Skip to content

Commit 6ef12cb

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #297305 from guywi-ms/new-ti-tables-with-query-samples
New ti tables with query samples
2 parents 8ef0f4b + 512c703 commit 6ef12cb

File tree

5 files changed

+184
-16
lines changed

5 files changed

+184
-16
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6739,6 +6739,11 @@
67396739
"redirect_url": "/dotnet/maui/data-cloud/push-notifications",
67406740
"redirect_document_id": false
67416741
},
6742+
{
6743+
"source_path": "articles/work-with-styx-objects-and-indicators.md",
6744+
"redirect_url": "/azure/sentinel/work-with-styx-objects-indicators",
6745+
"redirect_document_id": false
6746+
},
67426747
{
67436748
"source_path": "articles/storage/files/geo-redundant-storage-for-large-file-shares.md",
67446749
"redirect_url": "/azure/storage/files/files-redundancy",

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,8 @@
802802
href: use-threat-indicators-in-analytics-rules.md
803803
- name: Use matching analytics to detect threats
804804
href: use-matching-analytics-to-detect-threats.md
805+
- name: Work with STIX objects and indicators
806+
href: work-with-styx-objects-indicators.md
805807
- name: Detect threats and analyze data
806808
items:
807809
- name: Monitor and visualize data

‎articles/sentinel/understand-threat-intelligence.md

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22
title: Threat intelligence
33
titleSuffix: Microsoft Sentinel
44
description: Understand threat intelligence and how it integrates with features in Microsoft Sentinel to analyze data, detect threats, and enrich alerts.
5-
author: austinmccollum
5+
author: guywi-ms
66
ms.topic: concept-article
77
ms.date: 02/27/2025
8-
ms.author: austinmc
8+
ms.author: guywild
9+
ms.reviewer: alsheheb
910
appliesto:
1011
- Microsoft Sentinel in the Azure portal
1112
- Microsoft Sentinel in the Microsoft Defender portal
@@ -203,23 +204,28 @@ For more information, see [Work with threat intelligence in Microsoft Sentinel](
203204

204205
## View your threat intelligence
205206

206-
View your threat intelligence from the management interface or using queries. From the management interface, use advanced search to sort and filter your threat intelligence objects without even writing a Log Analytics query.
207+
View your threat intelligence from the management interface or using queries:
207208

208-
:::image type="content" source="media/understand-threat-intelligence/advanced-search.png" alt-text="Screenshot that shows an advanced search interface with source and confidence conditions selected." lightbox="media/understand-threat-intelligence/advanced-search.png":::
209+
- From the management interface, use advanced search to sort and filter your threat intelligence objects without even writing a Log Analytics query.
209210

210-
Use queries to view threat intelligence from **Logs** or **Advanced hunting**. Either way, the `ThreatIntelligenceIndicator` table under the **Microsoft Sentinel** schema is where all your Microsoft Sentinel threat indicators are stored. This table is the basis for threat intelligence queries performed by other Microsoft Sentinel features, such as analytics, hunting queries, and workbooks.
211+
:::image type="content" source="media/understand-threat-intelligence/advanced-search.png" alt-text="Screenshot that shows an advanced search interface with source and confidence conditions selected." lightbox="media/understand-threat-intelligence/advanced-search.png":::
212+
213+
- Use queries to view threat intelligence from **Logs** in the Azure portal or **Advanced hunting** in the Defender portal.
214+
215+
Either way, the `ThreatIntelligenceIndicator` table under the **Microsoft Sentinel** schema is where all your Microsoft Sentinel threat indicators are stored. This table is the basis for threat intelligence queries performed by other Microsoft Sentinel features, such as analytics, hunting queries, and workbooks.
211216

