[Deprecated] Intel 471 Malware Intelligence to Graph Security

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This playbook ingests malware indicators from Intel 471's Titan API into Microsoft Graph Security as tiIndicator resource type.

Attribute	Value
Type	Playbook
Solution	Intel471
Source	View on GitHub

Additional Documentation

📄 Source: Intel471-ImportMalwareIntelligenceToGraphSecurity/readme.md

Intel 471 Malware Intelligence import to Microsoft Graph Security

Table of contents

1. Overview
2. Prerequisites
3. Deployment instructions
4. Post-deployment instructions
5. Querying Intel 471 Malware Intelligence data in Sentinel
6. Data mapping
7. Script for granting ThreatIndicators.ReadWrite.OwnedBy role

Overview

This playbook fetches malware intelligence indicators from the Intel 471's Titan API and ingests them as tiIndicators through Microsoft Graph Security tiIndicators API to make them available in Microsoft Sentinel and other Microsoft security solutions such as Defender ATP.

Data connector used in this playbook is on a path for deprecation. For new solutions use the new threat intelligence upload indicators API data connector, which is used in Intel471-ImportMalwareIntelligenceToSentinel playbook. For more information, see Connect your threat intelligence platform to Microsoft Sentinel with the upload indicators API.

azuredeploy.json Azure Resource Manager template (ARM template) is responsible for building the Logic App along with the necessary connections. The ARM builds following components:

• Logic App responsible for fetching the data from Titan API and ingesting them into ThreatIntelligenceIndicator table
• Connection objects
• Logic app to Blob storage (authorized automatically)
• Logic app to Key Vault (requires manual configuration)
• Logic app to Microsoft Security Graph (requires manual configuration)

Prerequisites

1. An active account in Titan platform, which is available as part of Intel 471's subscriptions. For more information, please contact sales@intel471.com.
2. Titan API credentials.
3. Pre-existing Key Vault for securely storing Titan API credentials. Store Titan API credentials as secrets under TitanUserNameGraph and TitanAPIKeyGraph keys.
4. Pre-existing Blob storage with blob container for persisting data such as cursor between the API calls.
5. Threat Intelligence connector enabled in Sentinel. Go to Sentinel instance → Content hub and install Threat Intelligence solution.

Deployment instructions

1. To deploy the Playbook, click the Deploy to Azure button. It will launch the ARM Template deployment wizard.

2. Provide following parameters:

   • Playbook Name: Either leave the default one or change it as needed
   • StorageAccountName: Name of the Storage account (see prerequisites)
   • StorageAccountContainerName: Name of the blob container in the Storage account
   • KeyVaultName: Name of the Key Vault (see prerequisites)
   • Target Product: Security product to which the indicators will be applied. Allowed values: Azure Sentinel, Microsoft Defender ATP
   • Action: The action to apply if the indicator is matched from within the targetProduct security tool. Allowed values: unknown, allow, block, alert
   • Look Back Days: How many days of history should be pulled on the first run. Leave 0 to start from the current time

   

Post-deployment instructions

1. Go to the Key Vault. Select Access control (IAM) → + Add → Add role assignment. Choose Key Vault Secrets User. On the next screen hit + Select members, search for Intel 471 and select newly created logic app. Select it and proceed with granting access rights.

[Content truncated...]

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Playbooks · Back to Intel471