Integrating with Microsoft Defender Threat Intelligence

The integration with Microsoft Defender Threat Intelligence (MDTI) allows you to view additional enrichments from MDTI—such as Passive SSL and Passive DNS—on observable details pages, and pivot from Domains to Certificates on the Graph UI.

Before activating the MDTI integration, you must register MDTI on the Azure portal, grant it the required permissions, and then obtain its Tenant ID, Client ID, and Client Secret.

For details on how to create app registrations, see Register an application with the Microsoft identity platform. After you have created the app registration for MDTI, grant it the required permissions.

To grant the required permissions to MDTI:

  1. Log in to your account on the Azure portal.

  2. In the portal menu, select Microsoft Entra ID.

  3. Click Manage.

  4. Click App registrations.

  5. Locate and click the app registration for MDTI.

  6. Click Manage > API permissions.

  7. Click Add a permission.

  8. Click Microsoft Graph > Application permissions.

  9. Select ThreatIntelligence > ThreatIntelligence.Read.All.

  10. Click Add permission.

The permission is added to the list of application API permissions. Note that the admin consent might be required for the permission to become active.

Obtaining MDTI Credentials

After registering MDTI on the Azure portal, you must obtain its Tenant and Client IDs, and create a Client Secret.

To obtain your MDTI Tenant ID and Client ID:

1. Log in to your account on the Azure portal.

2. In the portal menu, select Microsoft Entra ID.

3. Click Manage.

4. Click App registrations.

5. Locate and click the app registration for MDTI.

Your Client and Tenant IDs are displayed in the Essentials section.

To create a Client Secret:

  1. In the Azure portal menu, select Microsoft Entra ID.

  2. Click Manage.

  3. Click App registrations.

  4. Locate and click the app registration for Microsoft Defender Threat Intelligence.

  5. In the main menu, click Manage > Certificates & secrets.

  6. Click + New client secret.

  7. In the dialog box that opens, provide a brief description of the Client Secret and select a time at which the secret will expire and need to be regenerated.

  8. Click Add.

You should see your newly-generated Client Secret listed on the Certificates & Secrets page. Copy and save the value of the generated secret because after leaving this page, there is not way to retrieve the value of the Client Secret. If you do not save it, you will need to generate a new Client Secret.

Activating the MDTI Integration

To activate the MDTI integration:

  1. In the bottom-left corner of the side navigation panel, click > ThreatStream and then click Integrations.

  2. Click Activate in the Microsoft Defender.

  3. Enter your MDTI Tenant ID, Client ID, and Client Secret.

  4. Click Save.

    The MDTI integration is activated.