Microsoft Sentinel & Cyberint Threat Intel Integration Guide (2024)

Microsoft Sentinel & Cyberint IOC Module Integration Guide

In today’s cybersecurity landscape, threat intelligence plays a critical role in identifying and mitigating potential threats. Microsoft Sentinel, a powerful cloud-native SIEM (Security Information and Event Management) solution, provides robust capabilities for security monitoring and incident response.

Integrating Microsoft Sentinel with Cyberint (Cyberint - Threat Intelligence & Digital Risk Protection) module enhances its ability to detect and respond to emerging threats using threat intelligence feeds.

This guide outlines the steps to integrate Cyberint’s module with Microsoft Sentinel, enabling you to leverage enriched threat intelligence data for more effective security operations.

PREQUISITES

1. Ensure you have an active Azure account with sufficient permissions to create resources

2. Active Cyberint account. (To get the API Token & URL)

This blog will guide you through the steps for integrating with Cyberint TI feeds and how to troubleshoot various issues that may arise during integration. Here is a brief summary of the steps needed

Log in to your Azure account.
Create a new Logic App
Ensure that Managed Identity for the Logic app is enabled.
Switch to Code view and paste in the JSON code
Use JSON Lint to verify and validate the Json Format.
Save the Logic App code.
Add a Switch-Case to handle HTTP action redirect status code 307.
Add steps for delay action to handle the Status code 429.
Configure the Logic App to execute daily.
Add Retry Policy if Status code 429 persists.
Grant Microsoft Sentinel Contributor Role to Logic App at the Resource Group Level.

Create a Blank logic app

1. Sign In to Azure Portal

Go to: Azure Portal
Log in with your Azure credentials.

2. Create a new Logic App

Navigate to: All services > Logic Apps
Click: + Add or + Create
Configure Basics:
- Subscription: Select your Azure subscription.
- Resource Group: Choose or create a new one.
- Logic App Name: Enter a unique name.
- Region: Choose your preferred region.
- Select Type: Choose Logic App (Consumption) for pay-as-you-go pricing.

Click: Review + Create, then Create.

3. Ensure that the Logic app's Managed Identity

Under the "Settings" section in the navigation bar, select "Identity"

Switch the "Status" slider to "On" and verify that you wish to perform this action.

You will assign role assignments later in the Blog post.

4. Switch to Code View to paste in JSON code

After activating the managed Identity, proceed to the Code view within Logic app.

Under the "Development Tools" section in the navigation bar, select "Logic app code view"

Insert the following code, making sure to substitute the elements marked in yellow with the relevant information specific to your environment.

The information you will need to gather is:

Microsoft Sentinel Subscription ID
Microsoft Sentinel Resource Group Name
Microsoft Sentinel Deployment Region
Cyberint API Token
Cyberint Environment URL

**Utilize the following code provided by CYBERINT to implement the foundational logic structure. Substitute the sections highlighted in Redwith the appropriate values.
-----------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------

{

"definition": {

"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition....",

"actions": {

"Compose": {

"inputs": "@split(variables('input'), '\n')",

"runAfter": {

"Initialize_variable": [

"Succeeded"

]

"type": "Compose"

"Filter_array": {