Microsoft Sentinel App
Detection & Response Enablement
概要
Azure Sentinel solution that connects OpenCTI with Microsoft Sentinel to ingest threat intelligence, enrich incidents, and automate indicator synchronization using custom Logic Apps connectors and SOAR playbooks.
The OpenCTI for Azure Sentinel solution is a deployable application within the Microsoft Sentinel environment that enables seamless integration between Microsoft’s SIEM/SOAR capabilities and the OpenCTI threat intelligence platform.
It provides a custom Azure Logic Apps connector along with SOAR playbooks designed to operationalize threat intelligence throughout the incident lifecycle.
This integration allows organizations to:
- Automatically ingest threat intelligence data from OpenCTI into Microsoft Sentinel.
- Enrich Sentinel incidents and alerts with contextual indicators and knowledge from OpenCTI, improving investigation accuracy and prioritization.
- Synchronize indicators bidirectionally, enabling analysts to push indicators from Sentinel back into OpenCTI for centralized knowledge sharing.
- Automate SOC workflows using prebuilt playbooks for indicator creation, enrichment, and incident response.
基本情報
Filigran
Nino Rowlands
サードパーティとの統合
Detection (SIEM, XDR & EDR)
2026年7月07日
0