Microsoft Threat Intelligence TAXII Export Connector Moves to General Availability

What Changed

The Threat Intelligence TAXII Export connector has transitioned from Preview to General Availability status. The connector title was updated to remove “(Preview)” branding, and the availability configuration was changed from preview state to production-ready status.

Security Impact (Visibility & Fidelity)

Production Microsoft Sentinel deployments can now officially use TAXII 2.1 export functionality for sharing STIX objects with external threat intelligence platforms and partners. Previously, organizations hesitant to use preview connectors in production had limited options for automated TI sharing workflows.

The GA status indicates Microsoft’s commitment to supporting this connector for production threat intelligence sharing scenarios, reducing operational risk for SOCs implementing automated TI distribution workflows.

Affected Files

Solutions/Threat Intelligence (NEW)/Data Connectors/template_ThreatIntelligenceTaxiiExport.json
(packaging artefacts: 3.0.18.zip, ReleaseNotes.md, Solution_ThreatIntelligenceUpdated.json, mainTemplate.json)