Most engineers think…
Many people think 'threat intelligence in Sentinel' just means 'subscribe to a feed and wait for alerts'. That works — barely — but it misses the architecture.
Sentinel threat intelligence is a pipeline: ingest (TAXII, MDTI or Upload API) → store (ThreatIntelIndicators or ThreatIntelObjects tables) → match (built-in IOC-matching analytics rules join raw logs against indicators) → fire an incident. Watchlists plug into this pipeline as a fast KQL-queryable lookup, letting you enrich or suppress matches with context — VIP lists, safe IP ranges, subnet maps — without touching the main log tables. Getting this pipeline right is what separates a noisy feed subscription from a high-fidelity SOC detection engine.
① Watchlists — fast enrichment tables inside your workspace
A watchlist in Microsoft Sentinel is a CSV file you upload to the workspace and query by name in KQL, like a small reference table. Typical uses: a list of VIP user accounts that need priority alerting, known-bad IP ranges to suppress or escalate, subnet-to-site mappings for geographic context, or a list of recently terminated employees. The watchlist lives in your Log Analytics workspace and is queried with the _GetWatchlist() function — no extra table ingestion cost, just a small flat-file join.
The key difference from a raw log join: watchlists are semi-static reference data, not streaming events. They refresh on upload (or via API) and are ideal for context that changes slowly — asset inventories, trust lists, geofencing. In analytics rules you add a watchlist lookup to enrich a match or to suppress known-good positives before an alert fires, keeping your incident queue clean.
Watchlist rows do not cost Log Analytics ingestion. Use them freely for context tables — VIP lists, department-to-subnet maps, recently terminated employees. Update them via the portal or the Watchlist API when the data changes.
What is the primary purpose of a Sentinel watchlist?
② TI connectors — TAXII, MDTI and the Upload API
Microsoft Sentinel offers three ways to bring in threat indicators. The TAXII connector (Data connectors → Threat Intelligence – TAXII) accepts TAXII 2.0 and 2.1 feeds — most commercial and open-source TI providers (e.g. Pulsedive, AlienVault OTX, Recorded Future, ISAC feeds) expose a TAXII server. You give Sentinel the API root URL, a collection ID and credentials, and it polls on a schedule. Indicators arrive as STIX bundles.
MDTI and the Upload API
The Microsoft Defender Threat Intelligence (MDTI) connector brings in Microsoft-curated indicators at no additional licence cost — high-confidence IOCs from Microsofts own telemetry. It ingests into the ThreatIntelIndicators table automatically once enabled. The Threat Intelligence Upload API lets you push indicators programmatically from your own platform or SOAR via REST, which is useful for homegrown feeds or platforms that do not speak TAXII. All three routes end in the same destination table.
A CSV reference table inside the workspace. Queried with _GetWatchlist() in KQL. Used for VIP lists, safe-IP suppression, subnet maps — semi-static enrichment data, not streaming events.
Polls a TAXII 2.0 / 2.1 server on a schedule. Accepts STIX bundles from commercial or open-source feeds. Needs API root URL, collection ID and credentials.
Microsoft Defender Threat Intelligence connector — brings in Microsoft-curated high-confidence IOCs at no additional licence cost, enriched with GeoLocation and WhoIs.
A built-in scheduled KQL analytics rule that joins ThreatIntelIndicators against a log table (e.g. CommonSecurityLog, DNS events) and raises an incident on a match.
Microsoft stopped ingesting data into ThreatIntelligenceIndicator after July 2025. Any custom queries, workbooks or automation still referencing the old table return no results. Update all references to ThreatIntelIndicators (IOCs) and ThreatIntelObjects (STIX actors, patterns, relationships).
Which Sentinel TI connector brings in Microsoft-curated indicators at no additional licence cost?
③ The Threat Intelligence blade, ThreatIntelIndicators & STIX objects
The Threat Intelligence blade (Sentinel → Threat intelligence) is your indicator management UI. It shows all ingested indicators, lets you filter by type (IP, domain, URL, file hash, email), confidence score, threat type and validity date. You can add indicators manually here too — handy for ad-hoc IOC response. Microsoft enriches IP and domain indicators with GeoLocation and WhoIs data automatically, giving analysts extra context without a separate enrichment step.
Since April 2025, Sentinel uses two tables. ThreatIntelIndicators holds STIX Indicator objects — the classic IOCs: IP addresses, domain names, URLs, file hashes, email addresses. ThreatIntelObjects holds non-indicator STIX objects: Threat Actors, Attack Patterns (MITRE ATT&CK techniques), Identities, Relationships, and Malware — richer context for threat hunting beyond simple matches. Custom queries, workbooks and analytics rules should reference these new tables; the legacy ThreatIntelligenceIndicator table stopped receiving data after July 2025.
STIX version matters here: Sentinel supports STIX 2.0 and 2.1 bundles from TAXII and the Upload API, and maps them to the appropriate table on ingest.
Before troubleshooting a suspected IOC match, open Sentinel → Threat intelligence to confirm the indicator is actually ingested, active, and not expired (ValidUntil). A connector that silently stopped polling will give you no indicators and therefore no matches — even though everything else looks fine.
▶ Watch an IOC from a TAXII feed fire a Sentinel incident
Step through how a malicious IP from a TAXII feed travels from ingest to incident. Press Play for the healthy path, then Break it to see the classic silent-failure.
An analyst wants to hunt for relationships between a known threat actor and attack patterns used in recent incidents. Which table should they query?
