Question

Your SOC receives threat indicators from two sources. A commercial vendor exposes a TAXII 2.1 server that continuously publishes STIX 2.1 collections, and an internal threat team produces small daily batches of custom indicators from a proprietary script. You must ingest both into Microsoft Sentinel with the least ongoing maintenance and without deploying additional infrastructure. Which approach should you configure?

Accepted Answer

Use the Threat Intelligence – TAXII data connector for the vendor feed and the Threat Intelligence Upload Indicators API for the internal script's batches.

Answer

Deploy a Logic App playbook to poll the vendor TAXII server hourly and write to a custom table, and use the same playbook to import the internal indicators.

Answer

Use the Threat Intelligence Platforms (Graph Security API) connector for both the vendor TAXII feed and the internal indicators.

Answer

Configure the Threat Intelligence – TAXII connector for both sources by pointing it at the vendor server and at a locally hosted TAXII server that republishes the internal indicators.