212217
>[!IMPORTANT]
213-
>Tables supporting the new STIX object schema aren't available publicly. In order to view the STIX objects in queries and unlock the hunting model that uses them, request to opt in with [this form](https://forms.office.com/r/903VU5x3hz?origin=lprLink). Ingest your threat intelligence into the new tables, `ThreatIntelIndicator` and `ThreatIntelObjects`, alongside or instead of the current table, `ThreatIntelligenceIndicator`, with this opt-in process.
214-
>
218+
> On April 3, 2025, we publicly previewed two new tables to support STIX indicator and object schemas: `ThreatIntelIndicator` and `ThreatIntelObjects`. Microsoft Sentinel will ingest all threat intelligence into these new tables, while continuing to ingest the same data into the legacy `ThreatIntelligenceIndicator` table until July 31, 2025.
219+
>**Be sure to update your custom queries, analytics and detection rules, workbooks, and automation to use the new tables by July 31, 2025.** After this date, Microsoft Sentinel will stop ingesting data to the legacy `ThreatIntelligenceIndicator` table. We're updating all out-of-the-box threat intelligence solutions in Content hub to leverage the new tables. For more information about the new table schemas, see [ThreatIntelIndicator](/azure/azure-monitor/reference/tables/threatintelligenceindicator) and [ThreatIntelObjects](/azure/azure-monitor/reference/tables/threatintelobjects).
220+
> For information on using and migrating to the new tables, see (Work with STIX objects to enhance threat intelligence and threat hunting in Microsoft Sentinel (Preview))[work-with-styx-objects-and-indicators.md].
215221
216-
For more information, see [Work with threat intelligence in Microsoft Sentinel](work-with-threat-indicators.md#find-and-view-threat-intelligence-with-queries).
222+
### Threat intelligence lifecycle
217223

218-
### Threat intelligence life cycle
224+
Microsoft Sentinel ingests threat intelligence indicators into the threat intelligence tables in your Log Analytics workspace. For more information on Microsoft Sentinel's threat intelligence tables, see [View your threat intelligence](#view-your-threat-intelligence).
219225

220-
Threat intelligence indicators are ingested into the `ThreatIntelligenceIndicator` table of your Log Analytics workspace as read-only. Whenever an indicator is updated, a new entry in the `ThreatIntelligenceIndicator` table is created. Only the most current indicator appears on the management interface. Microsoft Sentinel deduplicates indicators based on the `IndicatorId` and `SourceSystem` properties and chooses the indicator with the newest `TimeGenerated[UTC]`.
226+
Whenever an indicator is created, updated, or deleted, Microsoft Sentinel creates a new entry in the tables. Only the most current indicator appears on the management interface. Microsoft Sentinel deduplicates indicators based on the `Id` property (the `IndicatorId` property in the legacy `ThreatIntelligenceIndicator`) and chooses the indicator with the newest `TimeGenerated[UTC]`.
221227

222-
The `IndicatorId` property is generated using the STIX indicator ID. When indicators are imported or created from non-STIX sources, `IndicatorId` is generated using both the source and pattern of the indicator.
228+
The `Id` property is a concatenation of the base64-encoded `SourceSystem` value, `---` (three dashes), and the `stixId` (which is the `Data.Id` value).
223229

224230
### View your GeoLocation and WhoIs data enrichments (public preview)
225231

