> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Or Update Indicator

Create or update a new indicator entity.

The following permissions are required to run this action:

* `Ti.ReadWrite`
* `Ti.ReadWrite.All`

<Note>
  External Documentation

  To learn more, visit the [Microsoft Defender For Endpoints documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/post-ti-indicator).
</Note>

## Basic Parameters

<div className="integrations-table">
  | Parameter       | Description                                                                                              |
  | --------------- | -------------------------------------------------------------------------------------------------------- |
  | Action          | The action that is taken if the indicator is discovered in the organization.                             |
  | Description     | The description of the indicator.                                                                        |
  | Generate Alert  | Select `True` if alert generation is required,and `False` if this indicator shouldn't generate an alert. |
  | Indicator Type  | The type of the indicator entity.                                                                        |
  | Indicator Value | The value to assign to the indicator.                                                                    |
  | Severity        | The severity of the indicator.                                                                           |
  | Title           | The title of the indicator alert.                                                                        |
</div>

## Advanced Parameters

<div className="integrations-table">
  | Parameter           | Description                                                                                                             |
  | ------------------- | ----------------------------------------------------------------------------------------------------------------------- |
  | Application         | A friendly name for the blocked content. If set, it appears in the blocking message instead of the file or domain name. |
  | Educate URL         | A custom notification/support URL. Supported for `Block` and `Warn` action types for URL indicators.                    |
  | Expiration Time     | The expiration time of the indicator.                                                                                   |
  | Rbac Group Names    | A comma-separated list of RBAC group names the indicator would be applied to.                                           |
  | Recommended Actions | Recommended actions for alerts triggered by threat intelligence (TI) indicators.                                        |
</div>

## Example Output

```json theme={"dark"}
{
	"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators/$entity",
	"id": "5",
	"indicatorValue": "230e7d15b011d7fac48f2bd61114db1022197f7f",
	"indicatorType": "FileSha1",
	"action": "BlockAndRemediate",
	"createdBy": "admin@havivblinkops.onmicrosoft.com",
	"severity": "Informational",
	"category": 1,
	"application": "demo-test",
	"educateUrl": null,
	"bypassDurationHours": null,
	"title": "test",
	"description": "test",
	"recommendedActions": "nothing",
	"creationTimeDateTimeUtc": "2025-10-21T12:09:46.0916319Z",
	"expirationTime": "2026-12-12T00:00:00Z",
	"lastUpdateTime": "2025-10-21T12:09:55.7079339Z",
	"lastUpdatedBy": "admin@havivblinkops.onmicrosoft.com",
	"rbacGroupNames": [],
	"rbacGroupIds": [],
	"notificationId": null,
	"notificationBody": null,
	"version": null,
	"mitreTechniques": [],
	"historicalDetection": false,
	"lookBackPeriod": null,
	"generateAlert": true,
	"additionalInfo": null,
	"createdByDisplayName": "admin@havivblinkops.onmicrosoft.com",
	"externalId": null,
	"createdBySource": "Portal",
	"certificateInfo": null
}
```

## Workflow Library Example

[Create or Update Indicator with Microsoft Defender for Endpoints and Send Results Via Email](https://library.blinkops.com/workflows/create-or-update-indicator-with-microsoft-defender-for-endpoints-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/create-or-update-indicator-with-microsoft-defender-for-endpoints-and-send-results-via-email/canvas" />
</div>