---
title: Azure Sentinel IOC Feed Setup
slug: azure-sentinel-ioc-feed-setup
docTags: 
createdAt: 2026-03-11T18:01:45.670Z
---

:::hint{type="warning"}
**Note:** This requires a licensed Sekoia IOC Feed add-on and is *not* included in the Sentinel integration by default. Reach out to your CSM for more information.
:::

How to setup an IOC feed in Azure Sentinel

- Go to the Microsoft Sentinel interface in Microsoft Azure.
- In the “Configuration” menu, click on “Data connectors”.
- Search for “TAXII” and select “Threat intelligence - TAXII” connector. If the search is disabled, click on the content hub and search for “TAXII”. Install it.

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/6_1S8oWM2S3p0WUTpT6IH-20260324-201048.png)

- On the “Data Connections” page, select “Threat intelligence - TAXII” and click on “Open connector page”

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/FXTRuKta6c-5gfv732wpA-20260324-201157.png)

In the “Threat intelligence - TAXII” connector page, fill the form with the following information:

- Friendly name (for server): flare
- API Root URL: https\://api.flare.io/taxii2
- Collection ID: paste here your feed identifier
- Username: api-key
- Password: paste here the API key that was created in the first step
- Import indicators: “All available”
- Polling Frequency: “Once an hour”

 

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Fzjk4Do-cmKKGyZDeelPb-20260324-201237.png)