Microsoft Sentinel App

The OpenCTI for Azure Sentinel solution is a deployable application within the Microsoft Sentinel environment that enables seamless integration between Microsoft’s SIEM/SOAR capabilities and the OpenCTI threat intelligence platform.

It provides a custom Azure Logic Apps connector along with SOAR playbooks designed to operationalize threat intelligence throughout the incident lifecycle.

This integration allows organizations to:

• Automatically ingest threat intelligence data from OpenCTI into Microsoft Sentinel.
• Enrich Sentinel incidents and alerts with contextual indicators and knowledge from OpenCTI, improving investigation accuracy and prioritization.
• Synchronize indicators bidirectionally, enabling analysts to push indicators from Sentinel back into OpenCTI for centralized knowledge sharing.
• Automate SOC workflows using prebuilt playbooks for indicator creation, enrichment, and incident response.