How to Integrate Threat Intelligence with EDR
Your EDR is the front line of endpoint defense — but it's only as good as the intelligence it can act on. Feeding it fresh, structured indicators means blocking threats on day one, instead of waiting for a signature or playbook update. The Threat Landscape TAXII server makes this a configuration task, not a build task.
Almost every major EDR and security platform speaks TAXII 2.0/2.1 out of the box or through a built-in integration. That means one feed configuration delivers continuously updated indicators to your endpoint fleet — no custom code, no hand-rolled parsing.
Which EDR Platforms Support TAXII?
Here's how the major vendors handle TAXII ingestion today:
| Vendor / Platform | TAXII Support | Details | Official Doc |
|---|---|---|---|
| Microsoft (Defender for Endpoint / Sentinel) | Native, built-in | Built-in TAXII client supports TAXII 2.0/2.1. The connector lives in Microsoft Sentinel, accessible standalone or from the Defender portal, and imports threat intelligence from TAXII 2.x servers. | learn.microsoft.com/.../connect-threat-intelligence-taxii |
| Trend Micro (Trend Vision One) | Native, built-in | Subscribe to and monitor TAXII feeds directly from the console under Threat Intelligence > Third-Party Intelligence. Supports TAXII 2.0 and 2.1, feeding into the Suspicious Object List for automatic blocking. | docs.trendmicro.com/.../intelligence-feeds.aspx |
| Palo Alto Cortex XSIAM / XDR | Supported, via content pack | TAXII 1.x and 2.x ingestion ships as a "TAXII Feed" integration pack in the Cortex Marketplace, configured through the platform's Threat Intel feed integrations screen — not a separate bolt-on tool. | docs-cortex.paloaltonetworks.com/.../Configure-Threat-Intel-feed-integrations |
| SentinelOne (Singularity) | Supported, via API / BYO-IOC | Bring your own IOCs via API or STIX/TAXII, alongside pre-built feeds (Recorded Future, Mandiant, AT&T Alien Labs OTX) in the Singularity Marketplace. Handled via API and marketplace integrations rather than a single TAXII connector. | sentinelone.com/.../cyber-threat-intelligence-lifecycle |
Which Threat Landscape Collection to Use
For EDR, the IOC Feed is usually the right choice. It delivers lean, deduplicated STIX 2.1 indicator objects — one per unique IOC value, with defined validity windows — covering IPv4/IPv6 addresses, domains and subdomains, URLs and URI patterns, and file hashes (MD5, SHA-1, SHA-256). That's exactly the shape an EDR wants for matching against endpoint events.
The Intelligence Feed is the fuller option if you also want surrounding context — threat actors, malware, campaigns, TTPs and relationships — for enrichment inside a platform or TIP.
Concrete Example: Microsoft Defender for Endpoint & Sentinel
Microsoft's TAXII ingestion lives in the Threat Intelligence solution for Microsoft Sentinel. Here's the full path:
1. Install the Threat Intelligence solution. For Microsoft Sentinel in the Azure portal, go to Content management > Content hub. In the Defender portal, go to Microsoft Sentinel > Content management > Content hub. Find the Threat Intelligence solution and select Install/Update.
2. Enable the Threat Intelligence – TAXII data connector. Select the Data connectors menu, find Threat Intelligence – TAXII, and select Open connector page.
3. Configure the connector. Enter a friendly name, then fill in the TAXII server details:
| Parameter | Value |
|---|---|
| Friendly Name | Threat Landscape IOC Feed |
| API Root URL | https://api.threatlandscape.io/taxii2/ |
| Collection ID | 4c3b2a1d-5e6f-4a8b-8c0d-e1f2a3b4c5d6 |
| Username | Any value (our server ignores it) |
| Password | Your Threat Landscape API key |
Our TAXII server accepts standard HTTP Basic auth — the username field is ignored and your API key goes in the password field. Choose the indicator group and polling frequency, then select Add.
4. Confirm and monitor. You should receive confirmation that a connection to the TAXII server was established. Repeat the last step to connect multiple collections from one or more TAXII servers. Within a few minutes, threat indicators begin flowing into your Microsoft Sentinel workspace — find them on the Threat intelligence pane, accessible from the Microsoft Sentinel menu.
Key Takeaway
After the first sync, TAXII ingestion is incremental — each poll pulls only what's new, so the feed stays fresh without re-downloading history. Pick a polling frequency that matches your risk tolerance.
Next Steps
The same TAXII feed powers OpenCTI TAXII ingestion for your central knowledge graph, while EDR and SIEM/SOAR workflows cover the detection and response side. Together they form a complete loop: intelligence in, detection out.
Ready to wire it up? The Threat Landscape API documents the full TAXII server reference, and the Threat Landscape Platform brings the same intelligence to life with its AI Assistant.