‎articles/sentinel/work-with-styx-objects-indicators.md

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
title: Work with STIX objects and indicators to enhance threat intelligence and threat hunting in Microsoft Sentinel (Preview)
3+
titleSuffix: Microsoft Sentinel
4+
description: This article provides examples of how to incorporate STIX objects into queries to enhance threat hunting.
5+
author: guywi-ms
6+
ms.topic: how-to
7+
ms.date: 03/31/2025
8+
ms.author: guywild
9+
ms.reviewer: alsheheb
10+
appliesto:
11+
- Microsoft Sentinel in the Azure portal
12+
- Microsoft Sentinel in the Microsoft Defender portal
13+
ms.collection: usx-security
14+
#Customer intent: As a security analyst, I want to understand how to incorporate STIX objects into queries to enhance threat hunting.
15+
---
16+
17+
# Work with STIX objects and indicators to enhance threat intelligence and threat hunting in Microsoft Sentinel (Preview)
18+
19+
On April 3, 2025, we publicly previewed two new tables to support STIX (Structured Threat Information eXpression) indicator and object schemas: `ThreatIntelIndicator` and `ThreatIntelObjects`. This article provides examples of how to incorporate STIX objects into queries to enhance threat hunting, and how to migrate to the new threat indicator schema.
20+
21+
For more information about threat intelligence in Microsoft Sentinel, see [Threat intelligence in Microsoft Sentinel](understand-threat-intelligence.md).
22+
23+
>[!IMPORTANT]
24+
> Microsoft Sentinel will ingest all threat intelligence into the new `ThreatIntelIndicator` and `ThreatIntelObjects` tables, while continuing to ingest the same data into the legacy `ThreatIntelligenceIndicator` table until July 31, 2025.
25+
>
26+
> **Be sure to update your custom queries, analytics and detection rules, workbooks, and automation to use the new tables by July 31, 2025.** After this date, Microsoft Sentinel will stop ingesting data to the legacy `ThreatIntelligenceIndicator` table. We're updating all out-of-the-box threat intelligence solutions in Content hub to leverage the new tables. For more information about the new table schemas, see [ThreatIntelIndicator](/azure/azure-monitor/reference/tables/threatintelligenceindicator) and [ThreatIntelObjects](/azure/azure-monitor/reference/tables/threatintelobjects).
27+
28+
## Identify threat actors associated with specific threat indicators
29+
30+
This query is an example of how to correlate threat indicators, such as IP addresses, with threat actors:
31+
32+
```Kusto
33+
let IndicatorsWithThatIP = (ThreatIntelIndicators
34+
| extend tlId = tostring(Data.id)
35+
| summarize arg_max(TimeGenerated,*) by Id
36+
| where IsDeleted == false);
37+
let ThreatActors = (ThreatIntelObjects
38+
| where StixType == 'threat-actor'
39+
| extend tlId = tostring(Data.id)
40+
| extend ThreatActorName = Data.name
41+
| extend ThreatActorSource = base64_decode_tostring(tostring(split(Id, '---')[0]))
42+
| summarize arg_max(TimeGenerated,*) by Id
43+
| where IsDeleted == false);
44+
let AllRelationships = (ThreatIntelObjects
45+
| where StixType == 'relationship'
46+
| extend tlSourceRef = tostring(Data.source_ref)
47+
| extend tlTargetRef = tostring(Data.target_ref)
48+
| extend tlId = tostring(Data.id)
49+
| summarize arg_max(TimeGenerated,*) by Id
50+
| where IsDeleted == false);
51+
let IndicatorAsSource = (IndicatorsWithThatIP
52+
| join AllRelationships on $left.tlId == $right.tlSourceRef
53+
| join ThreatActors on $left.tlTargetRef == $right.tlId);
54+
let IndicatorAsTarget = (IndicatorsWithThatIP
55+
| join AllRelationships on $left.tlId == $right.tlTargetRef
56+
| join ThreatActors on $left.tlSourceRef == $right.tlId);
57+
IndicatorAsSource
58+
| union IndicatorAsTarget
59+
| project ObservableValue, ThreatActorName
60+
```
61+
62+
63+
## List threat intelligence data related to a specific threat actor
64+
65+
This query provides insights into the tactics, techniques, and procedures (TTPs) of the threat actor (replace `Sangria Tempest` with the name of the threat actor you want to investigate):
66+
67+
```Kusto
68+
let THREAT_ACTOR_NAME = 'Sangria Tempest';
69+
let ThreatIntelObjectsPlus = (ThreatIntelObjects
70+
| union (ThreatIntelIndicators
71+
| extend StixType = 'indicator')
72+
| extend tlId = tostring(Data.id)
73+
| extend PlusStixTypes = StixType
74+
| extend importantfield = case(StixType == "indicator", Data.pattern,
75+
StixType == "attack-pattern", Data.name,
76+
"Unkown")
77+
