Manage indicators

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2
• Microsoft Defender XDR

Want to experience Defender for Endpoint? Sign up for a free trial.

1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

2. Select the tab of the entity type you'd like to manage.

3. Update the details of the indicator and select Save or select the Delete button if you'd like to remove the entity from the list.

Import a list of IoCs

You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.

Download the sample CSV to know the supported column attributes.

1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

2. Select the tab of the entity type you'd like to import indicators for.

3. Select Import > Choose file.

4. Select Import. Repeat for all the files you'd like to import.

5. Select Done.

Note

Only 500 indicators can be uploaded for each batch. Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available at the portal.

The following table shows the supported parameters.

Parameter	Type	Description
indicatorType	Enum	Type of the indicator. Possible values are: FileSha1, FileSha256, IpAddress, DomainName, and Url. Required
indicatorValue	String	Identity of the Indicator entity. Required
action	Enum	The action that is taken if the indicator is discovered in the organization. Possible values are: Allowed, Audit, BlockAndRemediate, Warn, and Block. Required
title	String	Indicator alert title. Required
description	String	Description of the indicator. Required
expirationTime	DateTimeOffset	The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. Optional
severity	Enum	The severity of the indicator. Possible values are: Informational, Low, Medium, and High. Optional
recommendedActions	String	TI indicator alert recommended actions. Optional
rbacGroups	String	Comma-separated list of RBAC groups the indicator would be applied to. Optional
category	String	Category of the alert. Examples include: Execution and credential access. Optional
mitretechniques	String	MITRE techniques code/id (comma separated). For more information, see Enterprise tactics. Optional It's recommended to add a value in category when a MITRE technique.
GenerateAlert	String	Whether the alert should be generated. Possible Values are: True or False. Optional

Note

Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!.

Network indicators do not support the action type, BlockAndRemediate. If a network indicator is set to BlockAndRemediate, it won't import.

Watch this video to learn how Microsoft Defender for Endpoint provides multiple ways to add and manage Indicators of compromise (IoCs).

See also

• Create indicators
• Create indicators for files
• Create indicators for IPs and URLs/domains
• Create indicators based on certificates
• Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.