Question

A global manufacturing company is designing its security operations capability based on the Microsoft Cybersecurity Reference Architectures (MCRA). The CISO wants the SOC to consume curated threat intelligence that automatically enriches detections and enables proactive hunting across email, endpoints, identities, and cloud apps. The architecture must minimize custom integration effort and use Microsoft's native, vendor-provided intelligence feeds. Which design approach best aligns with the MCRA for integrating threat intelligence into security operations?

Accepted Answer

Deploy Microsoft Defender Threat Intelligence (MDTI) and integrate it with Microsoft Sentinel and Defender XDR so native detections and hunting are enriched with Microsoft-curated intelligence

Answer

Build a custom threat intelligence platform on Azure VMs that ingests open-source STIX/TAXII feeds and forwards indicators to each product via bespoke scripts

Answer

Rely solely on Network Security Groups and Azure Firewall threat intelligence-based filtering to block malicious IPs at the network layer

Answer

Export all raw logs to a third-party SIEM and purchase a separate commercial threat feed to correlate indicators outside the Microsoft ecosystem