MISP2Sentinel
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | MISP2SentinelConnector |
| Publisher | MISP project & cudeso.be |
| Used in Solutions | MISP2Sentinel |
| Collection Method | Azure Function (TI Upload API) |
| Connector Definition Files | MISP2SentinelConnector_UploadIndicatorsAPI.json |
| Ingestion API | STIX 2.1 Upload Indicators API — Connector definition filename suffix '_UploadIndicatorsAPI' indicates STIX 2.1 Upload Indicators API |
| Microsoft Learn | View on Learn |
This solution installs the MISP2Sentinel connector that allows you to automatically push threat indicators from MISP to Microsoft Sentinel via the Upload Indicators REST API. After installing the solution, configure and enable this data connector by following guidance in Manage solution view.
Tables Ingested
This connector ingests data into the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
ThreatIntelIndicators |
SourceSystem == "MISP" |
✓ | ✓ | ✗ |
ThreatIntelObjects |
✓ | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): read and write permissions are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Installation and setup instructions
Use the documentation from this GitHub repository to install and configure the MISP to Microsoft Sentinel connector:
https://github.com/cudeso/misp2sentinel
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