Lumen Defender Threat Feed

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Attribute	Value
Publisher	Lumen Technologies, Inc.
Support Tier	Partner
Support Link	https://www.lumen.com/en-us/contact-us/support.html
Categories	domains
Version	3.2.0
Author	Matthew Collier - matthew.collier@lumen.com
First Published	2025-09-12
Last Updated	2026-02-04
Solution Folder	Lumen Defender Threat Feed

The Lumen Defender Threat Feed for Microsoft Sentinel solution delivers high-confidence threat intelligence indicators of compromise directly into your Sentinel workspace.

Data Connectors
Tables Used
Content Items
Additional Documentation

Data Connectors

This solution provides 2 data connector(s):

Tables Used

This solution uses 22 table(s):

Table	Used By Connectors	Used By Content
`AADManagedIdentitySignInLogs`	-	Analytics
`AADNonInteractiveUserSignInLogs`	-	Analytics
`AADServicePrincipalSignInLogs`	-	Analytics
`ADFSSignInLogs`	-	Analytics
`ASimAuthenticationEventLogs`	-	Workbooks
`ASimDnsActivityLogs`	-	Workbooks
`ASimFileEventLogs`	-	Workbooks
`ASimNetworkSessionLogs`	-	Workbooks
`ASimProcessEventLogs`	-	Workbooks
`ASimWebSessionLogs`	-	Workbooks
`AuditLogs`	-	Workbooks
`AzureActivity`	-	Workbooks
`CommonSecurityLog`	-	Analytics, Hunting, Workbooks
`DeviceEvents`	-	Analytics
`DeviceFileEvents`	-	Workbooks
`DeviceNetworkEvents`	-	Workbooks
`DeviceProcessEvents`	-	Workbooks
`DnsEvents`	-	Analytics, Workbooks
`OfficeActivity`	-	Analytics, Workbooks
`SecurityEvent`	-	Analytics
`SigninLogs`	-	Analytics, Workbooks
`WindowsEvent`	-	Analytics

Internal Tables

The following 3 table(s) are used internally by this solution's content items:

Table	Used By Connectors	Used By Content
`SecurityAlert`	-	Workbooks
`SecurityIncident`	-	Workbooks
`ThreatIntelIndicators`	Lumen Defender Threat Feed Data Connector V2, Lumen Defender Threat Feed Data Connector V2 (using Azure Functions Flex Consumption Plan with Private Networking)	Analytics, Hunting, Workbooks

Content Items

This solution includes 10 content item(s):

Content Type	Count
Analytic Rules	8
Hunting Queries	1
Workbooks	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Lumen TI IPAddress in CommonSecurityLog	Medium	CommandAndControl	`CommonSecurityLog` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in DeviceEvents	Medium	CommandAndControl	`DeviceEvents` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in IdentityLogonEvents	Medium	CommandAndControl	`AADManagedIdentitySignInLogs` `AADNonInteractiveUserSignInLogs` `AADServicePrincipalSignInLogs` `ADFSSignInLogs` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in OfficeActivity	Medium	CommandAndControl	`OfficeActivity` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in SecurityEvents	Medium	CommandAndControl	`SecurityEvent` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in SigninLogs	Medium	CommandAndControl	`SigninLogs` Internal use: `ThreatIntelIndicators`
Lumen TI IPAddress in WindowsEvents	Medium	CommandAndControl	`WindowsEvent` Internal use: `ThreatIntelIndicators`
Lumen TI domain in DnsEvents	Medium	CommandAndControl	`DnsEvents` Internal use: `ThreatIntelIndicators`

Hunting Queries

Name	Tactics	Tables Used
Lumen TI IPAddress indicator in CommonSecurityLog	CommandAndControl	`CommonSecurityLog` Internal use: `ThreatIntelIndicators`

Workbooks

Name	Tables Used
Lumen-Threat-Feed-Overview	`ASimAuthenticationEventLogs` `ASimDnsActivityLogs` `ASimFileEventLogs` `ASimNetworkSessionLogs` `ASimProcessEventLogs` `ASimWebSessionLogs` `AuditLogs` `AzureActivity` `CommonSecurityLog` `DeviceFileEvents` `DeviceNetworkEvents` `DeviceProcessEvents` `DnsEvents` `OfficeActivity` `SigninLogs` Internal use: `SecurityAlert` `SecurityIncident` `ThreatIntelIndicators`

Additional Documentation

📄 Source: Lumen Defender Threat Feed/README.md

Lumen Defender Threat Feed for Microsoft Sentinel

Within a SIEM like Microsoft Sentinel, threat indicators (IoCs) help correlate known-bad artifacts—such as IPs, domains, URLs, and file hashes—with activity in your environment. Lumen’s Black Lotus Labs® (BLL) harnesses unmatched network visibility and machine intelligence to produce high-confidence indicators that can be operationalized at scale for detection and investigation.

Learn more:

Black Lotus Labs overview: https://www.lumen.com/en-us/security/black-lotus-labs.html
BLL blog archive: https://blog.lumen.com/black-lotus-labs/
BLL on X/Twitter: https://twitter.com/blacklotuslabs

Key features

Lumen Defender Threat Feed for Microsoft Sentinel offers powerful intelligence capabilities designed for security operations: