Get Indicator

View a threat intelligence indicator by name.

External Documentation

To learn more, visit the Microsoft Sentinel documentation.

Parameters

Parameter	Description
Name	Threat intelligence indicator name field.
Resource Group Name	The name of the resource group. The name is case insensitive.
Subscription ID	The ID of the target subscription.
Workspace Name	The name of the workspace. Use the Log Analytics List Workspaces action to get workspace names.

Example Output

{
    "id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/e16ef847-962e-d7b6-9c8b-a33e4bd30e47",
    "name": "e16ef847-962e-d7b6-9c8b-a33e4bd30e47",
    "etag": "\"00002a2c-0000-0800-0000-5e97683b0000\"",
    "type": "Microsoft.SecurityInsights/ThreatIntelligence",
    "kind": "indicator",
    "properties": {
        "confidence": 78,
        "created": "2020-04-15T19:51:17.1050923Z",
        "createdByRef": "aztestConnectors@dataconnector.ccsctp.net",
        "externalId": "indicator--73be1729-babb-4348-a6c4-94621cae2530",
        "externalReferences": [],
        "granularMarkings": [],
        "lastUpdatedTimeUtc": "2020-04-15T20:18:49.2259902Z",
        "revoked": false,
        "source": "Azure Sentinel",
        "threatIntelligenceTags": [
            "patching tags"
        ],
        "displayName": "updated indicator",
        "description": "debugging indicators",
        "threatTypes": [
            "compromised"
        ],
        "killChainPhases": [],
        "pattern": "[url:value = 'https://abc.com']",
        "patternType": "url",
        "validFrom": "2020-04-15T17:44:00.114052Z"
    }
}

Workflow Library Example

Get Indicator with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop