Skip to content

New: Microsoft Sentinel TAXII integration is in technical preview.Read the integration guide

ELLIOELLIO Documentation

SIEM Connectors

Connectors deliver ELLIO Threat Intelligence directly into your security platform - your SIEM or MISP polls the ELLIO server on a schedule and ingests fresh indicators automatically, no manual downloads or pipeline glue required.

Browse the catalogue at Data Feeds → Connectors. Each connector has its own page where you generate and manage credentials - Microsoft Sentinel (TAXII), MISP Daily Sightings, MISP Per-IP Detail, and MISP Per-IP Detail with JA4+.

Microsoft Sentinel (TAXII)

Section titled “Microsoft Sentinel (TAXII)”

Native TAXII 2.1 feed for Microsoft Sentinel’s built-in Threat Intelligence - TAXII data connector. Sentinel polls the ELLIO server on a schedule you choose; ELLIO returns paginated STIX 2.1 indicators that land in your ThreatIntelIndicators table.

What you get:

  • Continuous delivery (no manual download)
  • Microsoft Sentinel native ingest (no custom parser)
  • SIEM-style consumption alongside your other indicator sources

Set-up walkthrough: Microsoft Sentinel TAXII - Setup Guide. Data model: STIX Data Model. Ready-to-run KQL: KQL Query Examples.

MISP Feed

Section titled “MISP Feed”

Native MISP feed for any MISP instance. Subscribe once and MISP keeps a rolling 90-day window of observed attacker activity in sync - events update in place using MISP’s built-in feed-sync.

What you get:

  • Three feed shapes - daily sightings, per-IP rolling, and per-IP rolling with FoxIO JA4+ - pick the granularity that matches your workflow
  • Native MISP tagging - TLP, ELLIO classification, Cyber Kill Chain phase, and MITRE ATT&CK techniques on every event and attribute
  • Decay-aware tagging - every event carries an ellio:decay-model tag pointing at ELLIO’s recommended 90-day curve. Configure a matching MISP decay model and the tag drives automatic scoring of aging indicators.

Set-up walkthrough: MISP Feed - Setup Guide. Decay model: MISP Decay Model. Event shape: MISP Feed Reference.

What’s coming

Section titled “What’s coming”

Additional connectors are planned for other major SIEM and SOAR platforms. The catalogue page is the source of truth for what’s currently available. Need a specific platform? Open a request via Support Center → Contact Support.