Skip to main content
Ingest Reyhford ICS/OT indicators into Microsoft Sentinel using the built-in TAXII data connector.

​
Prerequisites

  • Microsoft Sentinel workspace with Threat Intelligence permissions
  • Reyhford API key

​
Add TAXII connector

  1. In Azure Portal, open Microsoft Sentinel → Configuration → Data connectors.
  2. Search for Threat Intelligence - TAXII and select Open connector page.
  3. Click Add connector and configure:
SettingValue
Friendly nameReyhford Global Feed
TAXII Serverhttps://api.reyhford.com/taxii2/
TAXII Collection IDreyhford-global-feed
API Root(auto-discovered)
AuthenticationAPI Key / Header
Header nameAuthorization
Header valueBearer <your-api-key>
Polling frequency1 hour (adjust based on volume)
  1. Save and verify the connector shows Connected.

​
Workbook and hunting

Imported indicators appear under Threat intelligence → All indicators. Use KQL to hunt ICS-specific activity: 
ThreatIntelligenceIndicator
| where SourceSystem == "Reyhford Global Feed"
| where Description has "Modbus" or Description has "S7"
| project TimeGenerated, Description, ExternalIndicatorId, Confidence
| order by TimeGenerated desc

​
REST API alternative

For custom Logic Apps or Azure Functions, use the Indicators Search API with WorkOS JWT authentication.