Manage and Use Microsoft Sentinel Threat Indicators – SC-200 Study Guide

Purpose of This Lesson

Threat indicators, also called indicators of compromise (IOCs), give Microsoft Sentinel structured evidence that can be used to identify potentially malicious activity. This lesson focuses on importing, managing, and creating threat intelligence, then connecting that intelligence to investigation and detection workflows.

For SC-200 scenario questions, the important decisions are usually:

• How to bring threat intelligence into Sentinel
• Which Sentinel threat-intelligence capability fits the task
• When to create an indicator versus a relationship
• How metadata such as confidence, severity, validity, and sharing restrictions affects operations

Key Concepts

Threat indicators and IOCs

A threat indicator is a data point associated with malicious or suspicious activity. Common examples include:

• Malicious or suspicious IP addresses
• Domain names
• URLs
• File hashes
• Command-and-control infrastructure

Sentinel can correlate imported indicators with collected data such as DNS logs, network traffic, and endpoint telemetry. When an indicator matches observed activity, an analytics rule can help generate an alert or incident.

An indicator is not proof that an attack is occurring in every context. It is evidence that must be interpreted with telemetry, timing, asset importance, and other investigation details.

Threat intelligence in Sentinel

The Threat Intelligence area provides capabilities for managing and investigating cyber threat intelligence (CTI). Relevant areas include:

• Intel management: Manage imported and manually created intelligence objects.
• Threat analytics: Review Microsoft-curated reporting about significant threats and potential exposure.
• Intel profiles: Review information about threat actors, malware families, and campaigns.
• Intel Explorer: Search, filter, and pivot across intelligence to identify relationships and patterns.
• Intel projects: Organize structured research or investigative packages for ongoing campaigns and intelligence reporting, where available in the tenant.

The exact interface and feature availability can change with Sentinel updates, licensing, and tenant configuration.

Content Hub versus file-based import

There are two primary ways to begin using threat intelligence:

1. Install the threat intelligence solution from Content Hub. This is the preferred packaged approach when you need the associated data connectors, analytics rules, and related content.
2. Upload flat files. CSV or JSON-based information can be used when an organization has its own indicator source or a less integrated import requirement.

Installing the solution does not automatically make every external intelligence source available. The relevant connector must still be configured and connected, and the imported data must be suitable for the organization’s detection and investigation needs.

Threat intelligence objects and relationships

A threat intelligence object represents an intelligence entity. The most common object is an indicator, such as a malicious domain, IP address, URL, or file hash. Other object types described in the lesson include:

• Attack pattern: The method or technique used by an attacker, such as credential dumping, spear phishing, or lateral movement.
• Identity: A person, group, organization, victim, or researcher associated with an event.
• Threat actor: A named or classified attacker or group, including information such as aliases, motivations, regions, or commonly used tools.

A threat intelligence relationship connects two intelligence objects. Examples include:

• An indicator associated with a malware family
• A malware family used by a threat actor
• A campaign associated with a threat actor
• An attack pattern associated with a campaign

This object-and-relationship model follows the structured threat intelligence approach used by STIX. Use an object to describe the entity; use a relationship to describe how entities are connected.

Microsoft Security Operations Context

A typical Sentinel threat-intelligence workflow is:

1. Obtain intelligence from Microsoft, an external provider, or an internal research team.
2. Ingest indicators through the packaged solution, a connector, or a supported file import.
3. Correlate indicators with data sources such as DNS, network, and endpoint logs.
4. Use analytics rules to identify matches or suspicious activity.
5. Investigate resulting alerts and incidents using related entities and intelligence context.
6. Revoke, expire, update, or reclassify intelligence as its accuracy and relevance change.

Threat intelligence is most valuable when it is connected to reliable telemetry and a defined response process. A large, unvalidated indicator list can increase noise rather than improve detection.

Exam-Relevant Takeaways

• An IOC is a specific data point that may indicate compromise; common examples are IP addresses, domains, URLs, and file hashes.
• Sentinel uses analytics content to match threat intelligence with collected log and endpoint data.
• Content Hub installs a packaged threat-intelligence solution and may include connectors, analytics rules, and related content.
• A flat-file import is appropriate for organization-supplied CSV or JSON data when that is the selected ingestion method.
• A threat intelligence object describes an entity; a relationship links two objects.
• An attack pattern describes attacker behavior or technique, while a threat actor identifies the attacker or group.
• Revoking an object indicates that it should no longer be relied upon.
• Confidence expresses how certain the analyst or source is that the information is accurate.
• Severity communicates the importance or danger of an item. In the demonstrated model, values range from 0 through 5, with higher values representing greater severity.
• Traffic Light Protocol (TLP) controls intended sharing: white is public, green is community sharing, amber is organizational sharing, and red is restricted to specific recipients.
• Availability of some intelligence features can depend on licensing and tenant state.

