Append Tags To Indicator - BlinkOps Documentation

Append tags to a threat intelligence indicator.

External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

Parameters

Parameter	Description
Name	Threat intelligence indicator name field.
Resource Group Name	The name of the resource group. The name is case insensitive.
Subscription ID	The ID of the target subscription.
Tags	List of tags to be appended.
Workspace Name	The name of the workspace.

Example Output

{
	"id": "<string>",
	"name": "<string>",
	"etag": "<string>",
	"type": "<string>",
	"kind": "<string>",
	"properties": {
		"confidence": 61,
		"created": "2021-03-04T10:12:21",
		"defanged": true,
		"extensions": {
			"sentinel-ext": {
				"severity": null
			}
		},
		"externalId": "<string>",
		"externalLastUpdatedTimeUtc": "2021-01-26T13:27:36",
		"labels": [
			"<string>"
		],
		"language": "<string>",
		"lastUpdatedTimeUtc": "2023-01-28T09:03:33",
		"source": "<string>",
		"threatIntelligenceTags": [
			"<string>"
		],
		"displayName": "<string>",
		"description": "<string>",
		"parsedPattern": [
			{
				"patternTypeKey": "<string>",
				"patternTypeValues": [
					{
						"valueType": "<string>",
						"value": "<string>"
					}
				]
			}
		],
		"pattern": "<string>",
		"patternType": "<string>",
		"validFrom": "2023-01-05T08:44:08",
		"validUntil": "2021-04-17T06:38:40"
	}
}

Workflow Library Example

Append Tags to Indicator with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Overview Create Indicator

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example