> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Sentinel Integration

> Import Reyhford threat intelligence into Microsoft Sentinel via TAXII 2.1.

Ingest Reyhford ICS/OT indicators into Microsoft Sentinel using the built-in TAXII data connector.

## Prerequisites

* Microsoft Sentinel workspace with Threat Intelligence permissions
* Reyhford API key

## Add TAXII connector

1. In Azure Portal, open **Microsoft Sentinel → Configuration → Data connectors**.
2. Search for **Threat Intelligence - TAXII** and select **Open connector page**.
3. Click **Add connector** and configure:

| Setting             | Value                              |
| ------------------- | ---------------------------------- |
| Friendly name       | `Reyhford Global Feed`             |
| TAXII Server        | `https://api.reyhford.com/taxii2/` |
| TAXII Collection ID | `reyhford-global-feed`             |
| API Root            | (auto-discovered)                  |
| Authentication      | API Key / Header                   |
| Header name         | `Authorization`                    |
| Header value        | `Bearer <your-api-key>`            |
| Polling frequency   | 1 hour (adjust based on volume)    |

4. Save and verify the connector shows **Connected**.

## Workbook and hunting

Imported indicators appear under **Threat intelligence → All indicators**. Use KQL to hunt ICS-specific activity:

```kql theme={null}
ThreatIntelligenceIndicator
| where SourceSystem == "Reyhford Global Feed"
| where Description has "Modbus" or Description has "S7"
| project TimeGenerated, Description, ExternalIndicatorId, Confidence
| order by TimeGenerated desc
```

## REST API alternative

For custom Logic Apps or Azure Functions, use the [Indicators Search API](/api-reference/indicators/search) with WorkOS JWT authentication.

## Related

* [Quickstart](/quickstart)
* [Get Objects](/api-reference/taxii/objects)