skills.rest
jay-steenbergen
jay-steenbergenCOMMUNITY
Explore all skills by this author →
GitHub

cso-threat-intel-integration

Integrates threat intelligence feeds, Watchlists, and analytics rules in Microsoft Sentinel.

2|Updated Jun 1, 2026
Search Tags:#threat intelligence#sentinel#watchlist#soc#kql#taxii#analytics rule
One-click install
npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-threat-intel-integration-jay-steenbergen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cso-threat-intel-integration
Source: https://github.com/jay-steenbergen/MSSAMentorAgent/tree/main/.github/skills/tracks/cybersecurity-ops/cso-threat-intel-integration
Command: npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill cso-threat-intel-integration-jay-steenbergen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security learners and SOC analysts often struggle to connect external threat intelligence to real endpoint telemetry. This Skill walks a learner through the full threat intelligence loop in Microsoft Sentinel: ingesting indicators, building a custom IOC Watchlist, and writing an analytics rule that fires when endpoints contact known-bad infrastructure. ## Core Features & Use Cases - TI Connector Setup: Enable the Microsoft Defender Threat Intelligence connector or a free TAXII feed (e.g., Anomali Limo) so indicators land in the ThreatIntelligenceIndicator table. - Manual Indicators & Watchlists: Add STIX indicators by hand and upload a CSV-based Watchlist queryable via _GetWatchlist(). - IOC Matching Analytics Rule: Write a KQL scheduled rule that unions TI indicators with Watchlist entries and joins them against DeviceNetworkEvents to generate incidents. - Use Case: A cybersecurity student triggers a test connection from an MDE-onboarded VM to a lab indicator IP, then watches a Sentinel incident appear with Host, IP, and Account entities populated. ## Quick Start Ask the Mentor to start the threat intelligence integration project and walk you through connecting a TAXII feed, creating a Watchlist, and building an IOC matching rule in Sentinel.

Frequently Asked Questions about cso-threat-intel-integration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect a threat intelligence feed to Microsoft Sentinel?▼

Use the Threat Intelligence - TAXII data connector in Sentinel under Configuration > Data connectors. Provide the feed's API root URL, collection ID, and credentials, then verify ingestion by querying the ThreatIntelligenceIndicator table after the first hourly poll.

How do I create a Watchlist in Microsoft Sentinel?▼

Go to Sentinel > Configuration > Watchlist, choose New > Local file, and upload a CSV with a designated SearchKey column. Query it in KQL with _GetWatchlist('YourAlias') and join it against telemetry tables like DeviceNetworkEvents.

How do I write a Sentinel analytics rule that matches IOCs against network traffic?▼

Build a KQL query that unions ThreatIntelligenceIndicator rows with Watchlist entries, then inner joins on DeviceNetworkEvents where RemoteIP matches an indicator IP. Wrap it in a scheduled query rule with entity mappings for Host, IP, and Account.

Why is my TAXII connector connected but no indicators appear in Sentinel?▼

TAXII feeds poll on an hourly interval, so indicators may take 30-60 minutes to appear. Also verify the feed credentials are current, the collection ID is correct, and the feed has published recent updates.

What is the difference between a Sentinel Watchlist and a threat intelligence feed?▼

A Watchlist is a manually maintained CSV lookup table for internal high-confidence IOCs, queried via _GetWatchlist(). A TI feed streams STIX indicators from external providers into the ThreatIntelligenceIndicator table automatically. Analytics rules can union both sources.

Can I test a Sentinel IOC matching rule without contacting real malicious IPs?▼

Yes. Add a manual indicator for a safe documentation IP such as 93.184.216.34 (example.com), then run Invoke-WebRequest against it from an MDE-onboarded VM. The rule fires on the match without any real malicious contact.

Related Skills

Explore More Education & Research Skills→
NCLGISANCLGISA

microsoft-defender

Manage Microsoft Defender XDR, Endpoint, and Sentinel security operations.

Official
Advanced
dandyedandye
85

compromised-user-account-response

Guides containment, eradication, and recovery workflows for confirmed compromised user accounts.

Community
Advanced
xalgordxalgord
954

detecting-mimikatz-execution-patterns

Detect Mimikatz credential dumping via LSASS access, command-line, and in-memory indicators.

Community
Intermediate
xalgordxalgord
954

processing-stix-taxii-feeds

Parses and validates STIX 2.1 bundles from TAXII 2.1 servers for threat intelligence pipelines.

Community
Advanced