Lumen Defender Threat Feed Data Connector V2 (using Azure Functions Flex Consumption Plan with Private Networking)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

Attribute Value
Connector ID LumenThreatFeedConnectorV2PrivateNetworking
Publisher Lumen Technologies, Inc.
Used in Solutions Lumen Defender Threat Feed
Collection Method Azure Function (TI Upload API)
Connector Definition Files LumenThreatFeedConnectorV2_PrivateNetworking_ConnectorUI.json
Ingestion API STIX 2.1 Upload Indicators API — Connector code references STIX 2.1 Upload Indicators API endpoint (matched 'api.ti.sentinel.azure.com')

The Lumen Defender Threat Feed connector provides the capability to ingest STIX-formatted threat intelligence indicators from Lumen's Black Lotus Labs research team into Microsoft Sentinel. The connector automatically downloads and uploads threat intelligence indicators including IPv4 addresses and domains to the ThreatIntelIndicators table via the STIX Objects Upload API.

NOTE: This data connector uses the Azure Functions Flex Consumption Plan with VNet integration for secure, private network access to storage resources. More pricing details are here.

Tables Ingested

This connector ingests data into the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
ThreatIntelIndicators ObservableKey in "domain-name:value,ipv4-addr:value"
SourceSystem == "Lumen"		 ✓ ✓ ✗
ThreatIntelObjects ✓ ✓ ?

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Custom Permissions:

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

NOTE: This connector uses Azure Functions with the Flex Consumption Plan to connect to the Lumen Defender Threat Feed API and upload threat intelligence indicators to Microsoft Sentinel via the STIX Objects API. The Flex Consumption Plan enables VNet integration for secure, private network access to storage resources. This might result in additional data ingestion and compute costs. Check the Azure Functions pricing page for details.

(Optional Step) Securely store API keys and secrets in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. Follow these instructions to use Azure Key Vault with an Azure Functions App.

1. Configuration

STEP 1 - Network Prerequisites for Private Access

IMPORTANT: When deploying with private storage account access, you need a Virtual Network with two properly configured subnets. You can either use an existing VNet or deploy one using the template below.

Option A: Deploy a New Virtual Network (Recommended for new deployments)

Use this template to create a properly configured VNet with two subnets:

Deploy VNet to Azure

After deployment, note the following output values for use in STEP 5:

Option B: Use an Existing Virtual Network

If using an existing VNet, ensure the following requirements are met:

Note: The connector deployment will automatically create private endpoints for storage services (blob, queue, table, file) and configure Private DNS zones.

STEP 2 - Obtain Lumen Defender Threat Feed API Key

  1. Contact Lumen to obtain API access to our Threat Feed API service
  2. Obtain your API key for authentication.

STEP 3 - Configure Azure Entra ID Application and gather information

  1. Create a new Entra app registration from the App registrations tab in the Entra ID section of the Azure portal. See the documentation for a guide to registering an application in Microsoft Entra ID.
  2. Create a client secret and note the Application ID, Tenant ID, and Client Secret
  3. Assign the Microsoft Sentinel Contributor role to the newly registered application in the Access control (IAM) menu of your Microsoft Sentinel Log Analytics Workspace
  4. Make note of your Workspace ID, which can be obtained from the overview page of the Log Analytics Workspace for your Microsoft Sentinel instance.

STEP 4 - Enable the **Threat Intelligence Upload Indicators API (Preview) data connector in Microsoft Sentinel**

  1. Deploy the Threat Intelligence (New) Solution, which includes the Threat Intelligence Upload Indicators API (Preview)
  2. Browse to the Content Hub, find and select the Threat Intelligence (NEW) solution.
  3. Select the Install/Update button.

STEP 5 - Deploy the Azure Function with Private Networking

IMPORTANT: Before deploying the Lumen Defender Threat Feed connector, have the following information readily available:

  1. Click the Deploy to Azure button.

Deploy To Azure

  1. Fill in the appropriate values for each parameter:

Basic Settings:

Lumen API Settings:

Azure Entra ID Settings:

Private Networking Settings:

Note: Ensure the Function App subnet is delegated to Microsoft.App/environments before deployment. The deployment will create private endpoints for storage account services and configure Private DNS zones automatically.

STEP 6 - Verify Deployment

  1. The connector polls for indicator updates every 15 minutes.
  2. Verify that the Function App is properly integrated with the Virtual Network by checking the Networking settings in the Azure Portal
  3. Confirm that private endpoints were created for the storage account services (blob, file, queue, table)
  4. After the app performs its first run, review the indicators ingested by either viewing the "Lumen Defender Threat Feed Overview" workbook or viewing the "Threat Intelligence" section in Microsoft Sentinel. In Microsoft Sentinel "Threat Intelligence", filter for source "Lumen" to display only Lumen generated indicators.

Troubleshooting Private Networking Issues

If the Function App is not receiving data after deployment:

  1. Check VNet Integration: Navigate to Function App → Networking → VNet integration and verify the Function App subnet is connected
  2. Verify Private Endpoints: Navigate to the storage account → Networking → Private endpoint connections and verify all endpoints are in "Approved" state
  3. Check DNS Resolution: Ensure private DNS zones are properly linked to the VNet for storage account resolution
  4. Review Function Logs: Check Application Insights or Function App logs for connection errors
  5. Subnet Delegation: Confirm the Function App subnet is delegated to Microsoft.App/environments (required for Flex Consumption Plan)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index