Does Spur integrate with Microsoft Sentinel?
Yes. The Spur: IP Intelligence and Enrichment solution, available on the Microsoft Marketplace, enriches public IP addresses on Microsoft Sentinel incidents using the Spur Context API. For the full installation, configuration, and troubleshooting walkthrough, see the Microsoft Sentinel integration guide.
For the complete installation walkthrough — installing the solution, deploying the custom connector, creating the enrichment playbook, and testing the integration — see the Microsoft Sentinel integration guide.
Similar questions
Can Spur integrate with SIEM, SOAR, TIP, and security platforms?
Yes. Many organizations integrate Spur intelligence into security operations workflows, including SIEM, SOAR, threat intelligence, fraud prevention, and trust and safety platforms.
How does Spur integrate with our existing technologies (Cloudflare, etc.)?
Many customers integrate Spur intelligence into web security, fraud prevention, and access control workflows. Available integration methods may vary depending on the platform and use case.
How does spur IP intelligence help with reconnaissance detection?
Reconnaissance activity often appears benign when viewed in isolation. Infrastructure context from Spur can reveal whether requests originate from rotating VPN infrastructure, proxy networks, cloud-hosted environments, or other sources commonly used during attack preparation.
Can Spur IP intelligence improve alert triage and SOC efficiency?
Yes. Spur's infrastructure context can help analysts prioritize alerts, distinguish benign activity from suspicious behavior, and make faster, more informed investigation decisions. This additional context can improve detection fidelity while reducing unnecessary investigation effort.
How does Spur IP intelligence complement existing perimeter security tools?
Perimeter tools such as WAFs, SIEMs, XDRs, IDS/IPS platforms, and threat intelligence feeds are highly effective at detecting known threats and suspicious activity. Spur IP intelligence adds infrastructure context, helping analysts understand whether traffic originates from residential proxies, VPNs, hosting providers, mobile proxies, or other anonymized environments.
Related guides & explainers
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
Fastly No-Code Integration
Connect Monocle to your Fastly service without writing any code. Monocle deploys and manages a Compute service that enforces your policy at the edge.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.