QuestionQ89

VerifiedProactive Threat Detection

Global Security Firm, a multinational cybersecurity company, wants to strengthen its threat intelligence capabilities by integrating real-time threat feeds into its Microsoft Sentinel SIEM. These threat intelligence feeds provide valuable information about malicious IPs, domains, file hashes, and attack patterns, helping the SOC team proactively detect and respond to security threats.

The firm requires a standardized protocol that enables automated threat intelligence sharing, ensuring its Microsoft Sentinel environment continuously receives updated threat indicators from external intelligence sources. The ideal data connector should support a structured format for efficiently importing and managing threat intelligence feeds. Which Microsoft Sentinel data connector should Global Security Firm implement to integrate threat intelligence feeds by using an industry-standard protocol?

Explanation

The Threat Intelligence - TAXII data connector is designed to import threat indicators from TAXII 2.0 and 2.1 servers into Microsoft Sentinel. TAXII, used with the STIX structured threat-intelligence format, is a widely adopted industry standard for exchanging indicators such as IP addresses, domains, URLs, and file hashes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!