MDTI-Data-Trackers

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This logic app automatically retrieves and enriches incident indicators generated by Microsoft Sentinel by leveraging data from the MDTI tracker endpoint.

Attribute	Value
Type	Playbook
Solution	Microsoft Defender Threat Intelligence
Source	View on GitHub

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azuresentinel	Managed	1	4
http	Built-in	0	2

Action parameters (URLs, paths, function IDs)

azuresentinel (Managed)

Action	Method	Endpoint	Other
Entities_-_Get_Hosts	post	/entities/host	—
Entities_-_Get_IPs	post	/entities/ip	—
Add_comment_to_incident_(V3)_4	post	/Incidents/Comment	—
Add_comment_to_incident_(V3)	post	/Incidents/Comment	—

http (Built-in)

Action	Method	Endpoint	Other
Trackers_for_Hostname	GET	@{parameters('MDTI-BaseUrl')}/@{parameters('Api-Version')}/security/threatIntelligence/hosts('@{items('For_each_Host')?['HostName']}.@{items('For_each_Host')?['DnsDomain']}')/trackers?$count=true	—
Trackers_for_IP_Address	GET	@{parameters('MDTI-BaseUrl')}/@{parameters('Api-Version')}/security/threatIntelligence/hosts('@{items('For_each_IP_Address')?['Address']}')/trackers?$count=true	—

Additional Documentation

📄 Source: MDTI-Trackers/readme.md

Overview

This playbook uses the Microsoft Defender Threat Intelligence Trackers data to automatically enrich incidents generated by Microsoft Sentinel. Leverage this playbook to enrich your incidents with Trackers data hosted by the indicators found within the incident. Trackers are unique codes or values found within web pages and often used to track user interaction. These codes can be used to correlate a disparate group of websites to a central entity. Often, actors will copy the source code of a victim’s website they are looking to impersonate for a phishing campaign. Seldomly will actors take the time to remove these IDs that allow users to identify these fraudulent sites using Microsoft’s Trackers data set. Actors may also deploy tracker IDs to see how successful their cyber-attack campaigns are. This is similar to marketers when they leverage SEO IDs, such as a Google Analytics Tracker ID, to track the success of their marketing campaign.

Key Capabilities

• Automatically triggers on new Sentinel incidents (incident creation trigger).
• Collects Host and IP entities (up to the limits of the incident payload).
• Queries MDTI Trackers data via Microsoft Graph (Managed Identity auth).
• Generates per-host and per-IP HTML tables summarizing Trackers observations.
• Adds structured comments back to the originating incident.

Prerequisites

1. Microsoft Defender Threat Intelligence (MDTI) Premium license enabled for the tenant. If you have trouble accessing your account or your credentials, contact your account representative (mdtidiscussion[@]microsoft.com).
2. One of the following Azure AD roles (to grant Graph application permissions to the playbook's Managed Identity): Security Administrator, Global Administrator, or Privileged Role Administrator.

Deployment Parameters

Name	Description	Default
PlaybookName	Name of the Logic App (playbook)	MDTI-Data-Trackers
MDTI-BaseUrl	MDTI Graph API base URL (must start with https://)	https://graph.microsoft.com
Api-Version	MDTI Graph API version	v1.0

Deploy to Azure

Post-Deployment Steps

1. Assign Microsoft Graph Permission (ThreatIntelligence.Read.All) to Managed Identity

To allow the playbook to query Microsoft Defender Threat Intelligence data, you must grant the managed identity of the playbook the ThreatIntelligence.Read.All application permission in Microsoft Graph. Follow these steps:

1. Ensure you have the necessary Azure AD permissions (Security Administrator, Global Administrator, or Privileged Role Administrator).
2. Open the Azure Cloud Shell or use a local PowerShell session with the Microsoft Graph module installed.
3. Run the following commands, replacing 'MDTI-Data-Trackers' with your playbook's name if different:

# Install the Microsoft Graph module for interacting with Microsoft Graph APIs
Install-Module Microsoft.Graph -Scope CurrentUser -AllowClobber -Force
Import-Module Microsoft.Graph

# Authenticate to Microsoft Graph using Managed Identity
Connect-MgGraph -Identity

# Retrieve the Microsoft Graph Service Principal
$graphSp = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Graph'"

# Find the ThreatIntelligence.Read.All role
$role = $graphSp.AppRoles | Where-Object { $_.Value -eq 'ThreatIntelligence.Read.All' -and $_.AllowedMemberTypes -contains 'Application' }

# Define the Logic App name (update if different)
$logicAppName = 'MDTI-Data-Trackers'
$logicAppSp = Get-MgServicePrincipal -Filter "displayName eq '$logicAppName'"

# Assign the ThreatIntelligence.Read.All role to the Logic App's Managed Identity

*[Content truncated...]*

---

**Browse:** [🏠](../README.md) · [Solutions](../solutions-index.md) · [Connectors](../connectors-index.md) · [Methods](../methods-index.md) · [Tables](../tables-index.md) · [Content](../content/content-index.md) · [Parsers](../parsers/parsers-index.md) · [ASIM Parsers](../asim/asim-index.md) · [ASIM Products](../asim/asim-products-index.md) · [Logic Apps](../logic-apps/logic-apps-index.md) · [📊](../statistics.md)

↑ [Back to Playbooks](playbooks.md) · [Back to Microsoft Defender Threat Intelligence](../solutions/microsoft-defender-threat-intelligence.md)