Microsoft Threat Intelligence IOC - Cloudflare IPs Triggering Sentinel Noise

JC 40 Reputation points
2026-11-05T22:50:11.3066667+00:00

We have recently observed multiple Microsoft Sentinel incidents being triggered by IP addresses associated with Cloudflare that are currently being flagged by Microsoft Threat Intelligence IOC feeds.

Our investigation indicates these IPs belong to legitimate Cloudflare infrastructure and are generating a significant volume of alerts, resulting in operational noise and false positives within our environment.

Could you please help clarify:

  1. What criteria or intelligence led to these Cloudflare IPs being added to the Microsoft Threat Intelligence IOC feed?
  2. Are these indicators intended to represent malicious Cloudflare infrastructure, or potentially malicious clients operating behind Cloudflare services?
  3. Is there a Microsoft-recommended method to suppress or exclude specific threat intelligence indicators from Sentinel analytics when they are known to be benign in our environment?
  4. Are there best practices for tuning the built-in Microsoft Threat Intelligence analytics rules to reduce alerts generated from CDN or reverse proxy providers such as Cloudflare?
Microsoft Security | Microsoft Sentinel
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. JC 40 Reputation points
    2026-11-05T22:55:56.2666667+00:00

    IOC is actually from Microsoft hence we are not seeing any active rules
    Microsoft Threat Intelligence published an IOC for 172.71.x.x.

    1. Microsoft detected that IP in your CommonSecurityLog data.
    2. Microsoft Defender generated the alert:

    Threat Intelligence match for NetworkSourceIPv4 observed in CommonSecurityLog

    1. The alert was ingested into Sentinel as a Defender alert.
    Field Value
    AlertName Threat Intelligence match for NetworkSourceIPv4 observed in CommonSecurityLog
    ProviderName MicrosoftThreatProtection
    ProductName Microsoft 365 Defender

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.