Premium Microsoft Defender Threat Intelligence (Preview) connector for Microsoft Sentinel

Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc. Note: This is a paid connector. To use and ingest data from it, please purchase the "MDTI API Access" SKU from the Partner Center.

This is autogenerated content. For changes, contact the solution provider.

Connector attributes

Connector attribute	Description
Log Analytics table(s)	ThreatIntelligenceIndicator
Data collection rules support	Not currently supported
Supported by	Microsoft Corporation

Query samples

Summarize by threat type

ThreatIntelligenceIndicator

| where ExpirationDateTime > now()

| where SourceSystem == "Premium Microsoft Defender Threat Intelligence"

| where ExpirationDateTime > now()

| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress 
| summarize count() by ThreatType

Summarize by 1 hour bins

ThreatIntelligenceIndicator

| where SourceSystem == "Premium Microsoft Defender Threat Intelligence"

| where TimeGenerated >= ago(1d) 
| summarize count()​​

Vendor installation instructions

Use this data connector to import Indicators of Compromise (IOCs) from Premium Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel.

Next steps

For more information, go to the related solution in the Azure Marketplace.