Bulk delete Sentinel Threat Intelligence

Question

Bulk delete Sentinel Threat Intelligence

Anchal Singh 5

I used Workspace Purge Rest API to bulk delete Sentinel threat intelligence. I used the api to remove intelligence from 'ThreatIntelligenceIndicator' table on sentinel but this did not end up deleting them from Sentinel threat intelligence (under Threat management). Removing threat intel from the 'ThreatIntelligenceIndicator' table should reflect on Sentinel Threat Intelligence but I don't understand why it is not reflecting.

User's image

How can i resolve this issue?

Shweta Mathur 30,431 Reputation points Microsoft Employee Moderator

2024-04-08T12:47:40.98+00:00

@Anchal Singh Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Shweta Mathur 30,431 Reputation points Microsoft Employee Moderator

2024-04-08T12:47:40.98+00:00

@Anchal Singh Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Andrew Blumhardt 10,071 Microsoft Employee

I am not sure of the specific cause, but this is not a common practice, though technically feasible. I suspect this will clear up in 12-24 hours. You may need to open a support case if this runs longer.

It may help to consider how this feature functions. The TI view only displays the most recent, unique, active records from the table. Each IOC is given and ID. Any updates are represented as a new record. For example, when a record expires, a new record is written with an inactive flag for the IOC. I assume what you see in the portal is not a direct query. Likely a hidden sub-table that is updated periodically. The purge may have caused an unexpected interruption to this process.

Anchal Singh 5 Reputation points

2024-04-05T14:33:55.5966667+00:00

What other hidden sub-table can sentinel Threat Intelligence be pulling data from?

With the purge API i was able to clear 'ThreatIntelligenceIndicator' table. Proof below:

However it's not deleted on Sentinel threat intelligence. Its been above 48 hours.For the exact same records and IOCs i deleted from the 'ThreatIntelligenceIndicator' table still appear in Threat Intelligence.

Thank you.
Clive Watson 7,951 Reputation points MVP Volunteer Moderator

2024-04-05T15:25:06.1166667+00:00

The value you see may well be from a query the portal is doing on the "potential" data of 2.8m.
If you have deleted the data, then its not looking at that as a source. This is common in the UI. You have 8 TI sources connected so its maybe doing a sum of those?

I normally see bulk delete of TI using these type of methods

seyed-nouraie/Sentinel-Bulk-Threat-Intelligence-Management: Bulk delete sentinel threat intelligence based on specific sources (github.com)

or

rstcloud-mssentinel/Scripts/bulk_ioc_removal at main · rstcloud/rstcloud-mssentinel (github.com)

Share via

Bulk delete Sentinel Threat Intelligence

1 answer

Your answer