Parsers/ThreatIntelIndicatorsv2.yaml"],
  "Hunting Queries": [
    "Hunting Queries/FileEntity_OfficeActivity.yaml",
    "Hunting Queries/FileEntity_SecurityEvent.yaml",
    "Hunting Queries/FileEntity_Syslog.yaml",
    "Hunting Queries/FileEntity_VMConnection.yaml",
    "Hunting Queries/FileEntity_WireData.yaml"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Threat Intelligence (NEW)\\",
  "Version": "3.0.21",
  "TemplateSpec": false,
  "StaticDataConnectorIds": [
    "ThreatIntelligenceTaxii",
    "ThreatIntelligence",
    "MicrosoftDefenderThreatIntelligence",
    "PremiumMicrosoftDefenderForThreatIntelligence"
  ]
}