Microsoft adds SOCRadar threat intelligence to Sentinel

SOCRadar has been named among the new and enhanced Microsoft Sentinel connectors announced for Ignite 2026, with the SOCRadar Alerts Azure Sentinel Directional Solution highlighted as a partner connector in an ecosystem of more than 500 Microsoft Sentinel connectors.

The integration enables SOCRadar Threat Intelligence to feed into Microsoft Sentinel, bringing context-rich alerts from SOCRadar’s Extended Threat Intelligence capabilities—such as Brand Protection, External Attack Surface Management (ASM), and Third-Party Findings—into security operations workflows. Microsoft notes bidirectional synchronization to keep incident status, severity, and comments aligned between Sentinel and SOCRadar.

The SOCRadar connector turns alarms and findings from across the Extended Threat Intelligence Platform into Microsoft Sentinel incidents for centralised investigation, with a dedicated SOCRadar workbook offering a consolidated view. Key features include automated alert ingestion, cross-module context for assessing external exposures and supplier risk, and bidirectional incident synchronization that mirrors updates back into SOCRadar.

The integration is positioned for use within the Microsoft Defender portal and is part of a broader set of Microsoft integrations on the SOCRadar platform, including routes for Bi-Directional (Sentinel) and Push (Sentinel) incident delivery, Threat Feeds or TAXII 2.1 ingestion, and multi-tenant support for MSSPs.