threatinfo – Page 2 – Threat Intelligence

Pushing Bulk Indicators to Multiple Sentinel Instances for a MSSP

Problem We manage a MISP instance which receives over 130,000 IOCs every day from multiple sources which we need to push to over 22 Microsoft Sentinel instances which we manage.…

threatinfo November 29, 2024

Defender Nifi

Microsoft Defender Indicator API Always Generates Alerts

No matter how hard I try, I cannot get the Microsoft Defender Indicator API https://api.securitycenter.microsoft.com/api/indicators/import to import IOCs with the Generate alert flag off. I have tried the below to no…

threatinfo November 29, 2024

Nifi

Configuring Nifi with Azure Key Vault Secrets Parameter Providers

To integrate Nifi with an Azure Key Vault follow the below steps Step 1 - Add Parameter Provider Go into Controller Settings -> Parameter Providers and add an AzureKeyVaultSecretsParameterProvider as…

threatinfo October 4, 2024

Threat Intelligence

Actor targeting Palo Alto VPN

User names used by actor seen using VPNs with Canadian source IP addresses 10/05/2024. Replace targetDomain below with the domain of the VPN service (i.e. victim Domain) monitor paservice@targetDomain admin@targetDomain…

threatinfo May 12, 2024

logstash sentinel siem

SIEM Log Ingestion – To filter or to deduplicate

Why Should You Manage Your Log Ingestion? Cost Implications SIEM tools operate under a licensing model that typically charges based on the volume of logs ingested. Ingesting a high volume…

threatinfo April 24, 2024

sentinel siem

Sentinel Parsing Data at Ingestion or at Query time

There are different options for parsing data in Microsoft Sentinel. Query time parsing when the parsing is done when an analytic or analyst executes a piece of KQL or Ingest…

threatinfo April 1, 2024

sentinel siem Threat Intelligence

Why is the Sentinel Threat Intelligence Indicator API so full of bugs

Microsoft have an API to add IOCs to the threat intelligence module in sentinel which can you read about here. My issue with it, is that is is full of…

threatinfo March 14, 2024

Threat Intelligence

MISP Database Size Getting Too Large

MISP MYSQL database growing too large and starting to get out of control? API calls getting slower and slower? Maybe its time to start doing some spring cleaning! Find below…

threatinfo March 11, 2024

Threat Intelligence

MISP – An Internal Error has occured – HTTP Status code 500

If you receive a "An internal error has occured" error message when clicking on various menu functions in the MISP UI. This is potentially due to model cache issues. This…

threatinfo March 7, 2024

Threat Intelligence

Whats a threat activity cluster?

A threat activity cluster is a grouping of security alerts which are related to a unique or similar activity taking place in an environment. It leverages less of the standard IOCs in…

threatinfo February 25, 2024