A security engineer is building a Microsoft Sentinel playbook to respond to a Defender for AI alert about a potential data exfiltration via Azure OpenAI. The playbook must enrich the alert with information about the source IP reputation before escalating. Which Logic App connector action provides IP reputation data?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Defender Threat Intelligence (MDTI) provides IP reputation and intelligence data through an API that can be called from a Logic App using the HTTP connector. The MDTI API returns reputation scores, associated threats, and geographic information for IP addresses, enriching the Defender for AI alert with contextual intelligence.
Full explanation below image
Full Explanation
B is correct because Microsoft Defender Threat Intelligence (MDTI) provides IP reputation and intelligence data through an API that can be called from a Logic App using the HTTP connector. The MDTI API returns reputation scores, associated threats, and geographic information for IP addresses, enriching the Defender for AI alert with contextual intelligence. A is incorrect because the ThreatIntelligenceIndicator table contains indicators ingested from threat intel sources and would only return data if the IP was previously imported as a known IOC; it does not perform live IP reputation lookups. C is incorrect because Azure Firewall logs show traffic that passed through the firewall but do not provide threat intelligence or reputation data for IP addresses. D is incorrect because the Microsoft Graph Security connector provides security entity data from connected Microsoft security services, not specialized threat intelligence reputation data.