④ IOC-matching analytics rules — from feed to fired incident
Ingesting indicators is not detection — you need IOC-matching analytics rules to turn indicators into alerts. Sentinel ships a family of built-in TI map rules in the Analytics templates gallery, with names like TI map IP entity to CommonSecurityLog, TI map Domain entity to DNS Events, and TI map URL entity to OfficeActivity. Each rule does a scheduled KQL join between ThreatIntelIndicators and a specific log table, looking for matching field values. When a match fires, it raises an incident with the indicator details, the matched event, and the entities for investigation.
Tuning is critical. Raw TI feeds carry low-confidence indicators — broad IP ranges, aged domains — that produce noise. Best practice: filter by confidence score (e.g. > 50), restrict by ValidUntil date, use watchlists to suppress known-safe IPs (your CDN ranges, internal scanners), and monitor the False Positive Rate in the Efficiency workbook. You can also write custom KQL analytics rules that join ThreatIntelIndicators directly for indicators that do not have a built-in map rule. Start in a low-severity test rule, validate for a week, then promote to production severity.
Priya, a SOC analyst at a Mumbai fintech firm, faces this
After enabling the TAXII connector to an open-source feed, the Sentinel incident queue floods with hundreds of low-severity IOC match alerts per day, mostly for IP addresses that belong to major CDN providers.
The built-in TI map rule has no confidence-score filter and no watchlist suppression — every IP in the feed, regardless of quality or validity date, is matched against CommonSecurityLog.
Open Sentinel → Analytics → find the TI map IP rule → inspect the KQL — no confidence filter. Check ThreatIntelIndicators — many entries have ConfidenceScore below 30 and ValidUntil in the past.
Sentinel ▸ Analytics ▸ TI map rule KQL ▸ Threat Intelligence blade ▸ Watchlist (CDN-safe-IPs)Edit the analytics rule KQL to filter ConfidenceScore > 50 and ValidUntil > now(). Create a watchlist of known CDN and internal IP ranges and add a watchlist exclusion join in the rule. Re-enable the rule in monitor mode for one week before raising severity.
Incident count drops by more than 80%. Remaining alerts are genuine matches on high-confidence, current IOCs. Priya promotes the rule to medium severity and closes the false-positive flood ticket.
A built-in TI map analytics rule is generating too many false-positive incidents from low-quality IP indicators. What is the best first tuning step?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Write one line: what is the difference between a watchlist and the ThreatIntelIndicators table in Sentinel? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Watchlist
- A CSV reference table in a Sentinel workspace queried via _GetWatchlist() in KQL — used for enrichment or suppression of analytics rule results.
- TAXII connector
- Sentinel data connector that polls a TAXII 2.0 / 2.1 server on a schedule and imports STIX-formatted indicator bundles from third-party TI providers.
- MDTI connector
- Microsoft Defender Threat Intelligence connector — brings Microsoft-curated, high-confidence IOCs into Sentinel at no additional licence cost.
- ThreatIntelIndicators
- The current Log Analytics table holding STIX Indicator objects (IP, domain, URL, file hash, email) ingested by all three TI connectors.
- ThreatIntelObjects
- The Log Analytics table holding non-indicator STIX objects: Threat Actors, Attack Patterns, Identities, Relationships, and Malware — for threat hunting beyond IOC matching.
- STIX
- Structured Threat Information eXpression — a JSON-based open standard for describing threat intelligence objects including indicators, actors, techniques and relationships.
- IOC-matching analytics rule
- A built-in or custom Sentinel scheduled analytics rule that joins ThreatIntelIndicators against a log table and fires an incident when a field value matches an active indicator.
- Confidence score
- A 0–100 field on each indicator reflecting the TI provider's certainty. Filtering to scores above ~50 in analytics rules is the primary way to reduce false positives from low-quality feeds.
- ValidUntil
- A timestamp field on each indicator marking when it expires. Analytics rules should filter ValidUntil > now() to exclude stale indicators from matches.
- TI blade
- The Threat Intelligence section in the Sentinel portal where all ingested indicators are visible, filterable by type and confidence, and manually manageable.
📚 Sources
- Microsoft Learn — Understand threat intelligence in Microsoft Sentinel. learn.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence
- Microsoft Learn — Threat intelligence integration in Microsoft Sentinel (connectors, TAXII, Upload API). learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration
- Microsoft TechCommunity — Announcing Public Preview: New STIX Objects in Microsoft Sentinel (ThreatIntelIndicators & ThreatIntelObjects). techcommunity.microsoft.com/blog/microsoftsentinelblog/announcing-public-preview-new-stix-objects-in-microsoft-sentinel/4369164
- Microsoft Learn — Work with STIX objects and indicators in Microsoft Sentinel. learn.microsoft.com/en-us/azure/sentinel/work-with-stix-objects-indicators
- Jeffrey Appel — Microsoft Defender Threat Intelligence (Defender TI) integrations with Microsoft Sentinel. jeffreyappel.nl/defender-ti-integrations-with-microsoft-sentinel/
- OneUptime Blog — How to Configure Microsoft Sentinel Threat Intelligence Connectors and Indicator Matching Rules (2026). oneuptime.com/blog/post/2026-02-16-how-to-configure-microsoft-sentinel-threat-intelligence-connectors-and-indicator-matching-rules/view
What's next?
Threat intel feeds your detections; automation closes the loop. Next, explore Microsoft Sentinel automation rules and Logic App playbooks — how to auto-triage, enrich and respond the moment an IOC match fires an incident.