A security engineer is building a Microsoft Sentinel playbook to respond to a Defender for AI alert about a potential data exfiltration via Azure OpenAI. The playbook must enrich the alert with information about the source IP reputation before escalating. Which Logic App connector action provides IP reputation data?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need the HTTP connector calling the Microsoft Defender Threat Intelligence (MDTI) IP summary API because it gives live IP reputation, threat associations, and geographic context for the source IP before escalation.
Full Explanation
The HTTP connector calling the Microsoft Defender Threat Intelligence (MDTI) IP summary API is correct because MDTI provides IP reputation and intelligence data through an API that can be called from a Logic App using the HTTP connector. The MDTI API returns reputation scores, associated threats, and geographic information for IP addresses, enriching the Defender for AI alert with contextual intelligence. The Microsoft Sentinel Threat Intelligence connector querying the ThreatIntelligenceIndicator table is incorrect because that table contains indicators ingested from threat intel sources and would only return data if the IP was previously imported as a known IOC; it does not perform live IP reputation lookups. The Azure Resource Graph connector querying Azure Firewall logs for the source IP is incorrect because Azure Firewall logs show traffic that passed through the firewall but do not provide threat intelligence or reputation data for IP addresses. The Microsoft Graph Security connector querying IP entity information is incorrect because it provides security entity data from connected Microsoft security services, not specialized threat intelligence reputation data.