| extend feedSource = base64_decode_tostring(tostring(split(Id, '---')[0]))
78+
| summarize arg_max(TimeGenerated,*) by Id
79+
| where IsDeleted == false);
80+
let ThreatActorsWithThatName = (ThreatIntelObjects
81+
| where StixType == 'threat-actor'
82+
| where Data.name == THREAT_ACTOR_NAME
83+
| extend tlId = tostring(Data.id)
84+
| extend ActorName = tostring(Data.name)
85+
| summarize arg_max(TimeGenerated,*) by Id
86+
| where IsDeleted == false);
87+
let AllRelationships = (ThreatIntelObjects
88+
| where StixType == 'relationship'
89+
| extend tlSourceRef = tostring(Data.source_ref)
90+
| extend tlTargetRef = tostring(Data.target_ref)
91+
| extend tlId = tostring(Data.id)
92+
| summarize arg_max(TimeGenerated,*) by Id
93+
| where IsDeleted == false);
94+
let SourceRelationships = (ThreatActorsWithThatName
95+
| join AllRelationships on $left.tlId == $right.tlSourceRef
96+
| join ThreatIntelObjectsPlus on $left.tlTargetRef == $right.tlId);
97+
let TargetRelationships = (ThreatActorsWithThatName
98+
| join AllRelationships on $left.tlId == $right.tlTargetRef
99+
| join ThreatIntelObjectsPlus on $left.tlSourceRef == $right.tlId);
100+
SourceRelationships
101+
| union TargetRelationships
102+
| project ActorName, PlusStixTypes, ObservableValue, importantfield, Tags, feedSource
103+
```
104+
105+
## Migrate existing queries to the new ThreatIntelObjects schema
106+
107+
This example shows how to migrate existing queries from the legacy `ThreatIntelligenceIndicator` table to the new `ThreatIntelObjects` schema. The query uses the `extend` operator to recreate legacy columns based on the `ObservableKey` and `ObservableValue` columns in the new table.
108+
109+
```Kusto
110+
ThreatIntelIndicators
111+
| extend NetworkIP = iff(ObservableKey == 'ipv4-addr:value', ObservableValue, ''),
112+
NetworkSourceIP = iff(ObservableKey == 'network-traffic:src_ref.value', ObservableValue, ''),
113+
NetworkDestinationIP = iff(ObservableKey == 'network-traffic:dst_ref.value', ObservableValue, ''),
114+
DomainName = iff(ObservableKey == 'domain-name:value', ObservableValue, ''),
115+
EmailAddress = iff(ObservableKey == 'email-addr:value', ObservableValue, ''),
116+
FileHashType = case(ObservableKey has 'MD5', 'MD5',
117+
ObservableKey has 'SHA-1', 'SHA-1',
118+
ObservableKey has 'SHA-256', 'SHA-256',
119+
''),
120+
FileHashValue = iff(ObservableKey has 'file:hashes', ObservableValue, ''),
121+
Url = iff(ObservableKey == 'url:value', ObservableValue, ''),
122+
x509Certificate = iff(ObservableKey has 'x509-certificate:hashes.', ObservableValue, ''),
123+
x509Issuer = iff(ObservableKey has 'x509-certificate:issuer', ObservableValue, ''),
124+
x509CertificateNumber = iff(ObservableKey == 'x509-certificate:serial_number', ObservableValue, ''),
125+
Description = tostring(Data.description),
126+
CreatedByRef = Data.created_by_ref,
127+
Extensions = Data.extensions,
128+
ExternalReferences = Data.references,
129+
GranularMarkings = Data.granular_markings,
130+
IndicatorId = tostring(Data.id),
131+
ThreatType = tostring(Data.indicator_types[0]),
132+
KillChainPhases = Data.kill_chain_phases,
133+
Labels = Data.labels,
134+
Lang = Data.lang,
135+
Name = Data.name,
136+
ObjectMarkingRefs = Data.object_marking_refs,
137+
PatternType = Data.pattern_type,
138+
PatternVersion = Data.pattern_version,
139+
Revoked = Data.revoked,
140+
SpecVersion = Data.spec_version
141+
| project-reorder TimeGenerated, WorkspaceId, AzureTenantId, ThreatType, ObservableKey, ObservableValue, Confidence, Name, Description, LastUpdateMethod, SourceSystem, Created, Modified, ValidFrom, ValidUntil, IsDeleted, Tags, AdditionalFields, CreatedByRef, Extensions, ExternalReferences, GranularMarkings, IndicatorId, KillChainPhases, Labels, Lang, ObjectMarkingRefs, Pattern, PatternType, PatternVersion, Revoked, SpecVersion, NetworkIP, NetworkDestinationIP, NetworkSourceIP, DomainName, EmailAddress, FileHashType, FileHashValue, Url, x509Certificate, x509Issuer, x509CertificateNumber, Data
142+
```
143+
144+
## Related content
145+
146+
For more information, see the following articles:
147+
148+
- [Threat intelligence in Microsoft Sentinel](understand-threat-intelligence.md).
149+
- Connect Microsoft Sentinel to [STIX/TAXII threat intelligence feeds](./connect-threat-intelligence-taxii.md).
150+
- See which [TIPs, TAXII feeds, and enrichments](threat-intelligence-integration.md) can be readily integrated with Microsoft Sentinel.
151+
152+
[!INCLUDE [kusto-reference-general-no-alert](includes/kusto-reference-general-no-alert.md)]

