Threat intelligence - TAXII
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Connector ID | ThreatIntelligenceTaxii |
| Publisher | Microsoft |
| Used in Solutions | Threat Intelligence, Threat Intelligence (NEW) |
| Collection Method | Native |
| Connector Definition Files | template_ThreatIntelligenceTaxii.json |
Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send the supported STIX object types from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the Microsoft Sentinel documentation >.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
ThreatIntelIndicators |
✓ | ✓ | ? |
ThreatIntelObjects |
✓ | ✓ | ? |
ThreatIntelligenceIndicator |
✓ | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions: - Workspace (Workspace): read and write permissions.
Custom Permissions: - TAXII Server: TAXII 2.0 or TAXII 2.1 Server URI and Collection ID.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Configure TAXII servers to stream STIX 2.0 or 2.1 STIX objects to Microsoft Sentinel
You can connect your TAXII servers to Microsoft Sentinel using the built-in TAXII connector. For detailed configuration instructions, see the full documentation.
Enter the following information and select Add to configure your TAXII server.
📋 Additional Configuration Step: This connector includes a configuration step of type
ThreatIntelligenceTaxii. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