Get Indicator

External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

Parameter	Description
Name	Threat intelligence indicator name field.
Resource Group Name	The name of the resource group. The name is case insensitive.
Subscription ID	The ID of the target subscription.
Workspace Name	The name of the workspace.

Parameter

Description

Name

Threat intelligence indicator name field.

Resource Group Name

The name of the resource group. The name is case insensitive.

Subscription ID

The ID of the target subscription.

Workspace Name

The name of the workspace.

Example Output

{
	"id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/e16ef847-962e-d7b6-9c8b-a33e4bd30e47",
	"name": "e16ef847-962e-d7b6-9c8b-a33e4bd30e47",
	"etag": "\"00002a2c-0000-0800-0000-5e97683b0000\"",
	"type": "Microsoft.SecurityInsights/ThreatIntelligence",
	"kind": "indicator",
	"properties": {
		"confidence": 78,
		"created": "2020-04-15T19:51:17.1050923Z",
		"createdByRef": "aztestConnectors@dataconnector.ccsctp.net",
		"externalId": "indicator--73be1729-babb-4348-a6c4-94621cae2530",
		"externalReferences": [],
		"granularMarkings": [],
		"lastUpdatedTimeUtc": "2020-04-15T20:18:49.2259902Z",
		"revoked": false,
		"source": "Azure Sentinel",
		"threatIntelligenceTags": [
			"patching tags"
		],
		"displayName": "updated indicator",
		"description": "debugging indicators",
		"threatTypes": [
			"compromised"
		],
		"killChainPhases": [],
		"pattern": "[url:value = 'https://abc.com']",
		"patternType": "url",
		"validFrom": "2020-04-15T17:44:00.114052Z"
	}
}

Integrations

Parameters

Example Output

Workflow Library Example

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example