312-39 · Question #50
A multinational cybersecurity firm wants to enhance its threat intelligence capabilities by integrating real-time threat feeds into Microsoft Sentinel. These feeds include malicious IPs, domains…
The correct answer is C. TAXII data connector. TAXII (Trusted Automated eXchange of Indicator Information) is an industry-standard protocol for automated threat intelligence transport, commonly used alongside STIX-formatted threat data. The question explicitly requires a standardized protocol to automate sharing and…
Question
A multinational cybersecurity firm wants to enhance its threat intelligence capabilities by integrating real-time threat feeds into Microsoft Sentinel. These feeds include malicious IPs, domains, file hashes, and attack patterns. The firm requires a standardized protocol that allows automated threat intelligence sharing so Sentinel continuously receives updated indicators from external sources in a structured format. Which Microsoft Sentinel data connector should be implemented to integrate threat intelligence feeds using an industry-standard protocol?
Options
- AThreat Intelligence Platforms data connector
- BSyslog connector
- CTAXII data connector
- DMicrosoft Defender for Cloud (Legacy) connector
How the community answered
(23 responses)- B13% (3)
- C78% (18)
- D9% (2)
Explanation
TAXII (Trusted Automated eXchange of Indicator Information) is an industry-standard protocol for automated threat intelligence transport, commonly used alongside STIX-formatted threat data. The question explicitly requires a standardized protocol to automate sharing and continuously import structured threat indicators into Sentinel. The TAXII data connector is designed for this purpose: it enables pulling indicator data from TAXII servers so that malicious IPs, domains, and hashes can be ingested and used in detection and enrichment workflows. Syslog is a logging transport protocol for device and system logs, not threat intel sharing. Microsoft Defender for Cloud (Legacy) is unrelated to ingesting external threat feeds via a standardized intel protocol. The “Threat Intelligence Platforms” connector can be used to integrate certain TI sources, but the question specifically calls out using an industry-standard protocol for automated sharing, which is TAXII . From a SOC analyst perspective, using TAXII supports consistent ingestion, reduces manual indicator handling, and improves correlation by allowing Sentinel analytics rules and playbooks to leverage the latest
Topics
Community Discussion
No community discussion yet for this question.