Which APIs I should prefer to create indicators in sentinel threat intelligence and in Microsoft defender?

Question

Which APIs I should prefer to create indicators in sentinel threat intelligence and in Microsoft defender?

Bharvi Bhut 181

We will going to develop one data connector from which we need to create an indicators in sentinel threat intelligence and Microsoft defender endpoint.

Can someone please suggest which APIs I should use to

create or update indicators in sentinel? Also I am planning to add every indicator of sentinel to the Microsoft defender endpoint as well, so which APIs I should prefer to
fetch the data of sentinel indicators and
send data into Microsoft defender endpoint.

currently I am referring below reference for APIs
For sentinel threat intelligence : https://learn.microsoft.com/en-us/rest/api/securityinsights/preview/threat-intelligence-indicator/create-indicator?tabs=HTTP#code-try-0
For defender : https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/post-ti-indicator?view=o365-worldwide

JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-04-17T18:41:57.77+00:00

@Bharvi Bhut

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer accepted by question author

Boris Von Dahle 3,226

Hello,

Your choice of APIs is correct for working with Azure Sentinel Threat Intelligence indicators and Microsoft Defender for Endpoint.

To create or update indicators in Azure Sentinel, use the following API:

Create or Update Threat Intelligence Indicator

To fetch the data of Azure Sentinel indicators, use the following API:

List Threat Intelligence Indicators

To create or update indicators in Microsoft Defender for Endpoint, use the following API:

Create or update TI indicator

Here's a high-level workflow for your task:

Call the "List Threat Intelligence Indicators" API to fetch the indicators from Azure Sentinel.
Iterate through the fetched indicators, and for each indicator, perform the following steps:
a. Call the "Create or Update Threat Intelligence Indicator" API to create or update the indicator in Azure Sentinel, if needed.
b. Call the "Create or update TI indicator" API to create or update the indicator in Microsoft Defender for Endpoint.

0 comments

1 additional answer

Your answer

JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-04-17T18:41:57.77+00:00

@Bharvi Bhut

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Andrew Blumhardt 10,071 Microsoft Employee

The Graph Security API can do both. Though support for Sentinel may be going away eventually. There may be an example of this in the Sentinel GitHub repo. https://learn.microsoft.com/en-us/graph/api/resources/tiindicator?view=graph-rest-beta

0 comments

Share via

Which APIs I should prefer to create indicators in sentinel threat intelligence and in Microsoft defender?

1 additional answer

Your answer