Append tags to a threat intelligence indicator.

External Documentation

To learn more, visit the Microsoft Sentinel documentation.

​
Parameters

ParameterDescription
NameThreat intelligence indicator name field.
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
TagsList of tags to be appended.
Workspace NameThe name of the workspace.

​
Example Output

{
	"id": "<string>",
	"name": "<string>",
	"etag": "<string>",
	"type": "<string>",
	"kind": "<string>",
	"properties": {
		"confidence": 61,
		"created": "2021-03-04T10:12:21",
		"defanged": true,
		"extensions": {
			"sentinel-ext": {
				"severity": null
			}
		},
		"externalId": "<string>",
		"externalLastUpdatedTimeUtc": "2021-01-26T13:27:36",
		"labels": [
			"<string>"
		],
		"language": "<string>",
		"lastUpdatedTimeUtc": "2023-01-28T09:03:33",
		"source": "<string>",
		"threatIntelligenceTags": [
			"<string>"
		],
		"displayName": "<string>",
		"description": "<string>",
		"parsedPattern": [
			{
				"patternTypeKey": "<string>",
				"patternTypeValues": [
					{
						"valueType": "<string>",
						"value": "<string>"
					}
				]
			}
		],
		"pattern": "<string>",
		"patternType": "<string>",
		"validFrom": "2023-01-05T08:44:08",
		"validUntil": "2021-04-17T06:38:40"
	}
}

​
Workflow Library Example

Append Tags to Indicator with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Append tags to a threat intelligence indicator.

External Documentation

To learn more, visit the Microsoft Sentinel documentation.

​
Parameters

ParameterDescription
NameThreat intelligence indicator name field.
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
TagsList of tags to be appended.
Workspace NameThe name of the workspace.

​
Example Output

{
	"id": "<string>",
	"name": "<string>",
	"etag": "<string>",
	"type": "<string>",
	"kind": "<string>",
	"properties": {
		"confidence": 61,
		"created": "2021-03-04T10:12:21",
		"defanged": true,
		"extensions": {
			"sentinel-ext": {
				"severity": null
			}
		},
		"externalId": "<string>",
		"externalLastUpdatedTimeUtc": "2021-01-26T13:27:36",
		"labels": [
			"<string>"
		],
		"language": "<string>",
		"lastUpdatedTimeUtc": "2023-01-28T09:03:33",
		"source": "<string>",
		"threatIntelligenceTags": [
			"<string>"
		],
		"displayName": "<string>",
		"description": "<string>",
		"parsedPattern": [
			{
				"patternTypeKey": "<string>",
				"patternTypeValues": [
					{
						"valueType": "<string>",
						"value": "<string>"
					}
				]
			}
		],
		"pattern": "<string>",
		"patternType": "<string>",
		"validFrom": "2023-01-05T08:44:08",
		"validUntil": "2021-04-17T06:38:40"
	}
}

​
Workflow Library Example

Append Tags to Indicator with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop