Microsoft Sentinel Content Pack Overview

Overview

Microsoft Sentinel™ is a cloud-based security information and event management (SIEM) solution focused on delivering timely, comprehensive security information to an organization. Major use cases for Microsoft Sentinel include detecting, investigating, and responding to threats. ThreatConnect^® offers a Content Pack that supports the following use cases for managing incidents and alerts in Microsoft Sentinel and importing them into ThreatConnect for further analysis and investigation:

• Using the ThreatConnect TAXII™ 2.1 server to bulk import Indicators from ThreatConnect into Microsoft Sentinel
• Using Microsoft^® Kusto Query Language (KQL) queries to import incidents and alerts from Microsoft Sentinel into ThreatConnect
• Retrieving incidents from Microsoft Sentinel and creating Incident Groups in ThreatConnect
• Retrieving incidents from Microsoft Sentinel and creating Workflow Cases in ThreatConnect

Before You Start

Additional Resources

• Microsoft Sentinel API Versions
• Microsoft Sentinel Entity Types Reference
• Microsoft Sentinel Incidents API Reference

ThreatConnect^® is a registered trademark, and TC Exchange™ is a trademark, of ThreatConnect, Inc.
Azure^® and Microsoft^® are registered trademarks, and Active Directory™ and Microsoft Sentinel™ are trademarks, of Microsoft Corporation.
TAXII™ is a trademark of The MITRE Corporation.

20153-01 v.01.A