Integrations · Microsoft Sentinel

Pull HoneyLabs intel into Microsoft Sentinel

Sentinel ships a TAXII data connector, and HoneyLabs runs a TAXII 2.1 server at honeylabs.net/taxii2/. Give the connector our API root, a collection ID, and your API key as the password, and evidence-backed indicators land in your workspace on the schedule you pick. Nothing gets deployed on the Azure side.

1. 01

   Install the Threat Intelligence solution

   In Sentinel, open Content hub, find the Threat Intelligence solution by Microsoft, and install it. That adds the TAXII data connector plus the rule templates that match indicators against your logs. Skip this if the connector is already present.

2. 02

   Get an API key

   Any HoneyLabs API key works as the TAXII password, including a free one. Create the key on the dashboard; the account it belongs to is what shows up in your usage view later.

   copy

   https://honeylabs.net/dashboard?src=sentinel  ->  API keys  ->  New key

3. 03

   Add the TAXII connector

   Under Data connectors, open Threat Intelligence - TAXII and fill in the form. The username can be any string; only the password (your key) is checked. Hourly polling matches how often the collections change.

   copy

   Friendly name : HoneyLabs exploiters
   API root URL  : https://honeylabs.net/taxii2/api/
   Collection ID : exploiters
   Username      : taxii
   Password      : <your API key>
   Polling       : Once an hour

4. 04

   Add the second collection

   Repeat the previous step with the malware-infrastructure collection to also ingest loader and C2 URLs extracted from captured payloads.

   copy

   Friendly name : HoneyLabs malware infrastructure
   Collection ID : malware-infrastructure

5. 05

   Turn on the matching rules

   Under Analytics, enable the TI mapping rule templates for the log sources you actually collect (CommonSecurityLog for firewalls, SigninLogs, DNS). Indicators arrive tagged with the friendly name you chose, so incidents say where the intel came from. Each indicator links back to its HoneyLabs report for the full evidence.