Use STIX/TAXII to import and export threat intelligence in Microsoft Sentinel

The STIX data format and the TAXII protocol are the most widely adopted industry standards for transmitting threat intelligence. Microsoft Sentinel supports integration with threat intelligence platforms using the standards, and provides built-in connectors for importing and exporting threat intelligence.

Use the Threat Intelligence – TAXII data connector to import threat indicators from TAXII 2.0 or 2.1 servers into your Sentinel workspace. To share threat intelligence externally, configure the Threat Intelligence – TAXII Export connector, which enables secure, standards-based export to supported TAXII 2.1 platforms.

This article walks you through both processes - connecting to STIX/TAXII feeds for import and configuring export to TAXII servers.

Learn more about threat intelligence in Microsoft Sentinel, and specifically about the TAXII threat intelligence feeds that you can integrate with Microsoft Sentinel.

For more information, see Connect your threat intelligence platform (TIP) to Microsoft Sentinel.

Prerequisites

• To install, update, and delete standalone content or solutions in the Content hub, you need the Microsoft Sentinel Contributor role at the resource group level.
• You must have a TAXII 2.0 or TAXII 2.1 API root URI and collection ID.

Get the TAXII server API root and collection ID

TAXII 2.x servers advertise API roots, which are URLs that host collections of threat intelligence. You can usually find the API root and the collection ID in the documentation pages of the threat intelligence provider that hosts the TAXII server.

Install the Threat Intelligence solution in Microsoft Sentinel

To import threat indicators into Microsoft Sentinel from a TAXII server or export threat indicators from Microsoft Sentinel, install the Threat Intelligence solution:

1. For Microsoft Sentinel in the Azure portal, under Content management, select Content hub.

   For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Content hub.

2. Find and select the Threat Intelligence solution.

3. Select the Install/Update button.

For more information about how to manage the solution components, see Discover and deploy out-of-the-box content.

Enable the Threat Intelligence - TAXII data connector

To configure the TAXII data connector:

1. Select the Data connectors menu.

2. Find and select the Threat Intelligence - TAXII data connector, and then select Open connector page.

   

3. Enter a name for this TAXII server collection in the Friendly name text box. Fill in the text boxes for API root URL, Collection ID, Username (if necessary), and Password (if necessary). Choose the group of indicators and the polling frequency you want. Select Add.

   

You should receive confirmation that a connection to the TAXII server was established successfully. Repeat the last step as many times as you want to connect to multiple collections from one or more TAXII servers.

Within a few minutes, threat indicators should begin flowing into this Microsoft Sentinel workspace. Find the new indicators on the Threat intelligence pane. You can access it from the Microsoft Sentinel menu.

IP allowlisting for the Microsoft Sentinel TAXII client

Some TAXII servers, like FS-ISAC, have a requirement to keep the IP addresses of the Microsoft Sentinel TAXII client on the allowlist. Most TAXII servers don't have this requirement.

When relevant, the following IP addresses are the addresses to include in your allowlist:

Enable the Threat intelligence - TAXII Export data connector

To configure the TAXII data connector:

1. Make sure you have the latest version of the Threat Intelligence solution in Microsoft Sentinel. For more information, see Install the Threat Intelligence solution in Microsoft Sentinel.

2. Select the Data connectors menu.

3. Select the Threat intelligence - TAXII Export data connector and then select Open connector page in the side pane.

   

4. In the Configuration area on the Threat intelligence - TAXII Export page:

   • Enter a name for this TAXII server collection in the Friendly name (for server) text box.
   • Fill in the textboxes for API root URL, Collection ID. For more information, see Get the TAXII server API root and collection ID.
   • Select an Basic authentication or API key from the Authentication type dropdown and provide the relevant authentication details.
   • Select Enable rules to apply the rules described on the connector page to all exported threat intelligence.

   For example:

   • Defender portal
   • Azure portal

   

   Note

   Editing existing connectors is currently not supported. To change the configuration of a TAXII server or its rules, reinstall the connector.

5. Select Add to add your server.

IP allowlisting for the Threat Intelligence - TAXII Export connector

Add these IP addresses to your allowlist to ensure that your export operations don't get blocked:

Related content

In this article, you learned how to connect Microsoft Sentinel to threat intelligence feeds by using the TAXII protocol. To learn more about working with threat intelligence in Microsoft Sentinel, see the following articles:

• Work with Microsoft Sentinel threat intelligence