Prepare for SC-200 with a reference that remembers your progress.

Threat-intelligence connectors import external and Microsoft indicators so Sentinel analytics, hunting, workbooks, and playbooks can correlate known malicious observables with organizational activity.

Options include standard or premium Microsoft Defender Threat Intelligence, Threat Intelligence Platforms, TAXII, and the Threat Intelligence Upload API. Content Hub solutions can provide scheduled analytics, workbooks, hunting queries, and response playbooks alongside the connector.

Choose by feed source, licensing, STIX/TAXII compatibility, authentication, update frequency, indicator quality, and required custom integration.

Install or update the Threat Intelligence solution, open the standard or premium Defender Threat Intelligence connector, select Connect, and confirm Connected status. The feed brings Microsoft's public, open-source, and high-fidelity IoCs into the workspace.

Sentinel supports TAXII 2.0 and 2.1. Configure a friendly name, API root URL, collection ID, and credentials, then add the server. Monitor connection status and the last indicator received time.

TAXII transports STIX threat objects from a sharing server; it does not itself determine indicator quality or relevance.

The preview Upload API accepts STIX objects from a TIP or custom application. Register an Entra application, create a credential, assign it Microsoft Sentinel Contributor at workspace scope, and configure the client ID, OAuth token flow, and workspace ID in the sending platform.

Protect client secrets, apply least privilege, monitor ingestion failures, and account for preview support terms.

Use ThreatIntelIndicators and ThreatIntelObjects for current STIX indicator and object schemas. The lesson notes that dual ingestion into legacy ThreatIntelligenceIndicator ended after July 31, 2025, so custom analytics, workbooks, hunting, and automation should use the new tables.

ThreatIntelIndicators
| where IsDeleted == false
| summarize Indicators = count() by Type

Verify current schema fields in the workspace before deploying queries, and filter lifecycle state and validity windows before correlation.

Review connector choices, MDTI, TAXII requirements, Upload API identity and roles, STIX, packaged TI content, and migration from the legacy indicator table.

Select trustworthy feeds, connect them securely, validate freshness and schema, migrate queries to current tables, and operationalize indicators through analytics and hunting rather than collecting them without use.