Is it possible to mass set Threat Intelligence IOC Valid Until Date via CLI?

Colton Buys 20 Reputation points
2023-01-17T22:05:18.1033333+00:00

We have hundreds of IOCs in our Sentinel Tenant that do not have a validity date. We would like to set these en masse to prevent false postives?

If so, what would be the script needed?

Thank you.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
989 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,619 questions
Accepted answer
  1. Andrew Blumhardt 9,496 Reputation points Microsoft Employee
    2023-02-09T02:24:33.3133333+00:00

    This is an interesting problem. Your TAXII provider is not setting an expiration date.
    This table automatically purges expired records. The retention setting are ignored and these records will be retained forever without an expiration. As you know these are only valid for so long. There is no easy way to update these records in mass.
    I recommend exporting the table into CSV. Use the purge API to dump the table. Then bulk import the records again with a newly set expiration date. Though this problem will persist if the feed is not improved.

    https://learn.microsoft.com/en-us/rest/api/loganalytics/workspace-purge/purge?tabs=HTTP

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest