{
    "id": "PremiumMicrosoftDefenderForThreatIntelligence",
    "title": "Premium Microsoft Defender Threat Intelligence",
    "publisher": "Microsoft",
    "logo": {
        "type": 258,
        "options": null
    },
    "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Premium Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc. Note: This is a paid connector. To use and ingest data from it, please purchase the \"MDTI API Access\" SKU from the Partner Center.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "ThreatIntelligenceIndicator",
            "baseQuery": "ThreatIntelligenceIndicator\n                      | where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\""
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by threat type",
            "query": "ThreatIntelligenceIndicator\n| where ExpirationDateTime > now()\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where ExpirationDateTime > now()\n| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "ThreatIntelligenceIndicator\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where TimeGenerated >= ago(1d) | summarize count()​​"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "PremiumMicrosoftDefenderForThreatIntelligence"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelligenceIndicator",
            "lastDataReceivedQuery": "ThreatIntelligenceIndicator \n                | where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "premiummdticonnector",
            "featureStates": {
                "1": 3,
                "2": 3,
                "3": 3,
                "4": 3,
                "5": 3,
                "6": 0,
                "7": 1,
                "8": 1
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Use this data connector to import Indicators of Compromise (IOCs) from Premium Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel."
        },
        {
            "instructions": [
                {
                    "type": "PremiumMicrosoftDefenderForThreatIntelligence",
                    "parameters": {
                        "connectorKind": "PremiumMicrosoftDefenderForThreatIntelligence"
                    }
                }
            ]
        }
    ]
}