‎articles/sentinel/work-with-threat-indicators.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22
title: Work with threat intelligence
33
titleSuffix: Microsoft Sentinel
44
description: This article explains how to view, create, manage, and visualize threat intelligence in Microsoft Sentinel.
5-
author: austinmccollum
5+
author: guywi-ms
66
ms.topic: how-to
77
ms.date: 02/21/2025
8-
ms.author: austinmc
8+
ms.author: guywild
9+
ms.reviewer: alsheheb
910
appliesto:
1011
- Microsoft Sentinel in the Azure portal
1112
- Microsoft Sentinel in the Microsoft Defender portal
@@ -133,7 +134,7 @@ In the following image, multiple sources were used to search by placing them in
133134

134135
:::image type="content" source="media/work-with-threat-indicators/advanced-search.png" alt-text="Screenshot shows an OR operator combined with multiple AND conditions to search threat intelligence." lightbox="media/work-with-threat-indicators/advanced-search.png":::
135136

136-
Microsoft Sentinel only displays the most current version of your threat intel in this view. For more information on how objects are updated, see [Threat intelligence life cycle](understand-threat-intelligence.md#threat-intelligence-life-cycle).
137+
Microsoft Sentinel only displays the most current version of your threat intel in this view. For more information on how objects are updated, see [Threat intelligence lifecycle](understand-threat-intelligence.md#threat-intelligence-lifecycle).
137138

138139
IP and domain name indicators are enriched with extra `GeoLocation` and `WhoIs` data so you can provide more context for any investigations where indicator is found.
139140

@@ -164,8 +165,10 @@ This procedure describes how to view your threat intelligence with queries, rega
164165
Threat indicators are stored in the Microsoft Sentinel `ThreatIntelligenceIndicator` table. This table is the basis for threat intelligence queries performed by other Microsoft Sentinel features, such as **Analytics**, **Hunting**, and **Workbooks**.
165166

166167
>[!IMPORTANT]
167-
>Tables supporting the new STIX object schema aren't available publicly. In order to view the STIX objects in queries and unlock the hunting model that uses them, request to opt in with [this form](https://forms.office.com/r/903VU5x3hz?origin=lprLink). Ingest your threat intelligence into the new tables, `ThreatIntelIndicator` and `ThreatIntelObjects`, alongside or instead of the current table, `ThreatIntelligenceIndicator`, with this opt-in process.
168-
>
168+
> On April 3, 2025, we publicly previewed two new tables to support STIX indicator and object schemas: `ThreatIntelIndicator` and `ThreatIntelObjects`. Microsoft Sentinel will ingest all threat intelligence into these new tables, while continuing to ingest the same data into the legacy `ThreatIntelligenceIndicator` table until July 31, 2025.
169+
>**Be sure to update your custom queries, analytics and detection rules, workbooks, and automation to use the new tables by July 31, 2025.** After this date, Microsoft Sentinel will stop ingesting data to the legacy `ThreatIntelligenceIndicator` table. We're updating all out-of-the-box threat intelligence solutions in Content hub to leverage the new tables. For more information about the new table schemas, see [ThreatIntelIndicator](/azure/azure-monitor/reference/tables/threatintelligenceindicator) and [ThreatIntelObjects](/azure/azure-monitor/reference/tables/threatintelobjects).
170+
> For information on using and migrating to the new tables, see (Work with STIX objects to enhance threat intelligence and threat hunting in Microsoft Sentinel (Preview))[work-with-styx-objects-and-indicators.md].
171+
169172

170173
#### [Defender portal](#tab/defender-portal)
171174

0 commit comments

Comments
 (0)