Threat intel feeds, Sentinel workbooks, and Security Copilot in 2026

Microsoft Sentinel exposes threat intelligence as a first-class concept in the workspace. The Threat Intelligence menu surfaces ingested indicators, search and pivot UI, and indicator-management workflow. The underlying storage is the ThreatIntelligenceIndicator table in Log Analytics. Analytic rules in Sentinel automatically correlate against this table; Security Copilot uses the same table as part of its knowledge corpus for natural-language querying.

Indicator ingestion has three main paths. Microsoft Defender Threat Intelligence (MDTI) is the native integration: enable the connector, MDTI indicators flow into Sentinel. The Threat Intelligence TAXII connector polls STIX 2.x feeds from any compliant TAXII 2.x server. The Threat Intelligence Platforms (TIP) connector accepts indicators from vendor TIPs (Anomali, ThreatConnect, EclecticIQ, MISP via misp2sentinel). The upload-indicators API supports custom integrations and one-time loads.

Analytic rules in Sentinel come in several flavours: scheduled queries (run on a defined schedule), Microsoft security rules (built-in detection content from MSTIC), fusion rules (cross-source correlation), and ML behaviour analytics. The threat-intel matching analytic rules are pre-built and ship as part of the Threat Intelligence solution; they match common indicator types (IPs, domains, URLs, hashes, certificates) against logs as they arrive.

For the Microsoft Defender Threat Intelligence platform specifically, see Microsoft Defender Threat Intelligence review. MDTI is the most efficient first feed for Sentinel-centric SOCs already on the Microsoft licensing stack.

Sentinel uses Azure Logic Apps as the SOAR layer. Logic Apps are visual workflow designer applications that connect Sentinel incidents to actions across Microsoft and third-party systems. A typical CTI-driven Logic App workflow: Sentinel incident fires, Logic App receives the incident, queries MDTI for enrichment, queries Recorded Future for risk score, queries internal asset inventory for the affected host, creates a ServiceNow ticket pre-populated with enrichment, posts a summary to a Microsoft Teams channel, and tags the Sentinel incident with the assigned analyst.

Logic Apps pricing is consumption-based: a few cents per playbook run plus connector-specific costs. For a SOC processing 100-500 incidents per day with multi-step playbooks, Logic Apps cost is typically $5,000 to $25,000 per year. This is meaningfully cheaper than dedicated SOAR products like Splunk SOAR; the trade-off is that Logic Apps are general-purpose workflow tooling rather than security-specific, so SOC-specific abstractions (case management, playbook libraries) require custom implementation or marketplace add-ons.

For agentic SOC patterns that extend beyond Logic Apps playbooks, Microsoft Security Copilot is the integration layer that brings autonomous and semi-autonomous agent capability into the workflow. The combination of Logic Apps (deterministic playbooks) plus Security Copilot (reasoning over unstructured data) is the Microsoft answer to the multi-agent agentic SOC architecture.

Microsoft Security Copilot is the agentic AI layer that wraps Sentinel, Defender XDR, MDTI, and the broader Microsoft security graph. The product became generally available in April 2024 and has expanded through 2025 and 2026 to incorporate the multi-agent architecture described in the April 2026 agentic SOC manifesto.

The capability set in 2026 includes natural-language KQL generation (ask in plain English, Security Copilot writes the KQL and runs it), incident summarisation (paste an incident, get a structured timeline plus likely root cause plus suggested next steps), alert triage agents (autonomous first-pass on alerts with human review gates on escalations), and threat-intel reasoning (ask about specific actors, campaigns, or techniques and get sourced answers from MSTIC and the broader Microsoft Threat Intelligence Center corpus).

Pricing is denominated in Security Compute Units (SCU) at approximately $4 per SCU per hour. Active SOC analysts typically consume 10-50 SCU per day depending on workload. For a 20-analyst SOC, Security Copilot alone often runs $50,000 to $200,000 per year. The capability is genuinely useful at this price point for the analyst-productivity case; the autonomous-decision case requires careful governance, particularly on high-impact actions like endpoint isolation or account lockout.

For the broader agentic SOC architecture and how Security Copilot fits against competing platforms (Dropzone AI, Prophet Security, Torq HyperSOC), see agentic SOC buildout.

Source: Microsoft Sentinel pricing page (Apr 2026), Microsoft Security Copilot pricing page (Apr 2026), Azure Logic Apps pricing reference, Vendr contract data 2024-2026. Last verified May 2026.