Content Hub TAXII connector
Install the Threat Intelligence solution, then add a TAXII server with the isMalicious API root.
Integration
Microsoft Sentinel: TAXII 2.1 threat intelligence ingest
Sentinel’s built-in Threat Intelligence TAXII connector reads the isMalicious STIX 2.1 collections. No custom Content Hub solution needed.
No credit card required · Free API key
Capabilities
Key features at a glance.
Collection IDs
malicious-ips, malicious-domains, malicious-urls, c2-indicators, phishing-indicators, and more.
Score before you block
Filter on x_opencti_score. ≥ 60 for auto-block, 40–59 for analyst review.
Optional event push
SOC events can also land in Log Analytics via the dashboard Sentinel destination (Pro).
Applications
Use cases to evaluate first.
Indicator matching
Match Sentinel logs against isMalicious IPs and domains ingested over TAXII.
Hunting
Use C2 and phishing collections as hunting seeds, not as a raw firewall dump.
Firewall follow-through
High-score IPs from malicious-ips can feed EDL or blocklist workflows after review.
Setup
Connect in Sentinel
- Content management → Content hub → install Threat Intelligence.
- Data connectors → Threat Intelligence - TAXII → Open connector page → Add.
- Friendly name:
isMalicious - API root URL:
https://api.ismalicious.com/taxii2/api-root - Collection ID:
malicious-ipsormalicious-domains - Username
api, password = your dashboard API credential (Base64 of apiKey:apiSecret). - Polling frequency: hourly is enough for most SOCs.
FAQ
Frequently asked questions.
Is there a custom isMalicious app in the Sentinel Content Hub?
No. Sentinel already ships a Threat Intelligence TAXII connector. Point it at the isMalicious TAXII 2.1 API root and a collection ID. The dashboard Log Analytics destination is a separate outbound path for SOC events, not indicator ingest.
What URL do I enter as the API root?
https://api.ismalicious.com/taxii2/api-root — not the discovery URL. Discovery is https://api.ismalicious.com/taxii2/.
How do I authenticate?
Prefer Basic Auth with username = API key and password = API secret. Username api with password equal to the Base64 API credential (the X-API-KEY value) still works. Bearer with that same Base64 value also works on the TAXII server.
Which collection should I start with?
malicious-ips or malicious-domains. Filter on x_opencti_score after ingest: ≥ 60 for auto-block, 40–59 for review. The malicious-ips collection is a broad intelligence set, not a confirmed-only blocklist.
Explore
Related tools and pages.
Test it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key