To learn more, visit the Microsoft Sentinel documentation.

​
Parameters​

ParameterDescription
NameThreat intelligence indicator name field.
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Workspace NameThe name of the workspace. Use the Log Analytics List Workspaces action to get workspace names.

​
Example Output​

{    "id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/e16ef847-962e-d7b6-9c8b-a33e4bd30e47",    "name": "e16ef847-962e-d7b6-9c8b-a33e4bd30e47",    "etag": "\"00002a2c-0000-0800-0000-5e97683b0000\"",    "type": "Microsoft.SecurityInsights/ThreatIntelligence",    "kind": "indicator",    "properties": {        "confidence": 78,        "created": "2020-04-15T19:51:17.1050923Z",        "createdByRef": "aztestConnectors@dataconnector.ccsctp.net",        "externalId": "indicator--73be1729-babb-4348-a6c4-94621cae2530",        "externalReferences": [],        "granularMarkings": [],        "lastUpdatedTimeUtc": "2020-04-15T20:18:49.2259902Z",        "revoked": false,        "source": "Azure Sentinel",        "threatIntelligenceTags": [            "patching tags"        ],        "displayName": "updated indicator",        "description": "debugging indicators",        "threatTypes": [            "compromised"        ],        "killChainPhases": [],        "pattern": "[url:value = 'https://abc.com']",        "patternType": "url",        "validFrom": "2020-04-15T17:44:00.114052Z"    }}

​
Workflow Library Example​

Get Indicator with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Get IncidentList Alerts For Incident