Manage indicators

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

  2. Select the tab of the entity type you'd like to manage.

  3. Update the details of the indicator and select Save or select the Delete button if you'd like to remove the entity from the list.

Import a list of IoCs

You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details.

Download the sample CSV to know the supported column attributes.

  1. In the navigation pane, select Settings > Endpoints > Indicators (under Rules).

  2. Select the tab of the entity type you'd like to import indicators for.

  3. Select Import > Choose file.

  4. Select Import. Repeat for all the files you'd like to import.

  5. Select Done.


Only 500 indicators can be uploaded for each batch.

Attempting to import indicators with specific categories requires the string to be written in Pascal case convention and only accepts the category list available at the portal.

The following table shows the supported parameters.

Parameter Type Description
indicatorType Enum Type of the indicator. Possible values are: FileSha1, FileSha256, IpAddress, DomainName, and Url. Required
indicatorValue String Identity of the Indicator entity. Required
action Enum The action that is taken if the indicator is discovered in the organization. Possible values are: Allowed, Audit, BlockAndRemediate, Warn, and Block. Required
title String Indicator alert title. Required
description String Description of the indicator. Required
expirationTime DateTimeOffset The expiration time of the indicator in the following format YYYY-MM-DDTHH:MM:SS.0Z. The indicator gets deleted if the expiration time passes and whatever happens at the expiration time occurs at the seconds (SS) value. Optional
severity Enum The severity of the indicator. Possible values are: Informational, Low, Medium, and High. Optional
recommendedActions String TI indicator alert recommended actions. Optional
rbacGroups String Comma-separated list of RBAC groups the indicator would be applied to. Optional
category String Category of the alert. Examples include: Execution and credential access. Optional
mitretechniques String MITRE techniques code/id (comma separated). For more information, see Enterprise tactics. Optional It's recommended to add a value in category when a MITRE technique.
GenerateAlert String Whether the alert should be generated. Possible Values are: True or False. Optional


Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. For more information, see Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!.

Watch this video to learn how Microsoft Defender for Endpoint provides multiple ways to add and manage Indicators of compromise (IoCs).

See also


Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.