Microsoft Sentinel Integration - Reyhford Threat Intelligence

Ingest Reyhford ICS/OT indicators into Microsoft Sentinel using the built-in TAXII data connector.

Prerequisites

Microsoft Sentinel workspace with Threat Intelligence permissions
API key from reyhford.com/portal

Add TAXII connector

In Azure Portal, open Microsoft Sentinel → Configuration → Data connectors.
Search for Threat Intelligence - TAXII and select Open connector page.
Click Add connector and configure:

Setting	Value
Friendly name	`Reyhford Global Feed`
TAXII Server	`https://reyhford.com/api/taxii2/`
TAXII Collection ID	`ics-feed` or `global-feed`
API Root	(auto-discovered)
Authentication	API Key / Header
Header name	`Authorization`
Header value	`Bearer <your-api-key>`
Polling frequency	1 hour (adjust based on volume)

Save and verify the connector shows Connected.

Workbook and hunting

Imported indicators appear under Threat intelligence → All indicators. Use KQL to hunt ICS-specific activity:

ThreatIntelligenceIndicator
| where SourceSystem == "Reyhford Global Feed"
| where Description has "Modbus" or Description has "S7"
| project TimeGenerated, Description, ExternalIndicatorId, Confidence
| order by TimeGenerated desc

REST API alternative

For custom Logic Apps or Azure Functions, use the Indicators Search API with WorkOS JWT authentication.