Custom Indicators in Defender ATP

Question

As we have an expiration date for Custom Indicators in ATP, do we have a way to extend that date without creating those indicators (manually or via CSV) in ATP again?

Also, what's the best way to check if Microsoft detects an indicator? I have been checking, for instance, a file hash in ATP to see if Microsoft has additional information about the threat. If it does, does that mean ATP has an automatic detection for it (not through our custom indicator) and perhaps we don't need to have that as an indicator anymore?

Thanks!

Answer 1

@Mallika
Hi,
Based on my research, there is no such way to extend the date.
About the indicator, you could refer to the following article:
https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-unified-indicators-of-compromise-iocs/ba-p/656415
Hope above information can help you.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.