To learn more, visit the Microsoft Sentinel documentation.

​
Basic Parameters​

ParameterDescription
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Workspace NameThe name of the workspace. Use the Log Analytics List Workspaces action to get workspace names.

​
Advanced Parameters​

ParameterDescription
FilterFilters the results, based on a Boolean condition.
Order BySorts the results.
Skip TokenSkip token is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skip token parameter that specifies a starting point to use for subsequent calls.
TopReturns only the first n results.

​
Example Output​

{    "value": [        {            "id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/27d963e6-e6e4-e0f9-e9d7-c53985b3bbe8",            "name": "27d963e6-e6e4-e0f9-e9d7-c53985b3bbe8",            "etag": "\"00002f2c-0000-0800-0000-5e976a8e0000\"",            "type": "Microsoft.SecurityInsights/ThreatIntelligence",            "kind": "indicator",            "properties": {                "confidence": 90,                "created": "2020-04-15T20:11:57.9666134Z",                "createdByRef": "contoso@contoso.com",                "externalId": "indicator--8516d567-0daa-4614-8745-e3591e1b48cf",                "externalReferences": [],                "granularMarkings": [],                "lastUpdatedTimeUtc": "2020-04-15T20:15:11.0746926Z",                "revoked": false,                "source": "Azure Sentinel",                "threatIntelligenceTags": [                    "new schema"                ],                "displayName": "new schema 2",                "description": "debugging indicators",                "threatTypes": [                    "compromised"                ],                "killChainPhases": [],                "pattern": "[url:value = 'https://www.contoso.com']",                "patternType": "url",                "validFrom": "2020-04-15T17:44:00.114052Z"            }        },        {            "id": "/subscriptions/bd794837-4d29-4647-9105-6339bfdb4e6a/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/ThreatIntelligence/e16ef847-962e-d7b6-9c8b-a33e4bd30e47",            "name": "e16ef847-962e-d7b6-9c8b-a33e4bd30e47",            "etag": "\"00002a2c-0000-0800-0000-5e97683b0000\"",            "type": "Microsoft.SecurityInsights/ThreatIntelligence",            "kind": "indicator",            "properties": {                "confidence": 78,                "created": "2020-04-15T19:51:17.1050923Z",                "createdByRef": "contoso@contoso.com",                "externalId": "indicator--73be1729-babb-4348-a6c4-94621cae2530",                "externalReferences": [],                "granularMarkings": [],                "lastUpdatedTimeUtc": "2020-04-15T20:15:11.074903Z",                "revoked": false,                "source": "Azure Sentinel",                "threatIntelligenceTags": [                    "patching tags"                ],                "displayName": "updated indicator",                "description": "debugging indicators",                "threatTypes": [                    "compromised"                ],                "killChainPhases": [],                "pattern": "[url:value = 'https://www.contoso.com']",                "patternType": "url",                "validFrom": "2020-04-15T17:44:00.114052Z"            }        }    ]}

​
Workflow Library Example​

List Indicators with Microsoft Sentinel and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

List IncidentsMicrosoft Sentinel Custom Action