Tool / Feature Decision Guide

Requirement	Sentinel capability	Decision point
Install the complete threat-intelligence content package	Content Hub threat intelligence solution	Choose this when you need packaged connectors, analytics rules, and related content.
Bring in an internally maintained indicator list	Flat-file import	Use a supported CSV or JSON workflow when the source is file-based.
Add one malicious domain, IP, URL, or hash manually	Threat intelligence indicator object	Create an indicator and provide appropriate metadata.
Describe an attacker technique	Attack pattern object	Use this for the method or behavior, not the malicious artifact itself.
Build a profile for an attacker group	Threat actor object	Use this to represent the named or classified adversary.
Connect a malware family to an actor or indicator to a campaign	Threat intelligence relationship	Use a relationship when the important fact is the connection between objects.
Search across actors, tools, campaigns, and indicators	Intel Explorer	Use it to filter and pivot through related intelligence.
Review broader threat reporting	Threat analytics or Intel profiles	Use curated reporting and profiles to understand campaigns and exposure beyond a single IOC.

Common Exam Traps

• Confusing an indicator with an attack pattern: A malicious domain is an indicator; credential dumping or lateral movement is an attack pattern.
• Confusing a threat actor with an identity: An identity is a person, group, organization, victim, or researcher associated with an event. A threat actor is the classified attacker or group profile.
• Assuming Content Hub alone completes deployment: The solution may install the required content, but the relevant data connector still needs to be configured and connected.
• Treating every indicator match as a confirmed breach: An indicator match is a detection signal requiring validation against context and additional telemetry.
• Misreading severity values: In the lesson’s scale, larger values indicate higher severity; zero represents unknown or none.
• Using revoked intelligence: Revoked means the object is no longer considered valid and should not be relied upon for detection or investigation.
• Confusing TLP with severity: TLP describes who may receive or share the information. Severity describes the importance or danger of the threat.
• Assuming all intelligence features are universally available: Licensing, tenant configuration, and product changes can affect what appears in the portal.

Real-World SOC Analyst Notes

• Validate indicator provenance before enabling broad detection. Record the source, timestamp, confidence, and reason for inclusion.
• Preserve the original intelligence and document changes. Do not silently overwrite an indicator when the source, confidence, or assessment changes.
• Review indicator validity and revoke stale or incorrect data. Old domains, shared infrastructure, and recycled IP addresses can create false positives.
• Treat automated alerting as a triage aid, not a substitute for investigation. Confirm the affected user, device, process, destination, and time window.
• Apply TLP restrictions before adding intelligence to reports, tickets, or channels that include other teams or external parties.
• Use severity consistently so analysts can prioritize work. A high severity assignment should have an operational meaning and not simply reflect an analyst’s uncertainty.
• Coordinate intelligence changes with detection engineering and incident response teams. A newly imported feed can have tenant-wide impact if analytics rules begin matching it broadly.
• Monitor ingestion and connector health. A disconnected connector can create the false impression that the organization has current threat intelligence when it does not.

Quick Reference Summary

• IOC/indicator: A suspicious artifact such as an IP, domain, URL, or hash.
• Attack pattern: The attacker’s method or technique.
• Identity: A person, group, organization, victim, or researcher connected to an event.
• Threat actor: A named or classified attacker or group.
• Relationship: A connection between two threat-intelligence objects.
• Content Hub: Packaged installation of threat-intelligence content.
• Flat file: CSV or JSON-based import option.
• Revoked: No longer valid or trusted for use.
• Confidence: Certainty that the intelligence is accurate.
• Severity: Operational importance or danger, using the demonstrated 0–5 scale.
• TLP: Sharing restriction: white/public, green/community, amber/organization, red/restricted.

Flashcards

Q: A Sentinel analyst needs to add a known malicious domain manually. Which intelligence object should be created?
A: Create an indicator object and enter the domain using the pattern builder or the appropriate raw pattern. Add confidence, severity, validity, and sharing metadata when known.

Q: When should a Sentinel analyst create a threat intelligence relationship instead of an indicator?
A: Create a relationship when the important information is how two intelligence objects are connected, such as a malware family being used by a threat actor. Create an indicator when representing the malicious artifact itself.

Q: What is the main reason to install the threat-intelligence solution from Content Hub?
A: Content Hub provides packaged content such as relevant data connectors, analytics rules, and related Sentinel resources. The connector may still require configuration after installation.

Q: When might a flat-file import be selected instead of the Content Hub solution?
A: Use a CSV or JSON-based import when the organization has its own file-based indicator source or needs a simple file ingestion method rather than the complete packaged solution.

Q: What happens operationally when an imported indicator matches DNS or endpoint telemetry?
A: Sentinel analytics content can correlate the match with collected data and generate an alert or incident, depending on the configured rules and available telemetry.

Q: How does an attack pattern differ from a threat actor object?
A: An attack pattern describes how the attack is performed, such as credential dumping or lateral movement. A threat actor object identifies the adversary or group associated with the activity.

Q: What is the distinction between an identity object and a threat actor object?
A: An identity can represent any person, group, organization, victim, or researcher involved in an event. A threat actor is specifically used to profile a named or classified attacker or group.

Q: What does revoking a threat intelligence object communicate?
A: It communicates that the object is no longer valid or should no longer be relied upon. This is useful when intelligence becomes outdated or is found to be incorrect.

Q: What does a confidence value represent in threat intelligence?
A: It represents how certain the analyst or source is that the intelligence is accurate. A higher value indicates greater confidence; 100 represents fully verified information in the demonstrated model.

Q: What is the exam distinction between TLP and severity?
A: TLP controls intended information sharing, while severity communicates the threat’s importance or danger. A high-severity indicator is not automatically TLP-restricted, and a restricted indicator is not automatically high severity.

Q: What does TLP amber mean in the lesson’s model?
A: Amber means the information should be shared within the organization. It is more restricted than green community sharing but less restricted than red sharing with only specifically authorized recipients.

Q: An analyst wants to understand connections among an indicator, malware family, actor, and campaign. Which capability is most appropriate?
A: Use Intel Explorer to search, filter, and pivot through intelligence objects and their relationships. This is more appropriate than viewing only a single indicator record.

Q: Why should an analyst avoid treating every IOC match as proof of compromise?
A: Indicators can be stale, shared, misclassified, or legitimately present in a different context. The match must be validated using endpoint, network, identity, and timeline evidence.

Practice Questions

Question 1

A SOC receives an internal CSV containing malicious domains and file hashes. The team wants to import the data into Sentinel without deploying a broader packaged solution. What should the analyst use?

A. Intel Explorer
B. A flat-file threat-intelligence import
C. A threat actor object for each domain
D. A relationship object for each hash

Correct answer: B

Explanation: CSV or JSON flat-file import is the appropriate choice for an organization-supplied file-based intelligence source. Intel Explorer is used to investigate existing intelligence, while domains and hashes are indicators rather than threat actors or relationships.

Question 2

An analyst creates an indicator for a malicious URL and wants to document that it is associated with a specific malware family. What is the best modeling approach?

A. Replace the indicator with an attack pattern
B. Create a threat actor object only
C. Create the indicator and add a relationship connecting it to the malware object
D. Mark the indicator as revoked

Correct answer: C

Explanation: The URL is an indicator object. The association between that indicator and the malware family is represented by a threat intelligence relationship.

Question 3

A threat feed contains an IP address that was later determined to be incorrect. What should the analyst do?

A. Increase its confidence to 100
B. Mark the object as revoked
C. Change its TLP to white
D. Create an identity object for the IP address

Correct answer: B

Explanation: Revocation communicates that the intelligence is no longer valid and should not be relied upon. Confidence should not be increased for inaccurate data.

Question 4

A manager asks whether an indicator marked TLP red is necessarily a critical or severe threat. What is the correct response?

A. Yes, red always means severity 5
B. Yes, red means the indicator is confirmed malicious
C. No, red describes restricted sharing, while severity describes threat importance
D. No, red means the indicator is public

Correct answer: C

Explanation: TLP and severity represent different metadata. TLP red restricts sharing to specifically authorized recipients; it does not define how dangerous or important the threat is.

Question 5

A newly installed Sentinel threat-intelligence solution shows its connector as disconnected. What should the analyst do before expecting indicator correlation to work?

A. Configure and connect the threat-intelligence data connector
B. Create an Intel project
C. Change every indicator to severity 5
D. Add the connector as an attack pattern

Correct answer: A

Explanation: Installing the solution can provide the connector and related content, but the connector must be connected and ingesting data before the expected threat-intelligence workflow can operate.