Use STIX/TAXII to import and export threat intelligence in Microsoft Sentinel

STIX and TAXII are the most common open standards for sharing threat intelligence. Microsoft Sentinel has built-in connectors that use these standards to import and export threat data.

Use the Threat Intelligence – TAXII data connector to pull threat indicators from TAXII 2.0 or 2.1 servers. To send threat data to outside platforms, set up the Threat Intelligence – TAXII Export connector for TAXII 2.1 export.

This article shows you how to set up both import and export with TAXII servers.

Learn more about threat intelligence and TAXII feeds in Microsoft Sentinel.

For more information, see Connect your threat intelligence platform (TIP) to Microsoft Sentinel.

Prerequisites

Before you begin, make sure you have the following prerequisites:

• To install, update, and delete standalone content or solutions in the Content hub, you need the Microsoft Sentinel Contributor role at the resource group level.
• You must have a TAXII 2.0 or TAXII 2.1 API root URI and collection ID.

Get the TAXII server API root and collection ID

TAXII 2.x servers advertise API roots, which are URLs that host collections of threat intelligence. You can usually find the API root and the collection ID in the documentation pages of the threat intelligence provider that hosts the TAXII server.

Install the Threat Intelligence solution in Microsoft Sentinel

To import or export threat indicators with a TAXII server, install the Threat Intelligence solution:

1. For Microsoft Sentinel in the Azure portal, under Content management, select Content hub.

   For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Content hub.

2. Find and select the Threat Intelligence solution.

3. Select the Install/Update button.

To manage solution parts, see Discover and deploy out-of-the-box content.

Enable the Threat Intelligence - TAXII data connector

To configure the TAXII data connector:

1. Select the Data connectors menu.

2. Find and select the Threat Intelligence - TAXII data connector, and then select Open connector page.

   

3. In the Friendly name text box, enter a name for this TAXII server collection.

4. Fill in API root URL, Collection ID, Username (if needed), and Password (if needed).

5. Choose the group of indicators and the polling frequency.

6. Select Add.

   

You should receive confirmation that a connection to the TAXII server was established successfully. Repeat the last step as many times as you want to connect to multiple collections from one or more TAXII servers.

Within a few minutes, threat indicators should begin flowing into your Microsoft Sentinel workspace. Find the new indicators on the Threat intelligence pane. You can access the Threat intelligence pane from the Microsoft Sentinel menu.

IP allowlisting for the Microsoft Sentinel TAXII client

Some TAXII servers, like FS-ISAC, have a requirement to keep the IP addresses of the Microsoft Sentinel TAXII client on the allowlist. Most TAXII servers don't have this requirement.

When relevant, the following IP addresses are the addresses to include in your allowlist:

Enable the Threat intelligence - TAXII Export data connector

To configure the Threat Intelligence - TAXII Export connector:

1. Confirm you have the latest Threat Intelligence solution. For details, see Install the Threat Intelligence solution in Microsoft Sentinel.

2. Select the Data connectors menu.

3. Select the Threat intelligence - TAXII Export data connector. Then select Open connector page in the side pane.

   

4. In the Configuration area on the Threat intelligence - TAXII Export page:

   • In the Friendly name (for server) text box, enter a name for this server.
   • Fill in API root URL and Collection ID. For details, see Get the TAXII server API root and collection ID.
   • From the Authentication type dropdown, select Basic authentication or API key. Then enter your credentials.
   • Select Enable rules to apply the connector page rules to all exported threat data.

   For example:

   • Defender portal
   • Azure portal

   

   Note

   Editing existing connectors is currently not supported. To change the configuration of a TAXII server or its rules, reinstall the TAXII Export connector.

5. Select Add to add your server.

IP allowlisting for the Threat Intelligence - TAXII Export connector

Add these IP addresses to your allowlist to ensure that your export operations don't get blocked:

Related content

In this article, you learned how to connect Microsoft Sentinel to threat intelligence feeds by using the TAXII protocol. To learn more about working with threat intelligence in Microsoft Sentinel, see the following articles:

• Work with Microsoft Sentinel threat intelligence